squirrelscan

Official17 toolsLive

by squirrelscan · TypeScript

Website QA for your coding agent: audit SEO, performance, security, accessibility over MCP.

MCP Server: com.squirrelscan/squirrelscan

This MCP server exposes squirrelscan, an Open Source CLI tool for auditing websites. It checks for issues related to SEO, performance, security, accessibility, and agent experience, and is designed to provide exact fixes for a coding agent. It can be run via CLI, inside an agent, in the cloud, or over MCP.

🛠️ Key Features

Website QA audits for SEO, performance, security, accessibility
Includes agent experience and “other issues”
Provides exact fixes
Available as an MCP integration
Identified tool count: 17

🚀 Use Cases

Auditing a website before or during development
Running the same checks from a coding agent over MCP
Performing audits in CLI, cloud, or agent-driven workflows

⚡ Developer Benefits

Deterministic and extensible audit tool (as described)
Coding-agent oriented outputs: “exact fixes”
Topics covered: agent, audit, cli, llm, performance, seo, website

⚠️ Limitations

Limited documentation provided here: only the general audit scope and “exact fixes” are described.

Topics

agentauditclillmperformanceseowebsite

Captured live from the server via tools/list.

run_audit

Run a cloud audit of a website (crawl + 260+ rule analysis + report). Credits are spent as the audit runs (pay-as-you-go). Call once without confirm to get a credit estimate; if the response has status "confirmation_required", show the estimate to the user and call again with confirm: true. Audits are asynchronous and take minutes: poll get_audit_status with the returned run_id, then fetch results with get_report. The website is registered automatically on first audit.

Parameters5

url	string	required	Website URL to audit, e.g. https://example.com (scheme optional).
confirm	boolean	optional	Approve the credit spend. Omit on the first call to see the estimate; set true to start the audit after the user approves.
max_credits	integer	optional	Spend guard: refuse to start if the upper-bound estimate exceeds this many credits.
coverage	string	optional	Crawl coverage profile (default fast). Deeper coverage crawls more pages and costs more credits.
render	boolean	optional	Render pages in a headless browser (default true). Catches JavaScript-dependent issues; costs extra credits per page.

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Website URL to audit, e.g. https://example.com (scheme optional)."
    },
    "confirm": {
      "type": "boolean",
      "description": "Approve the credit spend. Omit on the first call to see the estimate; set true to start the audit after the user approves."
    },
    "max_credits": {
      "type": "integer",
      "exclusiveMinimum": 0,
      "description": "Spend guard: refuse to start if the upper-bound estimate exceeds this many credits."
    },
    "coverage": {
      "type": "string",
      "enum": [
        "fast",
        "surface",
        "deep",
        "full"
      ],
      "description": "Crawl coverage profile (default fast). Deeper coverage crawls more pages and costs more credits."
    },
    "render": {
      "type": "boolean",
      "description": "Render pages in a headless browser (default true). Catches JavaScript-dependent issues; costs extra credits per page."
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

get_audit_status

Poll a running audit by run_id (from run_audit or list_audits). Status pending/running means keep polling (every 15-30 seconds) — the response includes a progress field (phase, message, page/link counts) when available. Status completed means the report is ready: call get_report with the same run_id. Status failed/cancelled includes the error and completion reason.

Parameters1

run_id

string

required

Run id returned by run_audit or listed by list_audits.

Raw schema

{
  "type": "object",
  "properties": {
    "run_id": {
      "type": "string",
      "description": "Run id returned by run_audit or listed by list_audits."
    }
  },
  "required": [
    "run_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

list_audits

List the organization's audit runs: currently active (pending/running) plus the most recent runs of any status. Use the run ids with get_audit_status or get_report, and website ids with list_issues.

Parameters1

limit

integer

optional

Max recent runs to return (default 20).

Raw schema

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 50,
      "description": "Max recent runs to return (default 20)."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

list_websites

List websites the organization has audited, with their latest run status and health score. Use the website_id with list_issues/get_issue. Websites registered but never audited do not appear; run_audit or add_website registers a new one. Returns total/has_more for pagination.

Parameters2

limit	integer	optional	Page size (default 50).
offset	integer	optional	Pagination offset (default 0).

Raw schema

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 100,
      "description": "Page size (default 50)."
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset (default 0)."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

add_website

Register a website with the organization without running an audit (run_audit registers automatically, so this is only needed to set a site up ahead of time). Returns the website_id; idempotent per domain, so calling it again returns the existing website.

