squirrelscan for OpenAI Codex

Set up squirrelscan in OpenAI Codex CLI: add the hosted MCP server, install the skills, and run audits.

Codex connects to squirrelscan over the hosted MCP server and reads Agent Skills from ~/.agents/skills, so it can run audits, read findings as tools, and fix them in your repo.

1. Install the CLI

The skills and local audits run through the squirrel binary.

curl -fsSL https://install.squirrelscan.com | bash

iwr -useb https://install.squirrelscan.com/install.ps1 | iex

Local audits are free and run entirely on your machine. Verify with squirrel --version.

2. Add the MCP server

codex mcp add squirrelscan --url https://mcp.squirrelscan.com/mcp
codex mcp login squirrelscan

codex mcp login opens the browser, runs PKCE with a local loopback callback, and stores the token encrypted (Codex CLI 0.140.0+), not in config.toml.

codex mcp add squirrelscan --url https://mcp.squirrelscan.com/mcp \
  --bearer-token-env-var SQUIRRELSCAN_API_KEY

Codex sends SQUIRRELSCAN_API_KEY as Authorization: Bearer <value>. Export it in your shell or CI first.

Hand-write the block into ~/.codex/config.toml (global) or <project>/.codex/config.toml (honored once the project is trusted):

[mcp_servers.squirrelscan]
url = "https://mcp.squirrelscan.com/mcp"
# bearer_token_env_var = "SQUIRRELSCAN_API_KEY"   # omit if using OAuth

How to check which MCP servers are enabled in Codex

Run codex mcp list. Each server is listed with a Status column reading enabled or disabled, so that one command tells you whether squirrelscan is registered and switched on.

Remote servers like squirrelscan print in their own table, keyed by Url rather than Command, alongside the Bearer Token Env Var column that shows whether you configured API-key auth. Add --json if you want to parse the result:

codex mcp list --json

To inspect one server instead of all of them, pass its name to codex mcp get:

codex mcp get squirrelscan

If squirrelscan is missing from the list entirely, the codex mcp add step above did not write to the config file Codex is reading. Remember that codex mcp add only ever touches the global ~/.codex/config.toml, so a hand-written project-level .codex/config.toml will not appear until that project is trusted.

3. Install the skills

Codex reads Agent Skills from ~/.agents/skills, so the same install works:

npx skills add squirrelscan/squirrelscan

4. Run an audit

Ask Codex in natural language, it will call the squirrelscan tools or the CLI:

Use squirrelscan to audit example.com, then fix the high-severity issues.

Scope large sites to keep runs fast:

Audit only /blog/* on example.com, cap it at 20 pages, and list the SEO regressions.

Next steps

Fix your website with a coding agent

A full worked example of the audit-and-fix loop.

Hosted MCP server

The full tool list, auth, and credits.

MCP client setup

Scopes, API-key auth, and TOML config.

Rules reference

Every audit rule and how it’s fixed.

Edit this page