Introduction
The website QA tool for your coding agent
squirrelscan audits your website for SEO, performance, security, accessibility and agent experience issues, and gives your coding agent exact fixes. Run it from the CLI, inside your coding agent, in the cloud, or over MCP.
Combine your coding agent with a deterministic and extensible audit tool.
Install squirrelscan and run your first audit in under 2 minutes.
Use squirrelscan with Claude Code, Cursor, and other AI coding assistants.
Four Ways to Run squirrelscan
Same audit engine, same report, four front doors: your terminal, your coding agent, the cloud, or MCP.
Run audits directly in your terminal with a single binary and zero dependencies:
squirrel audit example.com
Perfect for:
- Manual audits during development
- Quick site health checks
- CI/CD pipelines (fail builds on score or severity thresholds)
Install the skills for autonomous workflows in Claude Code, Cursor, Codex, and any coding agent:
npx skills add squirrelscan/squirrelscan
Then prompt your agent:
Use the audit-website skill to audit this site and fix all issues
Or pipe LLM-optimized output to any assistant:
squirrel audit example.com --format llm | claude
Perfect for:
- Autonomous fixing of SEO/accessibility issues
- Multi-step AI workflows with plan mode
- Ad-hoc AI assistance and custom scripts
Log in and squirrelscan enriches each audit in the cloud: browser rendering, AI analysis, technology detection, and shareable reports. Billed in credits:
squirrel auth login
squirrel audit example.com
Perfect for:
- JavaScript-heavy sites and SPAs (real browser rendering)
- AI parsability and E-E-A-T authority signals
- Shareable dashboard reports with score history
See the cloud docs for features and costs.
Point any client at the hosted MCP server so agents call squirrelscan’s audit engine and cloud features as tools, no shell glue required:
https://mcp.squirrelscan.com/mcp
Authentication is per-user OAuth, or pass a squirrelscan API key as a Bearer token. Prefer to keep it local? Your agent can launch the CLI’s own server via its MCP config instead:
squirrel mcp
Perfect for:
- Agents and clients that speak MCP
- Tool-calling instead of parsing CLI output
- Claude Code and Cursor MCP setups
Why squirrelscan?
Comprehensive coverage across SEO, accessibility, performance, and security.
Highly optimised, memory efficient crawler.
Audit agent experience to assist agents in using your site.
Detect phishing kits, leaked credentials, and more.
ETag, Last-Modified, content hashing. Resume from checkpoints.
Single binary, zero dependencies, shell completions, self-update.
Track site evolution, compare crawls, spot regressions.
Console, JSON, HTML, Markdown, Text, LLM, XML.
Connect your agent to local or cloud MCP to run audits, fixes, etc.
Works Where You Work
Run anywhere with a single command.
Install the squirrelscan skills for autonomous workflows.
Native skill integration with composer mode.
Pipe text/JSON/markdown to any LLM.
Log in for rendering, AI analysis, and shareable reports.
Expose the audit engine to any MCP client as tools.
Fail pipelines on audit errors with exit codes.
Integrate into your automation workflows.
Rule Categories
squirrelscan runs 278 rules across 21 categories, plus opt-in cloud gap analysis. Ordered by how much a failure usually costs you, not by how many rules each one has.
| Category | Rules | What it covers |
|---|---|---|
| Crawlability | 20 | Whether search engines and agents can reach and index you at all: robots.txt, sitemap validity and coverage, indexability conflicts, redirect and canonical chains, soft 404s |
| Core SEO | 14 | The per-page fundamentals: title, meta description, H1, canonical, charset, doctype, robots meta, Open Graph and Twitter cards, plus canonical form drift across the site |
| Agent Experience | 17 | How ready you are for AI agents to read, discover and act on the site: whether GPTBot and Claude-User get the same content a browser does, AGENTS.md, llms.txt, Markdown responses, API and MCP discovery, licensing and noai signals, pay-per-crawl, response token weight |
| Site Integrity | 9 | Signs the site has been compromised: injected doorway pages, phishing kit signatures, obfuscated scripts, brand impersonation, cloaking, known-malicious URLs |
| Security | 16 | Transport and header hygiene: HTTPS and HSTS, CSP, cookie flags, mixed content, subresource integrity, leaked secrets, unprotected and downgraded forms |
| Links | 15 | Internal and external link health: broken and dead links, redirect chains, anchor-text quality, orphan and dead-end pages, pages linked only from sitewide chrome, HTTPS downgrades |
| Content | 18 | Text quality and honesty: duplicate titles and descriptions, title-template consistency, readability, word count against the site’s own norm, freshness, heading hierarchy, keyword stuffing, hidden text, encoding damage |
| Performance | 29 | Core Web Vitals and delivery: LCP, CLS and INP hints, TTFB, compression, caching, render-blocking resources, DOM size, font delivery, legacy and unminified JS/CSS |
| Images | 15 | Alt text, modern formats, responsive srcset, intrinsic dimensions and aspect-ratio mismatches, lazy loading above versus below the fold, file weight |
| Structured Data | 12 | JSON-LD validity and rich-result eligibility for Article, Product, FAQ, Review, Breadcrumb, Organization, LocalBusiness, Video and site search, plus pages missing the markup their same-type siblings have and rating markup that is not about the page it sits on |
| Accessibility | 61 | WCAG coverage: ARIA roles and names, form labels and autocomplete tokens, colour contrast, heading order, landmarks, tables and lists, focus visibility, touch targets, captions |
| Mobile | 6 | Viewport configuration, tap-target size, legible font sizes, horizontal scroll, blocked zoom, intrusive interstitials |
| Social Media | 5 | Open Graph and Twitter Card completeness, image dimensions, canonical URL match, social profile links, site-chrome assets that disagree across pages |
| URL Structure | 9 | Length, casing, hyphenation, stop words, query parameters, special characters, trailing-slash consistency, site-wide convention consistency |
| E-E-A-T | 15 | Experience, expertise, authority and trust signals: author bylines and credentials, about and contact pages, citations, editorial policy, disclaimers, YMYL detection |
| Legal Compliance | 4 | Privacy policy, terms of service, real cookie-consent machinery, subprocessor disclosure |
| Internationalization | 2 | hreflang correctness and the document language declaration |
| Local SEO | 3 | NAP (name, address, phone) consistency across every crawled page, geo metadata, service-area businesses |
| Video | 3 | VideoObject markup, captions and accessibility, thumbnails |
| Analytics | 2 | Google Tag Manager presence and consent-mode wiring |
| Blocking | 3 | Content, links and trackers that ad blockers and privacy filters strip for a large share of your visitors |
Total: 278 rules across 21 categories. Gap analysis (keyword and content gaps) is a cloud opt-in and is not counted above.
See the rules reference for full details.