Parameters1

url

string

required

Website URL to register, e.g. https://example.com (scheme optional).

Raw schema

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string",
      "description": "Website URL to register, e.g. https://example.com (scheme optional)."
    }
  },
  "required": [
    "url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

delete_website

Delete a website from the organization (soft delete: past audits, reports, and issues are preserved, and published report links keep working). Frees a slot under the plan's website limit. Re-adding the same domain later registers a fresh website with a new website_id. Call once without confirm to see what will happen; call again with confirm: true to delete.

Parameters2

website_id	string	required	Website id from list_websites, run_audit, or add_website.
confirm	boolean	optional	Approve the deletion. Omit on the first call to see the effect; set true to delete after the user approves.

Raw schema

{
  "type": "object",
  "properties": {
    "website_id": {
      "type": "string",
      "description": "Website id from list_websites, run_audit, or add_website."
    },
    "confirm": {
      "type": "boolean",
      "description": "Approve the deletion. Omit on the first call to see the effect; set true to delete after the user approves."
    }
  },
  "required": [
    "website_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

get_report

Fetch the finished report for an audit run (use the run_id from run_audit once get_audit_status shows completed). Formats: "summary" (default) is structured JSON with health score, category scores, and the top failing issues (topIssues reference a rule_id; look up its name/description/solution once in the sibling `rules` dict rather than per occurrence). Each topIssues row carries `provenance`: "carried" means the finding is re-injected from a page not re-crawled this run (not a fresh result) — check `lastSeenAt` for when it was last actually observed. `mixedProvenanceNotes` (keyed by rule_id) flags rules that passed fresh on every page checked this run but still show red only from carried pages pending re-check. Also includes a `history` array of prior audits of this website with score/issue deltas when available; "llm" is a compact text rendering optimized for LLM context (carried findings marked inline); "markdown" is a full human-readable report. Start with summary, then pull llm or markdown when you need every issue and page detail.

Parameters3

run_id	string	required	Run id returned by run_audit or listed by list_audits.
format	string	optional	summary (default): JSON scores + top issues. llm: compact text for LLM context. markdown: full report.
top_issue_limit	integer	optional	summary format only: max top issues to include (default 25).

Raw schema

{
  "type": "object",
  "properties": {
    "run_id": {
      "type": "string",
      "description": "Run id returned by run_audit or listed by list_audits."
    },
    "format": {
      "type": "string",
      "enum": [
        "summary",
        "llm",
        "markdown"
      ],
      "description": "summary (default): JSON scores + top issues. llm: compact text for LLM context. markdown: full report."
    },
    "top_issue_limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 100,
      "description": "summary format only: max top issues to include (default 25)."
    }
  },
  "required": [
    "run_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

list_issues

List a website's open audit issues (like a bug tracker: each issue is one failing rule with occurrences across pages, numbered per website). Returns issues sorted by severity, plus severity and status summaries. Use the issue number with get_issue for full detail and comments. Filter by status/severity/category to narrow down.

Parameters6

website_id	string	required	Website id from list_websites, run_audit, or list_audits.
status	string	optional	Filter by issue status (omit for all statuses).
severity	string	optional	Filter by severity.
category	string	optional	Filter by rule category code (e.g. seo, performance, security).
limit	integer	optional	Page size (default 50).
offset	integer	optional	Pagination offset (default 0).

Raw schema

{
  "type": "object",
  "properties": {
    "website_id": {
      "type": "string",
      "description": "Website id from list_websites, run_audit, or list_audits."
    },
    "status": {
      "type": "string",
      "enum": [
        "open",
        "in_progress",
        "resolved",
        "dismissed",
        "wontfix"
      ],
      "description": "Filter by issue status (omit for all statuses)."
    },
    "severity": {
      "type": "string",
      "enum": [
        "critical",
        "high",
        "medium",
        "low"
      ],
      "description": "Filter by severity."
    },
    "category": {
      "type": "string",
      "description": "Filter by rule category code (e.g. seo, performance, security)."
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 100,
      "description": "Page size (default 50)."
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset (default 0)."
    }
  },
  "required": [
    "website_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

get_issue

Fetch one issue by website_id + issue number, including its full description, recommendation, affected pages, occurrence detail from the latest report (which page/image/URL, snippets), and comment thread. Use comment_on_issue to add analysis or a fix note to the thread.

