Axe MCP Server Version 1.7.0 Release Notes

Release Date

October 12, 2026

Overview

This v1.7.0 release adds support for restricted corporate networks. If your organization requires outbound traffic to go through a proxy, or signs its sites with its own certificate authority (CA), you can now configure the Axe MCP Server to work with them. If you don't use either, nothing changes for you. This release also explains startup and browser problems in plain language.

New Features

Proxy Support

If your network only allows outbound traffic through a proxy, such as Zscaler, you can now set HTTPS_PROXY (or HTTP_PROXY for an http:// axe server) and the server sends all of its traffic to the axe server through that proxy, including startup, API key checks, and remediation. Hosts listed in NO_PROXY connect directly. If you don't set a proxy, the server connects directly, as before.

{
  "env": {
    "HTTPS_PROXY": "http://proxy.example.com:3128",
    "NO_PROXY": "intranet.example.com"
  }
}

• When a proxy is set, the browser that scans your pages uses it too. List any intranet sites you scan in NO_PROXY. With the npm distribution, localhost and other local addresses always connect directly, so scans of local development servers aren't affected. With Docker, add your Docker host's address to NO_PROXY too. See Proxy variables.
• The scan browser can't use a proxy that needs a username and password. The server logs a warning if you set one.
• If the proxy URL the server uses isn't a valid http:// or https:// address, the server stops at startup with a message that names the variable.

If you use OAuth 2.0, also set NODE_USE_ENV_PROXY=1 so the @deque/axe-auth CLI signs you in and refreshes tokens through the proxy. This requires Node.js 22.21 or later. See Proxy variables.

See Proxy variables for details.

Clearer Guidance for Untrusted Certificates

When a scan fails because the browser doesn't trust the page's certificate, your agent now tells you how to fix it:

• Linux and Docker — set NODE_EXTRA_CA_CERTS to the CA that signed the certificate, then restart the server.
• macOS — add the CA to your login keychain, trusted for SSL only.
• Windows — add the CA to your Current User Trusted Root store, trusted for SSL only.

See Untrusted certificates for the full steps.

IGT Timeouts Say Where the Run Stopped

When an Intelligent Guided Test times out, the error now names the last step it reached and how long ago, which makes a stuck test much easier to diagnose:

IGT timed out after 200000ms (last checkpoint: keyboard:tabstops:start 83s ago; last step: analyze-tabstops-ai 61s ago; last tick 2s ago)

Bug Fixes

• Custom CA certificates now work in the scan browser on Linux and Docker. Before, NODE_EXTRA_CA_CERTS never reached the browser, so pages signed by an internal CA failed to scan.
• Setting NODE_EXTRA_CA_CERTS no longer stops startup on macOS and Windows. The server now starts normally and tells you which system certificate store to use instead.
• Startup explains why a custom Chrome can't launch. If AXE_CHROME_PATH points at a browser that can't start, the server now says why. Before, it reported the browser as missing.
• Missing system libraries are reported when you use a custom Chrome. When AXE_CHROME_PATH is set, launch errors keep their full diagnostics, including the fix for missing Linux libraries.
• Configuration errors are readable. An invalid setting now produces a message that names the setting, instead of a raw AssertionError stack trace.
• Fixed broken documentation links in server messages.