squirrelscan for Windsurf

Windsurf’s Cascade agent runs terminal commands and acts on what comes back, so it can drive the squirrel CLI with no setup at all. Connecting the hosted MCP server goes further: audits, rules, issues, and reports arrive as native tools instead of terminal output Cascade has to parse.

1. Install the CLI

Run this in Windsurf’s integrated terminal.

curl -fsSL https://install.squirrelscan.com | bash

Local audits are free, need no account, and run entirely on your machine. Verify with squirrel --version.

2. Add the MCP server

Windsurf uses serverUrl for a remote server, not url. Create the file if it does not exist yet, Windsurf will not create it for you.

{
  "mcpServers": {
    "squirrelscan": {
      "serverUrl": "https://mcp.squirrelscan.com/mcp"
    }
  }
}

{
  "mcpServers": {
    "squirrelscan": {
      "serverUrl": "https://mcp.squirrelscan.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SQUIRRELSCAN_API_KEY}"
      }
    }
  }
}

Which file. The standalone editor reads ~/.codeium/windsurf/mcp_config.json. The Windsurf plugin for JetBrains or VS Code reads ~/.codeium/mcp_config.json, with no windsurf segment. There is no project-scoped MCP config in Windsurf, this is a global, user-level file, so the server is available in every workspace once it is added.

3. Run an audit

With the MCP server connected, ask Cascade in plain language and it calls the tools directly:

Audit example.com with squirrelscan, then fix the high-severity SEO issues in this repo.

Without the MCP server, Cascade can still run the CLI for you. The llm output format is compact and structured, so it works from the report without you summarizing it first:

squirrel audit https://example.com --format llm

Scope large sites so runs stay fast and cheap:

Audit only /blog/* on example.com, cap it at 20 pages, and list the SEO regressions.

4. The fix loop

A typical pass in Cascade looks like this:

1. Cascade runs the audit and groups findings by severity.
2. It maps each finding to a file in your workspace, core/title-missing to a layout component, images/alt-missing to the templates that render them.
3. It edits in batches, then re-audits to confirm the score moved.

Re-auditing matters: a fix that looks right in the diff can still fail the rule, and the second run is what tells you.

What squirrelscan checks, and what it does not

The audit covers 260+ rules, rolling up into four scores: SEO, Performance, Security, and Agents (how well AI crawlers and agents can consume the site).

Two limits worth knowing before you point Cascade at a site:

• Local versus cloud. The CLI audits anything your machine can reach, including localhost and private staging. The hosted MCP server crawls from squirrelscan’s cloud, so it needs a publicly reachable URL. Use the CLI or squirrel mcp for anything private.
• It is not a rank tracker. squirrelscan checks what is on the page and how it is served. It does not report keyword positions, backlinks, or competitor rankings.

Next steps