Parameters3

website_id	string	required	Website id the issue belongs to.
issue_number	integer	required	Issue number from list_issues.
occurrence_limit	integer	optional	Max occurrences to include (default 20); see occurrence_count/truncated.

Raw schema

{
  "type": "object",
  "properties": {
    "website_id": {
      "type": "string",
      "description": "Website id the issue belongs to."
    },
    "issue_number": {
      "type": "integer",
      "minimum": 1,
      "description": "Issue number from list_issues."
    },
    "occurrence_limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 100,
      "description": "Max occurrences to include (default 20); see occurrence_count/truncated."
    }
  },
  "required": [
    "website_id",
    "issue_number"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

comment_on_issue

Post a comment on a website issue — use it to record analysis, a proposed fix, or what you changed, so the team sees it in the dashboard issue thread. Markdown is supported.

Parameters3

website_id	string	required	Website id the issue belongs to.
issue_number	integer	required	Issue number from list_issues.
body	string	required	Comment body (markdown supported).

Raw schema

{
  "type": "object",
  "properties": {
    "website_id": {
      "type": "string",
      "description": "Website id the issue belongs to."
    },
    "issue_number": {
      "type": "integer",
      "minimum": 1,
      "description": "Issue number from list_issues."
    },
    "body": {
      "type": "string",
      "minLength": 1,
      "maxLength": 10000,
      "description": "Comment body (markdown supported)."
    }
  },
  "required": [
    "website_id",
    "issue_number",
    "body"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

list_rules

Browse the catalog of 260+ audit rules that run during an audit, grouped into categories (crawlability, meta tags, performance, security, accessibility, content, and more). Filter by category code or search by keyword to find what a specific rule checks. Use get_rule for one rule's full detail.

Parameters2

category	string	optional	Filter to one category code (see the categories list in the response).
search	string	optional	Case-insensitive keyword match on rule id, name, and description.

Raw schema

{
  "type": "object",
  "properties": {
    "category": {
      "type": "string",
      "description": "Filter to one category code (see the categories list in the response)."
    },
    "search": {
      "type": "string",
      "description": "Case-insensitive keyword match on rule id, name, and description."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

get_rule

Fetch one audit rule by id (e.g. "meta/title-length"), including what it checks, how to fix it (recommendation), its severity and score weight, a docs link, and whether it is a cloud (credit-billed) rule. Rule ids appear in report topIssues and issue rule_id fields.

Parameters1

rule_id

string

required

Rule id like "crawl/canonical-chain" (category/slug).

Raw schema

{
  "type": "object",
  "properties": {
    "rule_id": {
      "type": "string",
      "description": "Rule id like \"crawl/canonical-chain\" (category/slug)."
    }
  },
  "required": [
    "rule_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

whoami

Identify the current credentials: how you are authenticated, which organization you act for, the plan, and the current credit balance. Call this first in a session to orient yourself before running audits.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "$schema": "http://json-schema.org/draft-07/schema#"
}

get_credit_balance

Get the organization's credit balance: monthly credits (reset each billing period) and pack credits (purchased, never expire). Audits spend credits pay-as-you-go while they run; run_audit shows an upper-bound estimate before starting. Top up at https://app.squirrelscan.com/billing.

Parameters

No parameters.

Raw schema

{
  "type": "object",
  "properties": {},
  "$schema": "http://json-schema.org/draft-07/schema#"
}

list_credit_transactions

Audit the organization's credit accounting log: grants (signup/monthly/pack/promo), debits (audit_base 50cr + render 2cr/page + folded 0-cost services), refunds, and adjustments — newest first, paginated. Each debit/refund carries `run_id` so you can group a single audit's spend. Use this to explain why an audit cost what it cost or to reconcile a balance. For one audit's per-feature breakdown, use get_report (its `cost` field). Read-only.

Parameters2

limit	integer	optional	Max transactions to return (default 25, max 100).
cursor	string	optional	Opaque pagination cursor from a previous page's `next_cursor`.

Raw schema

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 100,
      "description": "Max transactions to return (default 25, max 100)."
    },
    "cursor": {
      "type": "string",
      "description": "Opaque pagination cursor from a previous page's `next_cursor`."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

create_api_key

Mint a new squirrelscan API key for this organization (requires credentials carrying the keys:write scope, which OAuth sign-in grants). The key is returned EXACTLY ONCE: show it to the user immediately and suggest saving it as the SQUIRRELSCAN_API_KEY environment variable for the CLI, CI, and MCP. Minted keys cannot themselves mint keys.

