squirrelscan for Claude Code

Set up squirrelscan in Claude Code: install the plugin (skills + MCP), connect the hosted MCP server, and run audits with /audit-website.

squirrelscan plugs straight into Claude Code. The plugin bundles both skills and the hosted MCP server, so Claude can run audits, read findings as tools, and fix them in your repo, all from one install.

1. Install the CLI

The skills and local audits run through the squirrel binary.

curl -fsSL https://install.squirrelscan.com | bash

iwr -useb https://install.squirrelscan.com/install.ps1 | iex

Local audits run entirely on your machine. Signed out, they need no account and cost nothing; signed-in audits spend credits. Verify with squirrel --version.

2. Add squirrelscan

The plugin bundles both skills plus the hosted MCP server:

/plugin marketplace add squirrelscan/skills
/plugin install squirrelscan@squirrelscan

That’s it, skills and MCP tools are both available. Authenticate the MCP server for cloud features (below).

Added the older squirrelscan/squirrelscan marketplace before? It now points the plugin at squirrelscan/skills, so it keeps working: run /plugin marketplace update squirrelscan then /plugin update squirrelscan@squirrelscan. To switch marketplaces instead, remove the old one first (Claude Code won’t add a second marketplace named squirrelscan, and removing it uninstalls the plugin):

/plugin marketplace remove squirrelscan
/plugin marketplace add squirrelscan/skills
/plugin install squirrelscan@squirrelscan

Add just the hosted server (dynamic client registration, no client id needed):

claude mcp add --transport http squirrelscan https://mcp.squirrelscan.com/mcp

Then run /mcp, select squirrelscan, and choose Authenticate. Full options, scopes, and the API-key variant are on the MCP client setup page.

Install the skills without the MCP server:

squirrel skills install

The skills drive the CLI directly, so signed-out local audits work with no auth.

3. Authenticate (for cloud)

Local audits need nothing. For hosted crawling, publishing, and credits, log in once. With the MCP server added, run /mcp → squirrelscan → Authenticate, or from the shell:

claude mcp login squirrelscan

Tokens are stored in your OS keychain, never in a config file, so a committed .mcp.json stays safe.

4. Run an audit

Trigger the skill with a slash command:

/audit-website

Claude detects your project’s website, runs the audit, and summarizes issues by severity. Or be explicit:

/audit-website https://example.com focusing on accessibility and performance

Or just ask in natural language:

Use the audit-website skill to audit example.com and fix all high-severity issues.

Plan mode for big fixes

For larger efforts, let Claude plan before it edits:

Enter plan mode. Use the audit-website skill to audit example.com,
then create a plan to fix all high and medium severity issues.

Claude runs the audit, groups fixes, orders them by dependency, and waits for your approval before changing code.

Parallel fixes with subagents

Audit example.com, then spawn subagents to fix in parallel:
accessibility, SEO meta tags, and performance.

Next steps

Fix your website with a coding agent

A full worked example of the audit-and-fix loop.

Hosted MCP server

The full tool list, auth, and credits.

MCP client setup

Scopes, API-key auth, and JSON config.

Rules reference

Every audit rule and how it’s fixed.

Edit this page