SquirrelScan
The website QA tool for your coding agent: 282 audit rules across SEO, performance, security, accessibility and agent experience, handing your AI agent exact fixes.
- Source repo
- squirrelscan/squirrelscan
- Stars
- ★ 296
- Last updated
- today
- License
- MIT
- Primary language
- TypeScript
- FA score
- 67/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A solo developer runs squirrel audit example.com after shipping a new site to catch SEO and performance regressions early.
- Not a fit if
- Teams that need fully offline use: cloud audits, rendering and the dashboard require the vendor's private hosted services
- Developers on plain Node.js who won't install the Bun 1.4.0 runtime
- Privacy-sensitive teams unwilling to set NO_TELEMETRY, since telemetry is on by default
- Source review
- 67/100 · Some gaps
What does this agent do, and when should you use it?
SquirrelScan is an open source CLI that audits websites for SEO, performance, security, accessibility and agent-experience (AX) issues, and produces exact fix instructions your coding agent can act on. It bundles a fast, memory-efficient crawler with 282 rules across 21 categories, from crawlability through WCAG accessibility coverage. You can run it from the CLI, in the cloud, inside your coding agent via an MCP server (mcp.squirrelscan.com), or through plugins and skills for Claude Code, Cursor, Codex and opencode. Reports score each category and can be emitted as console, JSON, HTML, Markdown, Text, LLM or XML. The repository open sources the complete local CLI, crawler, audit engine, rules, report generators and docs site; the hosted API, website, dashboard and cloud worker are separate private services.
Running squirrel audit example.com crawls the target site and executes 282 rules: robots.txt and sitemap validation, LCP/CLS/TTFB performance hints, HTTPS/HSTS/CSP checks, 61 WCAG accessibility rules, and AX checks for whether GPTBot/Claude-User receive the same content a browser does, plus AGENTS.md and llms.txt discovery. It scores each category and supports -f html for reports, --format llm piped to Claude, -C quick for fast probes, and --rule-include ax,performance to run selected rules. squirrel auth login enables cloud audits and cloud rendering. Connected as an MCP server, it powers a full fix loop: audit, map issues to source files, fix in batches, and re-audit until scores improve.
- A solo developer runs squirrel audit example.com after shipping a new site to catch SEO and performance regressions early.
- A Claude Code user installs the squirrelscan plugin so the agent audits the site, maps issues to source files, and applies batch fixes autonomously.
- A Cursor user adds the MCP server in one click to audit client websites and publish shareable HTML reports.
- An SEO consultant uses smart incremental crawling (ETag, Last-Modified, content hashing, checkpoint resume) to track a large site's evolution and compare crawl history.
- A security team uses site-integrity rules to detect phishing kits, injected doorway pages, obfuscated scripts and leaked credentials.
- An AI product team audits how agent-friendly their site is for GPTBot and Claude-User, including AGENTS.md, llms.txt and Markdown responses.
How do you install or deploy this agent?
macOS/Linux: curl -fsSL https://install.squirrelscan.com | bash; Windows: iwr -useb https://install.squirrelscan.com/install.ps1 | iex; npm: npm install -g squirrelscan; run without installing: npx squirrelscan audit example.com. Claude Code plugin: /plugin marketplace add squirrelscan/squirrelscan then /plugin install squirrelscan@squirrelscan; or MCP only: claude mcp add --transport http squirrelscan https://mcp.squirrelscan.com/mcp. Cursor: click the install badge or add {"mcpServers":{"squirrelscan":{"url":"https://mcp.squirrelscan.com/mcp"}}} to ~/.cursor/mcp.. For development you need Bun 1.4.0: clone the repo and run bun install --frozen-lockfile.
How do you use this agent?
Audit: squirrel audit example.com; HTML report: squirrel audit example.com -f html -o report.html; pipe to Claude: squirrel audit example.com --format llm | claude; quick probe: squirrel audit example.com -C quick; selected rules: squirrel audit example.com --rule-include ax,performance; cloud login: squirrel auth login. Install skills with npx skills add squirrelscan/squirrelscan, then tell your agent: "Use the audit-website skill to audit this site and fix all issues but only crawl 10 pages". Disable telemetry via squirrel self settings set telemetry false or NO_TELEMETRY=1.
What are this agent's strengths and limitations?
- 282 rules in 21 categories including a distinctive Agent Experience category — checking whether GPTBot/Claude-User get browser-equivalent content, AGENTS.md, llms.txt — a dimension most audit tools lack.
- Multiple delivery modes: single-binary zero-dependency CLI, remote MCP server, Claude Code plugin, and Agent Skills, fitting different workflows.
- Strong engineering details: ETag/Last-Modified/content-hash incremental crawling with checkpoint resume, crawl history comparison, seven output formats, shell completions and self-update.
- MIT licensed with the full CLI, crawler, audit engine, rules and report generators open source and auditable.