Parameters3

name	string	required	Human-readable label shown in the dashboard, e.g. "ci" or "claude-code".
scopes	array	optional	Scopes to grant (default: audits:write, audits:read, credits:read, org:read). Grantable: audits:write, audits:read, credits:read, org:read, org:write.
expires_in_days	integer	optional	Expire the key after this many days (default: never expires).

Raw schema

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "minLength": 1,
      "maxLength": 100,
      "description": "Human-readable label shown in the dashboard, e.g. \"ci\" or \"claude-code\"."
    },
    "scopes": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Scopes to grant (default: audits:write, audits:read, credits:read, org:read). Grantable: audits:write, audits:read, credits:read, org:read, org:write."
    },
    "expires_in_days": {
      "type": "integer",
      "minimum": 1,
      "maximum": 365,
      "description": "Expire the key after this many days (default: never expires)."
    }
  },
  "required": [
    "name"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

send_feedback

Report your experience using squirrelscan mid-session: a bug, a missing feature, what worked, what confused you, missing report data, or tool ergonomics. Reviewed by the team to improve the product — use it any time something surprises you, not just at the end of a session. Works with any authenticated credentials, including read-only API keys.

Parameters4

category	string	required	bug_report (a defect in squirrelscan itself — wrong or missing rule result, crash, broken tool), feature_request (something squirrelscan should do but doesn't), what_worked (something worked well), confusing (unclear response/behavior), missing_data (a report or tool response was missing something you needed), tool_ergonomics (awkward tool shape/args/naming), or other.
message	string	required	Free-text feedback (truncated at 2000 chars).
run_id	string	optional	Audit run id this feedback relates to, if any (from run_audit/get_report). Verified against your credentials' runs before being attached.
website_id	string	optional	Website id this feedback relates to, if any (from list_websites). Verified against your org's websites before being attached.

Raw schema

{
  "type": "object",
  "properties": {
    "category": {
      "type": "string",
      "enum": [
        "bug_report",
        "feature_request",
        "what_worked",
        "confusing",
        "missing_data",
        "tool_ergonomics",
        "other"
      ],
      "description": "bug_report (a defect in squirrelscan itself — wrong or missing rule result, crash, broken tool), feature_request (something squirrelscan should do but doesn't), what_worked (something worked well), confusing (unclear response/behavior), missing_data (a report or tool response was missing something you needed), tool_ergonomics (awkward tool shape/args/naming), or other."
    },
    "message": {
      "type": "string",
      "minLength": 1,
      "description": "Free-text feedback (truncated at 2000 chars)."
    },
    "run_id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128,
      "description": "Audit run id this feedback relates to, if any (from run_audit/get_report). Verified against your credentials' runs before being attached."
    },
    "website_id": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128,
      "description": "Website id this feedback relates to, if any (from list_websites). Verified against your org's websites before being attached."
    }
  },
  "required": [
    "category",
    "message"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

README.md12 KBView on GitHub

squirrelscan

The website QA tool for your coding agent

squirrelscan is an Open Source cli tool that audits websites for SEO, performance, security, accessibility, agent experience and other issues, and gives your coding agent exact fixes. Run it from the CLI, inside your coding agent, in the cloud, or over MCP.

Combine your coding agent with a deterministic and extensible audit tool.

Features

295 Rules, 21 Categories - Comprehensive coverage across SEO, accessibility, performance, and security
Fast crawler - Highly optimized memory efficient crawler
Agent Experience - Audit agent experience to assist agents in using your site
Security Audit - Detect phishing kits, leaked credentials, and more
Smart Incremental Crawling - ETag, Last-Modified, content hashing. Resume from checkpoints.
Developer-First CLI - Single binary, zero dependencies, shell completions, self-update
Crawl History & Changes - Track site evolution, compare crawls, spot regressions
Multiple Output Formats - Console, JSON, HTML, Markdown, Text, LLM, XML
MCP Connection - Connect your agent to local or cloud MCP to run audits, fixes, etc.

Rule categories

Ordered by how much a failure usually costs you, not by how many rules each one has.

