Atlas / MCP servers / squirrelscan / Squirrelscan

SquirrelscanBLOCK

Name: Squirrelscan
Author: squirrelscan

mcp/squirrelscan/squirrelscan

MCP server by squirrelscan · agent · audit · cli · Audited 2026-10-06

The website QA tool for your coding agent. 295+ audit rules across SEO, performance, security, accessibility and agent experience.

Verdict

BLOCK

Grade

Trust score

26 /100

Exposed tools

90 74r · 13w · 3d

Transport

stdio · streamable-http

License

MIT

Stars

271

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The website QA tool for your coding agent

squirrelscan is an Open Source cli tool that audits websites for SEO, performance, security, accessibility, agent experience and other issues, and gives your coding agent exact fixes. Run it from the CLI, inside your coding agent, in the cloud, or over MCP.

Combine your coding agent with a deterministic and extensible audit tool.

[](https://squirrelscan.com/add/cursor) [](https://squirrelscan.com/add/claude) [](https://squirrelscan.com/add/codex) [](https://squirrelscan.com/add/opencode) [](https://registry.modelcontextprotocol.io)

[](https://github.com/squirrelscan/squirrelscan/actions/workflows/ci.yml) [](https://github.com/squirrelscan/squirrelscan/actions/workflows/codeql.yml) [](https://www.npmjs.com/package/squirrelscan) [](LICENSE)

Features

295 Rules, 21 Categories - Comprehensive coverage across SEO, accessibility, performance, and security
Fast crawler - Highly optimized memory efficient crawler
Agent Experience - Audit agent experience to assist agents in using your site
**Securi

Read from source at commit 61e964208bcaOBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add waf-detect --env ACCESS_TOKEN=${ACCESS_TOKEN} --env API_KEY=${API_KEY} --env AUTH_TOKEN=${AUTH_TOKEN} --env GOOGLE_PSI_API_KEY=${GOOGLE_PSI_API_KEY} -- npx -y @squirrelscan/[email protected]

claude-desktop

{
  "mcpServers": {
    "waf-detect": {
      "command": "npx",
      "args": [
        "-y",
        "@squirrelscan/[email protected]"
      ],
      "env": {
        "ACCESS_TOKEN": "${ACCESS_TOKEN}",
        "API_KEY": "${API_KEY}",
        "AUTH_TOKEN": "${AUTH_TOKEN}",
        "GOOGLE_PSI_API_KEY": "${GOOGLE_PSI_API_KEY}"
      }
    }
  }
}

Exposed tools (90)