- Cloud audits, cloud rendering and the dashboard depend on private hosted services requiring squirrel auth login and possibly account credits; not everything runs locally.
- Source development is tied to the Bun 1.4.0 runtime; a plain Node.js environment cannot build it.
- Telemetry is on by default (minimal and opt-out, but privacy-sensitive teams must configure NO_TELEMETRY).
- Contributions require a Developer Certificate of Origin sign-off (git commit -s), adding process overhead for contributors.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| SquirrelScan This agent | 67 · Some gaps | CLIFreemium | ★ 296 | today | TypeScript | Codex · Claude Code |
| Front-End Checklist | 37 · Major gaps | Web appFree | ★ 75k | 18d ago | MDX | — |
| OSS Autopilot | 83 · Good | Agent plugin / skillFree | ★ 23 | today | TypeScript | Claude Code · Claude.ai |
| Context | 74 · Some gaps | MCP serverFree | ★ 428 | 3d ago | TypeScript | Codex · Claude Code · Claude.ai |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows restraint (least-privilege CI, NO_TELEMETRY in workflows) and a dependency-audit job with overrides pinning multiple known-vulnerable packages; but audit:dependencies ignores seven GHSAs with no in-file mitigation rationale, so dependency_security is not full. Telemetry is on by default (opt-out only), costing user_confirmation; cloud MCP, OAuth/API-key auth and telemetry are described but the cloud side is closed-source, so data_flow_transparency and sensitive_data_handling are only adequate. Rollback/self-update recovery is undocumented; DCO, CodeQL and secret-scan support attribution, but publisher identity is unverified so no full marks.
Sample tests show careful coverage of option merging, clamping and WAF false-positive avoidance, with a CI consistency check for test suites — good self-consistency. However the supplied files cover only a few modules, and no concrete failure-message evidence was shown, so failure_messages scores 1.
README addresses multiple audiences (developers, CI, coding agents, MCP clients) and environments (macOS/Linux/Windows, npm, Bun source build) clearly; quick/full profiles and --rule-include give trigger precision; but compatibility boundaries (Node versions, non-Bun builds) are unstated and boundaries lean on external docs.
Information architecture, three-platform install notes and MIT license are thorough; but no CHANGELOG file is visible (only release scripts referencing one), no dedicated known-limitations section, and the open-source/private-service boundary is covered in a single paragraph, so those are docked.
Seven output formats including an LLM-optimized format with embedded fix instructions give strong output_usability evidence. The 282-rule claim is plausible but unverified without execution; cloud-audit credits are mentioned but unexplained, so marginal_value and cost_benefit stay at 2.
Claims trace to tests, golden files, CI workflows and issue references (#513, #267, #1066), which is good traceability; but the example report, rules docs and telemetry claims point to external sites unverifiable from this repository, so cross_source_corroboration is only 1.
- Static review only; no commands were executed and all conclusions rest on repository files.
- audit:dependencies explicitly ignores seven known-vulnerability advisories; verify independently whether those dependencies are reachable in your usage.
- Telemetry and install registration are enabled by default and require NO_TELEMETRY or explicit configuration to disable.
- The hosted MCP server, published reports and cloud workers are closed-source; data flows during cloud audits cannot be verified from this repository.
- The curl | bash installer content was not among the reviewed files; inspect install.sh before running it.
- No visible CHANGELOG or known-limitations section; version behavior differences must be checked manually.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
White-label reports get a website and a footer, and the docs get a report walkthrough. Added - White-label reports can show a website link and footer text. Team and Enterprise organizations that use white-label reports can add a website and a footer line, such as a copyright notice. The report header links the logo or brand name to the website, and the footer shows the text and the website link where the squirrelscan credit was, in HTML, Markdown and text reports, including local reports from a signed-in CLI. Only an https:// website is linked. A report keeps the branding it was pu …View on GitHub ↗ -
Release notes excerpt
Reports can show what passed, score rings tell the truth about color, and the docs get a glossary. Added - squirrel audit and squirrel report take --include-passed, which lists the rules that passed after the issues, in every format: each rule with at least one passing check and no warning or error, with how many pages it passed on, site-wide for a site rule, or pages not recorded for a page rule whose passes name no page. On the HTML report it is one closed line under the findings. JSON gets a passedRules array (ruleId, name, category, scope, pages). A report read …View on GitHub ↗ -
Release notes excerpt
Reports are honest about how much of your site they saw, and the HTML page lets you dismiss every notice. Changed - Summaries keep to one score and the report's own counts. When a report shows its editor's summary (HTML, Markdown, text, XML, JSON, LLM and the console), at most one numeric score survives and /100 never appears, and a sentence that states a page count the report does not have is left out. Older stored summaries get the same treatment. If nothing survives, the summary falls back to the report's own totals instead of going blank. …View on GitHub ↗