Developers
The programmatic surface of squirrelscan: REST API, CI/CD, webhooks, auth, and agents
Everything squirrelscan does from a terminal it can also do from your code, your pipeline, and your agent. This hub is the map of that programmatic surface: the stable REST API, CI/CD integration, outbound webhooks, headless authentication, and the agent/MCP workflow.
Pick your surface
Connect Claude Code, Cursor, Codex, opencode, and any MCP client to the
hosted server at mcp.squirrelscan.com. Sign in with OAuth or an API key;
audits spend credits.
Gate builds on audits with --fail-on exit codes. GitHub Actions, GitLab,
and any shell runner.
The stable /v1 surface: create audits, read reports, check credits.
OpenAPI-described. Cloud, so it needs an API key.
Push audit events to any HTTPS endpoint. Signed, versioned, retried: react without polling.
API keys, scopes, and SQUIRRELSCAN_API_KEY for headless and CI auth.
How it fits together
The CLI (squirrel) and the REST API are two front doors to the same engine.
A local audit run signed out or with --offline is free and needs no login.
Anything that talks to the cloud (a signed-in audit, publishing reports, browser
rendering, AI summaries, the API) authenticates with a credential and is metered
in credits.
| You want to… | Reach for |
|---|---|
| Run an audit locally or in a script | squirrel audit |
| Fail a build when a score or issue count crosses a threshold | CI/CD + --fail-on |
| Drive audits/reports from your own backend | REST API |
| Get notified when an audit finishes | Webhooks |
| Authenticate without a browser | SQUIRRELSCAN_API_KEY |
| Connect an agent over MCP | Hosted MCP server |
| Let an agent run audits autonomously | Agents & MCP |
A 60-second tour
# 1. Local and free with --offline: exits non-zero if the gate trips.
squirrel audit https://example.com --offline --fail-on 'score<90'
# 2. Headless cloud auth: mint a key with `squirrel keys create`, or grab one
# from the dashboard.
export SQUIRRELSCAN_API_KEY=sq_xxxxxxxxxxxx
# 3. Or skip the CLI entirely and hit the API.
curl https://api.squirrelscan.com/v1/credits \
-H "Authorization: Bearer $SQUIRRELSCAN_API_KEY"