74 read · 13 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`A`	read
`AGENTS.md`	read	Detects /AGENTS.md (and variants) — plain-Markdown instructions for coding agents working against the site
`Accessibility`	read	Accessibility for users with disabilities
`Analytics`	read	Tracking and measurement implementation
`B`	read
`Blocking`	read	Content, links, and trackers that ad blockers and privacy filters block
`Boom`	read
`C`	read
`Charset`	read	Checks for proper character encoding declaration
`Citations`	read	Checks for citations to authoritative external sources
`Compression`	read	Checks for Gzip or Brotli compression
`Content`	read	Text quality, readability, and content structure
`Counter`	read	counts its own invocations
`Crawlability`	read	Robots.txt, sitemaps, and crawl directives
`Disclaimers`	read	Checks for appropriate disclaimers on sensitive content
`Doctype`	read	Checks for valid HTML5 doctype declaration
`E-E-A-T`	read	Experience, expertise, authority, trust signals
`Example`	read	Example rule
`FAQ`	read	FAQ structured data
`Favicon`	read	Checks for favicon presence
`HTTPS`	read	Check HTTPS
`Images`	read	Image optimization and accessibility
`Internationalization`	read	Language declarations and multi-region support
`Interstitials`	read	Detects potentially intrusive mobile interstitials
`Links`	read	Internal and external link health and structure
`Mobile`	read	Mobile-friendliness and responsive design
`Other`	read	Uncategorized or legacy rules
`Pagination`	read	Checks that paginated pages have proper canonicals
`Performance`	read	Page speed and loading performance
`Permissions-Policy`	read	Checks for Permissions-Policy (Feature-Policy) header
`Referrer-Policy`	read	Checks for Referrer-Policy header
`Robots.txt`	read	Robots.txt check
`SRI`	read	d
`Security`	read	HTTPS, headers, and safe link practices
`TTFB`	read	Pages should respond quickly
`Uncloneable`	read	emits a check structuredClone refuses
`Video`	read	Video content markup and accessibility
`X-Content-Type-Options`	read	Checks for MIME type sniffing protection
`X-Frame-Options`	read	Checks for clickjacking protection header
`analyze`	write	Run audit rules on stored crawl
`audit`	write	Run audit on a URL
`audit_website`	read
`auth`	read	Authentication commands
`comment_on_issue`	read
`compare_entities`	read
`completion`	read	Generate shell completions
`config`	write	Show or edit configuration
`crawl`	read	Crawl a website (no analysis)
`create`	write	Mint an org API key for headless / CI use (requires a login session)
`credits`	read	Show cloud credit balance and feature pricing
`disk`	read	Report what ~/.squirrel is using, per project and in total
`doctor`	write	Run health checks
`entities`	read	Query the entity map of a stored audit
`feedback`	write	Send feedback to the squirrelscan team
`get_entity`	read
`get_entity_findings`	read
`get_entity_graph`	read
`get_issue`	read
`get_report`	read
`get_rule`	read
`https`	read
`init`	write	Create squirrel.toml
`install`	write	Bootstrap local installation
`keys`	read	Manage org API keys
`list`	read	List org API keys (requires a login session)
`list_audits`	read
`list_entities`	read
`list_issues`	read
`list_rules`	read
`llms.txt`	read	Detects /llms.txt (and /llms-full.txt) at the domain root and checks its basic Markdown format — an emerging standard giving AI agents a curated, machine-readable map of your site
`login`	read	Authenticate with squirrelscan
`logout`	destructive	Sign out and revoke token
`mcp`	write	Run the local MCP server (stdio) for agents like Claude Code and Cursor
`path`	read	Show config file path
`quick_check`	read
`report`	read	Query and view stored audit reports
`revoke`	destructive	Revoke an org API key by prefix or id (requires a login session)
`self`	read	Self-management commands
`send_feedback`	write
`set`	write	Set config value
`settings`	read	Manage CLI settings
`setup`	write	Sign in, install the agent skills and pick your defaults
`show`	read	Show current config
`skills`	read	Manage agent skills (Claude Code, Cursor, Codex, and more)
`status`	read	Show authentication status (source, scopes, org)
`uninstall`	destructive	Remove squirrel from the system
`update`	write	Check and apply updates
`validate`	read	Validate config file
`version`	read	Show version information
`whoami`	read	Show the active credential (source, scopes, org)

Trust audit

BLOCKgrade F · trust 26/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (8 observation(s))
Network: declared (6 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

packages/rules/src/integrity/signals.ts:310

atob( ... "eval(

Why it matters. decodes a payload and executes it

CRITICALHard-coded secrets · secret.aws · CWE-798, CWE-321

packages/rules/src/security/leaked-secrets.ts:891

* `AKIA0000000000000000`. Counted by a walk rather than `/(?:x{3,}|0{16,})$/`, // pragma: allowlist secret

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/rules/src/security/leaked-secrets.ts:545

pattern: /-----BEGIN RSA PRIVATE KEY-----/g,

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/rules/src/security/leaked-secrets.ts:546

keywords: ["-----begin rsa private key-----"],

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/rules/src/security/leaked-secrets.ts:551

pattern: /-----BEGIN DSA PRIVATE KEY-----/g,

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/rules/src/security/leaked-secrets.ts:552

keywords: ["-----begin dsa private key-----"],

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/rules/src/security/leaked-secrets.ts:557

pattern: /-----BEGIN EC PRIVATE KEY-----/g,

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

apps/cli/src/types/bun-sqlite.d.ts:17

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/crawler/src/types/bun-sqlite.d.ts:17

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/rules/src/integrity/signals.ts:307

"eval(",

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/rules/src/integrity/signals.ts:308

'function("return this")',

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

apps/cli/src/lib/non-public-host.ts:41

"metadata.google.internal",

Why it matters. cloud metadata endpoint: the classic SSRF credential grab