squirrelscan for GitHub Copilot
Set up squirrelscan in GitHub Copilot for VS Code: mcp.json config, agent mode, the skills, and running audits from Copilot Chat.
Copilot agent mode in VS Code can already run terminal commands on your behalf, so it can run squirrel with no configuration at all. Connecting the hosted MCP server replaces that parsed terminal output with native tools for cloud audits, the issue tracker, and the rule catalog.
1. Install the CLI
The skills and local audits run through the squirrel binary.
curl -fsSL https://install.squirrelscan.com | bash
Local audits are free and run entirely on your machine. Verify with squirrel --version.
2. Add the MCP server
VS Code uses a top-level servers key, not mcpServers, and remote entries need "type": "http".
{
"servers": {
"squirrelscan": {
"type": "http",
"url": "https://mcp.squirrelscan.com/mcp"
}
}
}
On first connection VS Code discovers the authorization server, registers a client, and opens a browser so you can sign in. Manage or revoke the grant later under Accounts → Manage Trusted MCP Servers.
For a config you intend to commit, use a prompted input so the key lands in VS Code’s secret storage rather than in the file:
{
"inputs": [
{
"type": "promptString",
"id": "squirrelscan-api-key",
"description": "squirrelscan API key",
"password": true
}
],
"servers": {
"squirrelscan": {
"type": "http",
"url": "https://mcp.squirrelscan.com/mcp",
"headers": {
"Authorization": "Bearer ${input:squirrelscan-api-key}"
}
}
}
}
This also spares teammates an OAuth round trip just to open the project. Mint a key with squirrel keys create --shell.
Where it goes. Save either block through Command Palette → MCP: Add Server (choose HTTP), or write it yourself to .vscode/mcp.json for this workspace (safe to commit, no token is stored in it) or to the user mcp.json via Command Palette → MCP: Open User Configuration to get it everywhere.
3. Install the skills
VS Code with Copilot supports the Agent Skills standard:
npx skills add squirrelscan/squirrelscan
That installs audit-website (the fix loop) and squirrelscan (operating the CLI). See squirrel skills for the details.
4. Run an audit
Open Copilot Chat and switch to agent mode. Ask mode can read your code but cannot run tools or edit files, so audits and fixes both need agent mode.
Audit https://example.com with squirrelscan and list the top issues by severity.
Then hand it the fixes. Agent mode edits across the repo the same way it acts on a failing test:
Fix every core/title-missing and images/alt-missing finding, then re-audit to confirm the score went up.
Cap the crawl on a large site so the run stays fast:
Audit only /blog/* on example.com, cap it at 20 pages, and fix the broken links.
Copilot Business and Enterprise
Manual MCP servers are gated by org policy on paid plans, and both switches are needed. An org or enterprise owner has to enable the MCP servers in Copilot policy, which is off by default, and set Restrict MCP access to registry servers to Allow all, because squirrelscan is configured by hand and is not in GitHub’s MCP registry.
If squirrelscan connects on your personal account but not your work one, this is almost always why. The CLI path has no such restriction, so agent mode can still run squirrel in the integrated terminal while you wait on the policy change.
What squirrelscan checks, and what it does not
The audit covers 260+ rules, rolling up into four scores: SEO, Performance, Security, and Agents (how well AI crawlers and agents can consume the site).
The CLI audits anything your machine can reach, including localhost and private staging. The hosted MCP server crawls from squirrelscan’s cloud, so it needs a publicly reachable URL, use the CLI or squirrel mcp for anything private.
Copilot runs interactively in your editor, so it is the wrong tool for a per-deploy gate. Run the CLI in CI for that, it exits non-zero when a --fail-on threshold trips. Use Copilot for the fix loop and CI for the gate.
squirrelscan does not track keyword rankings, backlinks, or competitors. It reports what is on the page and how it is served.