Category	Rules	What it covers
Crawlability	20	Whether search engines and agents can reach and index you at all: robots.txt, sitemap validity and coverage, indexability conflicts, redirect and canonical chains, soft 404s
Core SEO	14	The per-page fundamentals: title, meta description, H1, canonical, charset, doctype, robots meta, Open Graph and Twitter cards, plus canonical form drift across the site
Agent Experience	17	How ready you are for AI agents to read, discover and act on the site: whether GPTBot and Claude-User get the same content a browser does, AGENTS.md, llms.txt, Markdown responses, API and MCP discovery, licensing and noai signals, pay-per-crawl, response token weight
Site Integrity	9	Signs the site has been compromised: injected doorway pages, phishing kit signatures, obfuscated scripts, brand impersonation, cloaking, known-malicious URLs
Security	16	Transport and header hygiene: HTTPS and HSTS, CSP, cookie flags, mixed content, subresource integrity, leaked secrets, unprotected and downgraded forms
Links	15	Internal and external link health: broken and dead links, redirect chains, anchor-text quality, orphan and dead-end pages, pages linked only from sitewide chrome, HTTPS downgrades
Content	21	Text quality and honesty: duplicate titles and descriptions, title-template consistency, readability, word count, freshness, heading hierarchy, keyword stuffing, hidden text, encoding damage
Performance	30	Core Web Vitals and delivery: LCP, CLS and INP hints, TTFB, compression, caching, render-blocking resources, DOM size, font delivery, legacy and unminified JS/CSS
Images	15	Alt text, modern formats, responsive `srcset`, intrinsic dimensions and aspect-ratio mismatches, lazy loading above versus below the fold, file weight
Structured Data	25	JSON-LD validity and rich-result eligibility for Article, Product, FAQ, Review, Breadcrumb, Organization, LocalBusiness, Video and site search, plus thirteen site-wide checks on the entity map: whether the site declares one identity for itself or a new one on every page, and rating markup that is not about the page it sits on
Accessibility	61	WCAG coverage: ARIA roles and names, form labels and autocomplete tokens, colour contrast, heading order, landmarks, tables and lists, focus visibility, touch targets, captions
Mobile	6	Viewport configuration, tap-target size, legible font sizes, horizontal scroll, blocked zoom, intrusive interstitials
Social Media	5	Open Graph and Twitter Card completeness, image dimensions, canonical URL match, social profile links, site-chrome assets that disagree across pages
URL Structure	9	Length, casing, hyphenation, stop words, query parameters, special characters, trailing-slash consistency, site-wide convention consistency
E-E-A-T	15	Experience, expertise, authority and trust signals: author bylines and credentials, about and contact pages, citations, editorial policy, disclaimers, YMYL detection
Legal Compliance	4	Privacy policy, terms of service, real cookie-consent machinery, subprocessor disclosure
Internationalization	2	hreflang correctness and the document language declaration
Local SEO	3	NAP (name, address, phone) consistency across every crawled page, geo metadata, service-area businesses
Video	3	VideoObject markup, captions and accessibility, thumbnails
Analytics	2	Google Tag Manager presence and consent-mode wiring
Blocking	3	Content, links and trackers that ad blockers and privacy filters strip for a large share of your visitors

Total: 295 rules across 21 categories

See the rules reference for full details.

CLI

Installation

macOS / Linux:

bash

curl -fsSL https://install.squirrelscan.com | bash

Windows:

powershell

iwr -useb https://install.squirrelscan.com/install.ps1 | iex

npm (all platforms):

bash

npm install -g squirrelscan

npx (run without installing):

bash

npx squirrelscan audit example.com

Quick start

bash

# Audit a website
squirrel audit example.com

# Generate HTML report
squirrel audit example.com -f html -o report.html

# Pipe to Claude for AI analysis
squirrel audit example.com --format llm | claude

# Quick audit for fast initial probe (other options surface, full)
squirrel audit example.com -C quick

# run only agent experience and performance rules
squirrel audit example.com --rule-include ax,performance

# login for cloud audits and cloud rendering
squirrel auth login

Reports

Category scores for SEO, performance, security and Agent Experience (AX). Publish reports to the web to share with team members or coding agents (fix instructions are embedded)

squirrelscan report

see an example report

Add to your coding agent

squirrelscan ships as an MCP server (hosted at mcp.squirrelscan.com), skills (autonomous audit + fix workflows), and a plugin for Claude Code and Cursor. Cursor installs in one click from the badge above; the rest are a single copy-paste.

