Hosted MCP server

squirrelscan runs a hosted Model Context Protocol server in the cloud. Point any MCP client at it and your agent gets 14 tools for running cloud audits, reading reports, working the per-website issue tracker, and browsing the 249+ rule catalog. Nothing to install, nothing to keep running:

https://mcp.squirrelscan.com/mcp

The transport is streamable HTTP. Authentication is OAuth 2.1 (browser sign-in) or a squirrelscan API key as a bearer header, whichever suits the environment.

Quick connect

The fastest path is Claude Code:

claude mcp add --transport http squirrelscan https://mcp.squirrelscan.com/mcp

Then, inside a session, run /mcp, select squirrelscan, and choose Authenticate. Your browser opens, you sign in to squirrelscan, pick the organization the agent should act for, and approve. That’s it: the tools are live.

Every other client is a couple of lines of config. See MCP client setup for exact snippets for Cursor, Codex CLI, VS Code, Windsurf, and Gemini CLI.

Authentication

There are two ways in. Pick one per config entry.

OAuth (browser sign-in)

Add the server with no auth headers and the client handles everything: it discovers the authorization server at /.well-known/oauth-authorization-server, registers itself dynamically (DCR and CIMD are both supported), and runs the PKCE browser flow. You sign in, choose an organization, and approve on the consent screen.

Behind the scenes the flow mints a 30-day squirrelscan API key scoped to the organization you approved. When it expires, the client prompts you to sign in again.

Best for: a human at an editor. No key to copy, no secret in any config file.

API key (bearer header)

Set a standard bearer header on the server entry:

Authorization: Bearer sq_xxxxxxxxxxxx

Get a key from the dashboard at app.squirrelscan.com/settings/api-keys, or without leaving the terminal:

squirrel keys create --shell

--shell offers to append export SQUIRRELSCAN_API_KEY=sq_... to your shell rc, and SQUIRRELSCAN_API_KEY is the conventional env var: most clients can interpolate it into the header so the key never lands in a config file. See squirrel keys and Authentication.

Key scopes apply to tools exactly like they do to the REST API: run_audit, add_website, and comment_on_issue need audits:write; audit, report, and issue reads need audits:read; get_credit_balance needs credits:read. A key missing a scope gets a structured FORBIDDEN error naming the missing scope. whoami works with any key but only includes the balance when the key has credits:read.

Best for: CI, headless machines, containers, and configs you commit and share.

Anonymous connections can initialize and list the tool catalog, but every tool call requires credentials. Unauthenticated calls get a 401 with a WWW-Authenticate challenge that points OAuth-capable clients at the sign-in flow.

Tools

All 14 tools require authentication. Write tools are marked; everything else only reads.

Two tools deserve a closer look:

• run_audit has a confirm rail. The first call returns a credit estimate instead of starting anything expensive; the agent is expected to show it to you and call again with confirm: true. Every audit costs at least the 50-credit base, so expect the confirm step on each run. A max_credits argument acts as a hard spend guard: the audit refuses to start if the estimate exceeds it.
• create_api_key is scope-gated. It needs credentials carrying the reserved keys:write scope. OAuth sign-in grants it (you consented on the approval screen); plain API keys never carry it, and keys minted by this tool can’t mint further keys. No escalation loops.

Credits

Cloud audits are pay-as-you-go: credits are spent while the audit runs, and nothing is charged up front. From the agent’s side a paid audit looks like this:

1. Agent calls run_audit with the URL. The response comes back with status: "confirmation_required", an upper-bound estimate (estimate.cap), and your current balance.
2. The agent shows you the estimate and asks. Actual spend is usually below the cap.
3. You approve; the agent calls run_audit again with confirm: true. The audit starts and returns a run_id.
4. The agent polls get_audit_status every 15-30 seconds, then pulls the results with get_report.

An audit costs 50 credits base plus 2 per rendered page. Check spend anytime with get_credit_balance, or top up at app.squirrelscan.com/billing.

Sample prompts

Copy-paste starters. Prompts marked spends credits run a cloud audit; prompts marked write change state in your org.

• “Audit https://example.com and fix the top 3 issues in this repo.” (spends credits, write)
• “Check my site’s open audit issues and comment on the ones this PR fixes.” (write)
• “Compare the last two audits of example.com and tell me what regressed.”
• “Create an API key for CI and add it to my GitHub Actions secrets.” (write, needs OAuth sign-in for keys:write)
• “What would a deep audit of example.com cost, and how many credits do we have left?”
• “Run a full-coverage audit of staging.example.com, but stop if it would cost more than 200 credits.” (spends credits, write)
• “List our websites and summarize the health of each one.”
• “What does the rule crawl/canonical-chain check, and how do I fix it on a Next.js site?”

Local MCP server

The CLI ships a local stdio MCP server too:

squirrel mcp

It runs squirrelscan’s deterministic audit engine on your machine: local audits are free, work offline, and need no account. Reach for it when you want unmetered local runs, are auditing localhost or a private network, or have no network at all. The hosted server is the better default for everything cloud-side: shared org state, the issue tracker, browser rendering, and zero local install.

Full setup and tool reference: squirrel mcp.

Related

• MCP client setup - exact config for Claude Code, Cursor, Codex CLI, VS Code, Windsurf, and Gemini CLI
• Authentication - API keys, scopes, and SQUIRRELSCAN_API_KEY
• squirrel keys - mint and manage keys from the terminal
• squirrel mcp - the local stdio server
• Cloud credits - how audits are metered