Security & Testing

squirrelscan.com

Audits websites for compliance and security issues.

1 endpoint17 known toolsFirst detected July 25, 2026Last detected July 25, 2026

ENDPOINT 1

https://mcp.squirrelscan.com/mcp

No auth detected

MCP server metadata

Name: squirrelscan
Version: 0.0.1

Capabilities

tools.listChanged

Server instructions

squirrelscan audits websites: crawl + 260+ rules across SEO, performance, security, accessibility, and content, scored into a report. Pricing is flat and predictable: 50 credits per audit plus 2 credits per rendered page (the base is charged when the audit starts, pages as they render). Failed audits are refunded automatically. Start with whoami to see which organization you act for and the credit balance. Running an audit: call run_audit with the URL. If the response has status "confirmation_required", show the estimate to the user and call run_audit again with confirm: true. Audits are asynchronous (minutes): poll get_audit_status with the returned run_id until completed, then call get_report (format "summary" first; "llm" or "markdown" for full detail). The website is registered automatically on first audit. IDs: run_id identifies one audit run (status + report). website_id identifies a registered website (issues live under it). audit_id ties a run to the website's audit history. Issues: each website keeps a tracker of open issues found by audits. list_issues -> get_issue -> comment_on_issue to record analysis or fixes for the team. Deleting a website (delete_website, two-step confirm) is a soft delete: past audits, reports, and issues are preserved and published report links keep working, but the site leaves listings and frees a slot under the plan's website limit. Re-adding the same domain later registers a fresh website with a new website_id. Feedback: call send_feedback any time something surprises you mid-session (a squirrelscan bug, a feature it should have, what worked, what confused you, missing report data, tool ergonomics) — it works with any authenticated credentials, including read-only API keys. Accounting: get_report's "summary" includes a per-audit "cost" breakdown (base + rendered pages + services + any refunds). list_credit_transactions is the full org accounting log (grants, debits, refunds) with a run_id on each so an audit's spend can be grouped. Read-only tools: whoami, get_audit_status, get_report, list_audits, list_websites, list_issues, get_issue, list_rules, get_rule, get_credit_balance, list_credit_transactions. Write tools: run_audit (spends credits), add_website, delete_website (two-step confirm), comment_on_issue, create_api_key (requires the keys:write scope), send_feedback (no scope required).

Known tools 17

run_audit

Run a cloud audit of a website (crawl + 260+ rule analysis + report).

Inferred read-only

get_audit_status

Poll a running audit by run_id (from run_audit or list_audits).

Inferred read-only

list_audits

List the organization's audit runs: currently active (pending/running) plus the most recent runs of any status.

Inferred read-only

list_websites

List websites the organization has audited, with their latest run status and health score.

Inferred read-only

add_website

Register a website with the organization without running an audit (run_audit registers automatically, so this is only needed to set a site up ahead of time).

Inferred read-only

delete_website

Delete a website from the organization (soft delete: past audits, reports, and issues are preserved, and published report links keep working).

Potential side effects

get_report

Fetch the finished report for an audit run (use the run_id from run_audit once get_audit_status shows completed).

Inferred read-only

list_issues

List a website's open audit issues (like a bug tracker: each issue is one failing rule with occurrences across pages, numbered per website).

Inferred read-only

get_issue

Fetch one issue by website_id + issue number, including its full description, recommendation, affected pages, occurrence detail from the latest report (which page/image/URL, snippets), and comment thread.

Inferred read-only

comment_on_issue

Post a comment on a website issue — use it to record analysis, a proposed fix, or what you changed, so the team sees it in the dashboard issue thread.

Potential side effects

list_rules

Browse the catalog of 260+ audit rules that run during an audit, grouped into categories (crawlability, meta tags, performance, security, accessibility, content, and more).

Inferred read-only

get_rule

Fetch one audit rule by id (e.

Inferred read-only

whoami

Identify the current credentials: how you are authenticated, which organization you act for, the plan, and the current credit balance.

Inferred read-only

get_credit_balance

Get the organization's credit balance: monthly credits (reset each billing period) and pack credits (purchased, never expire).

Inferred read-only

list_credit_transactions

Audit the organization's credit accounting log: grants (signup/monthly/pack/promo), debits (audit_base 50cr + render 2cr/page + folded 0-cost services), refunds, and adjustments — newest first, paginated.

Inferred read-only

create_api_key

Mint a new squirrelscan API key for this organization (requires credentials carrying the keys:write scope, which OAuth sign-in grants).

Potential side effects

send_feedback

Report your experience using squirrelscan mid-session: a bug, a missing feature, what worked, what confused you, missing report data, or tool ergonomics.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.squirrelscan]
url = "https://mcp.squirrelscan.com/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "squirrelscan": {
      "type": "http",
      "url": "https://mcp.squirrelscan.com/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: squirrelscan
Remote MCP URL: https://mcp.squirrelscan.com/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "squirrelscan": {
      "url": "https://mcp.squirrelscan.com/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "squirrelscan": {
      "type": "http",
      "url": "https://mcp.squirrelscan.com/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "squirrelscan",
  "transport": "streamable-http",
  "url": "https://mcp.squirrelscan.com/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.