SquirrelScan
The website QA tool for your coding agent: 282 audit rules across SEO, performance, security, accessibility and agent experience, handing your AI agent exact fixes.
Evidence shows restraint (least-privilege CI, NO_TELEMETRY in workflows) and a dependency-audit job with overrides pinning multiple known-vulnerable packages; but audit:dependencies ignores seven GHSAs with no in-file mitigation rationale, so dependency_security is not full. Telemetry is on by default (opt-out only), costing user_confirmation; cloud MCP, OAuth/API-key auth and telemetry are described but the cloud side is closed-source, so data_flow_transparency and sensitive_data_handling are only adequate. Rollback/self-update recovery is undocumented; DCO, CodeQL and secret-scan support attribution, but publisher identity is unverified so no full marks.
Sample tests show careful coverage of option merging, clamping and WAF false-positive avoidance, with a CI consistency check for test suites — good self-consistency. However the supplied files cover only a few modules, and no concrete failure-message evidence was shown, so failure_messages scores 1.
README addresses multiple audiences (developers, CI, coding agents, MCP clients) and environments (macOS/Linux/Windows, npm, Bun source build) clearly; quick/full profiles and --rule-include give trigger precision; but compatibility boundaries (Node versions, non-Bun builds) are unstated and boundaries lean on external docs.
Information architecture, three-platform install notes and MIT license are thorough; but no CHANGELOG file is visible (only release scripts referencing one), no dedicated known-limitations section, and the open-source/private-service boundary is covered in a single paragraph, so those are docked.
Seven output formats including an LLM-optimized format with embedded fix instructions give strong output_usability evidence. The 282-rule claim is plausible but unverified without execution; cloud-audit credits are mentioned but unexplained, so marginal_value and cost_benefit stay at 2.
Claims trace to tests, golden files, CI workflows and issue references (#513, #267, #1066), which is good traceability; but the example report, rules docs and telemetry claims point to external sites unverifiable from this repository, so cross_source_corroboration is only 1.
- Static review only; no commands were executed and all conclusions rest on repository files.
- audit:dependencies explicitly ignores seven known-vulnerability advisories; verify independently whether those dependencies are reachable in your usage.
- Telemetry and install registration are enabled by default and require NO_TELEMETRY or explicit configuration to disable.
- The hosted MCP server, published reports and cloud workers are closed-source; data flows during cloud audits cannot be verified from this repository.
- The curl | bash installer content was not among the reviewed files; inspect install.sh before running it.
- No visible CHANGELOG or known-limitations section; version behavior differences must be checked manually.
What does this agent do, and when should you use it?
SquirrelScan is an open source CLI that audits websites for SEO, performance, security, accessibility and agent-experience (AX) issues, and produces exact fix instructions your coding agent can act on. It bundles a fast, memory-efficient crawler with 282 rules across 21 categories, from crawlability through WCAG accessibility coverage. You can run it from the CLI, in the cloud, inside your coding agent via an MCP server (mcp.squirrelscan.com), or through plugins and skills for Claude Code, Cursor, Codex and opencode. Reports score each category and can be emitted as console, JSON, HTML, Markdown, Text, LLM or XML. The repository open sources the complete local CLI, crawler, audit engine, rules, report generators and docs site; the hosted API, website, dashboard and cloud worker are separate private services.
Running squirrel audit example.com crawls the target site and executes 282 rules: robots.txt and sitemap validation, LCP/CLS/TTFB performance hints, HTTPS/HSTS/CSP checks, 61 WCAG accessibility rules, and AX checks for whether GPTBot/Claude-User receive the same content a browser does, plus AGENTS.md and llms.txt discovery. It scores each category and supports -f html for reports, --format llm piped to Claude, -C quick for fast probes, and --rule-include ax,performance to run selected rules. squirrel auth login enables cloud audits and cloud rendering. Connected as an MCP server, it powers a full fix loop: audit, map issues to source files, fix in batches, and re-audit until scores improve.
- A solo developer runs squirrel audit example.com after shipping a new site to catch SEO and performance regressions early.
- A Claude Code user installs the squirrelscan plugin so the agent audits the site, maps issues to source files, and applies batch fixes autonomously.
- A Cursor user adds the MCP server in one click to audit client websites and publish shareable HTML reports.
- An SEO consultant uses smart incremental crawling (ETag, Last-Modified, content hashing, checkpoint resume) to track a large site's evolution and compare crawl history.
- A security team uses site-integrity rules to detect phishing kits, injected doorway pages, obfuscated scripts and leaked credentials.
- An AI product team audits how agent-friendly their site is for GPTBot and Claude-User, including AGENTS.md, llms.txt and Markdown responses.
What are this agent's strengths and limitations?
- 282 rules in 21 categories including a distinctive Agent Experience category — checking whether GPTBot/Claude-User get browser-equivalent content, AGENTS.md, llms.txt — a dimension most audit tools lack.
- Multiple delivery modes: single-binary zero-dependency CLI, remote MCP server, Claude Code plugin, and Agent Skills, fitting different workflows.
- Strong engineering details: ETag/Last-Modified/content-hash incremental crawling with checkpoint resume, crawl history comparison, seven output formats, shell completions and self-update.
- MIT licensed with the full CLI, crawler, audit engine, rules and report generators open source and auditable.
- Cloud audits, cloud rendering and the dashboard depend on private hosted services requiring squirrel auth login and possibly account credits; not everything runs locally.
- Source development is tied to the Bun 1.4.0 runtime; a plain Node.js environment cannot build it.
- Telemetry is on by default (minimal and opt-out, but privacy-sensitive teams must configure NO_TELEMETRY).
- Contributions require a Developer Certificate of Origin sign-off (git commit -s), adding process overhead for contributors.
How do you install or deploy this agent?
macOS/Linux: curl -fsSL https://install.squirrelscan.com | bash; Windows: iwr -useb https://install.squirrelscan.com/install.ps1 | iex; npm: npm install -g squirrelscan; run without installing: npx squirrelscan audit example.com. Claude Code plugin: /plugin marketplace add squirrelscan/squirrelscan then /plugin install squirrelscan@squirrelscan; or MCP only: claude mcp add --transport http squirrelscan https://mcp.squirrelscan.com/mcp. Cursor: click the install badge or add {"mcpServers":{"squirrelscan":{"url":"https://mcp.squirrelscan.com/mcp"}}} to ~/.cursor/mcp.. For development you need Bun 1.4.0: clone the repo and run bun install --frozen-lockfile.
How do you use this agent?
Audit: squirrel audit example.com; HTML report: squirrel audit example.com -f html -o report.html; pipe to Claude: squirrel audit example.com --format llm | claude; quick probe: squirrel audit example.com -C quick; selected rules: squirrel audit example.com --rule-include ax,performance; cloud login: squirrel auth login. Install skills with npx skills add squirrelscan/squirrelscan, then tell your agent: "Use the audit-website skill to audit this site and fix all issues but only crawl 10 pages". Disable telemetry via squirrel self settings set telemetry false or NO_TELEMETRY=1.