Cursor

Click the Add to Cursor badge above, or add it manually to ~/.cursor/mcp.json:

json

{
  "mcpServers": {
    "squirrelscan": { "url": "https://mcp.squirrelscan.com/mcp" }
  }
}

Skills: npx skills add squirrelscan/squirrelscan

Claude Code

Install the plugin (bundles skills + the MCP server):

code

/plugin marketplace add squirrelscan/squirrelscan
/plugin install squirrelscan@squirrelscan

Or add just the MCP server:

bash

claude mcp add --transport http squirrelscan https://mcp.squirrelscan.com/mcp

OpenAI Codex

Add the server to ~/.codex/config.toml:

toml

[mcp_servers.squirrelscan]
url = "https://mcp.squirrelscan.com/mcp"

Codex reads Agent Skills from ~/.agents/skills, so skills work too: npx skills add squirrelscan/squirrelscan

opencode

Add the server to opencode.json:

json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "squirrelscan": {
      "type": "remote",
      "url": "https://mcp.squirrelscan.com/mcp",
      "enabled": true
    }
  }
}

Any MCP client

squirrelscan is in the MCP Registry as com.squirrelscan/squirrelscan. Point any client at the remote server:

code

https://mcp.squirrelscan.com/mcp

Authentication is per-user OAuth (or pass a squirrelscan API key as a Bearer token). Skills follow the Agent Skills standard: npx skills add squirrelscan/squirrelscan lands them in .agents/skills/.

Skills

Two skills drive agent workflows:

squirrelscan - operating the CLI: install, login, keys, credits, running audits, publishing reports, MCP setup, config, troubleshooting.
audit-website - the full fix loop: audit, map issues to source files, fix in batches, re-audit until the site scores well.

bash

npx skills add squirrelscan/squirrelscan

Then, in your agent:

code

Use the audit-website skill to audit this site and fix all issues but only crawl 10 pages

Output formats

Format	Flag	Use Case
Console	(default)	Human-readable terminal output
JSON	`-f json`	CI/CD, programmatic processing
HTML	`-f html`	Visual reports for sharing
Markdown	`-f markdown`	Documentation, GitHub
Text	`-f text`	Clean output for piping to LLMs
LLM	`-f llm`	LLM optimized output
XML	`-f xml`	XML output

Source and development

The complete local CLI, crawler, audit engine, rules, report generators, CLI-facing cloud clients, and documentation site are open source in this repository. The hosted API, website, dashboard, and cloud worker implementations are separate private services.

Prerequisites: Bun 1.4.0 and Git.

bash

git clone https://github.com/squirrelscan/squirrelscan.git
cd squirrelscan
bun install --frozen-lockfile
bun run dev -- audit https://example.com --max-pages 10

Run the same checks used in pull requests:

bash

bun run format:check
bun run lint
bun run typecheck
bun test
bun run build
bun run docs:check
bun run docs:build

See CONTRIBUTING.md before opening a pull request. Contributions require a Developer Certificate of Origin sign-off (git commit -s).

Telemetry

Telemetry is enabled by default and is deliberately minimal: event name, CLI version, a random install ID, and bounded error categories. It does not send credentials, URLs, report contents, or raw error messages, and telemetry requests are never authenticated.

Disable it permanently with:

bash

squirrel self settings set telemetry false

Or disable all telemetry and install registration for any invocation by defining NO_TELEMETRY. Any defined value works, including an empty value, 0, or false:

bash

NO_TELEMETRY=1 squirrel audit https://example.com

License

The CLI and the repository contents are licensed under the MIT License. squirrelscan names and logos are covered by TRADEMARKS.md.

Install

Tools (17)

run_auditget_audit_statuslist_auditslist_websitesadd_websitedelete_websiteget_reportlist_issues

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://mcp.squirrelscan.com/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "squirrelscan": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.squirrelscan.com/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

MCP Server: com.squirrelscan/squirrelscan

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

run_audit

get_audit_status

list_audits

list_websites

add_website

delete_website

get_report

list_issues

get_issue

comment_on_issue

list_rules

get_rule

whoami

get_credit_balance

list_credit_transactions

create_api_key

send_feedback

squirrelscan

Features

Rule categories

CLI

Installation

Quick start

Reports

Add to your coding agent

Cursor

Claude Code

OpenAI Codex

opencode

Any MCP client

Skills

Output formats

Source and development

Telemetry

Links

License

Install

Remote endpoint

Related servers