squirrelscan for opencode

Set up squirrelscan in opencode: add the hosted MCP server to opencode.json, install the CLI, and run audits.

opencode connects to squirrelscan over the hosted MCP server, so it can run audits, read findings as tools, and fix them in your repo.

1. Install the CLI

Local audits and the skills run through the squirrel binary.

bash

curl -fsSL https://install.squirrelscan.com | bash

Local audits are free and run entirely on your machine. Verify with squirrel --version.

2. Add the MCP server

Add squirrelscan to your opencode.json (project root) or ~/.config/opencode/opencode.json (global). A remote server uses type: "remote":

json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "squirrelscan": {
      "type": "remote",
      "url": "https://mcp.squirrelscan.com/mcp",
      "enabled": true
    }
  }
}

On first connect opencode discovers the authorization server and runs a browser sign-in. Check status with opencode mcp list.

json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "squirrelscan": {
      "type": "remote",
      "url": "https://mcp.squirrelscan.com/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:SQUIRRELSCAN_API_KEY}"
      }
    }
  }
}

Export SQUIRRELSCAN_API_KEY in your shell or CI. A static header disables the OAuth fallback, which is what you want for headless runs.

3. Run an audit

Ask opencode in natural language, it will call the squirrelscan tools:

Use squirrelscan to audit example.com, then fix the high-severity issues.

Scope large sites to keep runs fast:

Audit only /docs/* on example.com, cap it at 20 pages, and fix the broken links.

Next steps

Fix your site with an AI agent

A full worked example of the audit-and-fix loop.

Hosted MCP server

The full tool list, auth, and credits.

MCP client setup

Config for every other MCP client.

Rules reference

Every audit rule and how it’s fixed.

Edit this page