Developers
The programmatic surface of squirrelscan: REST API, CI/CD, webhooks, auth, and agents
Everything squirrelscan does from a terminal it can also do from your code, your pipeline, and your agent. This hub is the map of that programmatic surface: the stable REST API, CI/CD integration, outbound webhooks, headless authentication, and the agent/MCP workflow.
Pick your surface
The stable /v1 surface: create audits, read reports, check credits.
OpenAPI-described, agent- and MCP-friendly.
Gate builds on audits with --fail-on exit codes. GitHub Actions, GitLab,
and any shell runner.
Push audit events to any HTTPS endpoint. Signed, versioned, retried: react without polling.
API keys, scopes, and SQUIRRELSCAN_API_KEY for headless and CI auth.
Connect any agent to the hosted MCP server at mcp.squirrelscan.com, or wire
squirrelscan into Claude Code, Cursor, and autonomous workflows.
How it fits together
The CLI (squirrel) and the REST API are two front doors to the same engine.
Local, deterministic audits are free and need no login. Anything that talks
to the cloud (publishing reports, browser rendering, AI summaries, the API)
authenticates with a credential and is metered in credits.
| You want to… | Reach for |
|---|---|
| Run an audit locally or in a script | squirrel audit |
| Fail a build on a regression | CI/CD + --fail-on |
| Drive audits/reports from your own backend | REST API |
| Get notified when an audit finishes | Webhooks |
| Authenticate without a browser | SQUIRRELSCAN_API_KEY |
| Connect an agent over MCP | Hosted MCP server |
| Let an agent run audits autonomously | Agents & MCP |
A 60-second tour
# 1. Local, free, no login — exits non-zero if the gate trips.
squirrel audit https://example.com --fail-on 'score<90'
# 2. Headless cloud auth — mint a key with `squirrel keys create`, or grab one
# from the dashboard.
export SQUIRRELSCAN_API_KEY=sq_xxxxxxxxxxxx
# 3. Or skip the CLI entirely and hit the API.
curl https://api.squirrelscan.com/v1/credits \
-H "Authorization: Bearer $SQUIRRELSCAN_API_KEY"