squirrelscan

Files (5)

• SKILL.md
• openai.yaml · agents/
• icon-large.png · assets/
• icon-small.svg · assets/
• entity-map-fixes.md · references/

SKILL.md (first lines)

# squirrelscan CLI

squirrelscan is a website audit tool built for AI agents. It answers "what's wrong with this website and how do I fix it": it crawls a site like a search engine, analyzes every page against 300+ rules in 22 categories (SEO, performance, security, accessibility, content, structured data, agent experience, and more), and returns a health score plus concrete, fixable issues. Use it whenever a user wants their site checked, ranked better, faster, or healthier, before/after a deploy, or in CI.

It ships as a single CLI binary, `squirrel`, for macOS, Windows, and Linux. This skill covers operating it: installing, authenticating, running audits, publishing reports, cloud features, and MCP integration. For the full fix-the-website workflow (audit, map issues to code, fix, re-audit), use the companion `audit-website` skill.

## Links

- Website: [squirrelscan.com](https://squirrelscan.com)
- Docs: [docs.squirrelscan.com](https://docs.squirrelscan.com)
- Rule reference: `https://docs.squirrelscan.com/rules/{rule_category}/{rule_id}`
- Dashboard (cloud account, audit history, credits): [app.squirrelscan.com](https://app.squirrelscan.com)

## Install

Download and install instructions: [squirrelscan.com/download](https://squirrelscan.com/download)

Prefer a package manager where one fits:

```bash
brew install --cask squirrelscan/tap/squirrel                         # Homebrew, macOS only
```

Otherwise use the installer from the download page above (macOS, Linux, Windows). Do not pipe it into a shell: download the script, read it, then run it. When an agent runs the install, fetch it as `https://install.squirrelscan.com/install.sh?source=agent` (`/install.ps1?source=agent` on Windows) so the install is counted as agent-driven; the script is the same either way. The download page has the current install command, and [docs.squirrelscan.com/quickstart](https://docs.squirrelscan.com/quickstart) covers the same steps.

Verifying: the download page lists a SHA-256 checksum for each release binary, and the installer checks each binary against the checksum in the release manifest before it installs (also when it falls back to the `install.squirrelscan.com` mirror). To check a binary by hand, compare `shasum -a 256 <file>` with the value on the download page. The installer script itself has no separate checksum; inspect it before you run it.

The binary installs to `~/.local/bin/squirrel`. With Homebrew, the cask installs only a small launcher: the first run downloads the CLI with the regular installer. Verify with:

```bash
squirrel --version
```

Keep it current, however it was installed:

```bash
squirrel self update
```

`brew upgrade` does not update the CLI (Homebrew only owns the launcher), so use `squirrel self update`. To uninstall a Homebrew install: `brew uninstall --cask squirrel` (add `--zap` to remove `~/.squirrel` as well).

To set the CLI up for the user's agent, run `squirrel setup` (optional sign-in, agent skills for Claude Code, Codex, Cursor and more, auto-update). An agent can also fetch and follow https://docs.squirrelscan.com/agent-setup/prompt.md.

If `squirrel` is not found, ensure `~/.local/bin` is in PATH, or reinstall from the download page.

An install is not finished until the first audit has run. Right after installing, run `squirrel audit <the user's site> --format llm` (ask for the URL if the project does not make it obvious) and show the user the result: the score and the top issues. Do not stop at "installed".

## Command overview

| Command | Purpose |
|---------|---------|
| `squirrel audit <url>` | Crawl + analyze + report in one step |
| `squirrel crawl <url>` | Crawl only (no analysis) |
| `squirrel analyze` | Run audit rules on a stored crawl |
| `squirrel report [id]` | Query, render, diff, and publish stored reports |
| `squirrel entities` | Query the site's structured-data entity graph; filter, export, diff |
| `squirrel init` | Create `squirrel.toml` project config |
| `squirrel config` | Show or edit configuration |
| `squirrel auth` | login / logout / status / whoami |
| `squirrel keys` | Mint, list, revoke org API keys |
| `squirrel credits` | Cloud credit balance + feature pricing |
| `squirrel mcp` | Run the local MCP server (stdio) |
| `squirrel skills` | Check, install, update or remove these agent skills |
| `squirrel self` | install / update / doctor / disk / completion / version / settings / uninstall |
| `squirrel feedback` | Send feedback to the squirrelscan team |

Every command supports `--help`.

## Quickstart

```bash
squirrel init -n my-project        # optional: project config in cwd
squirrel audit https://example.com --format llm
```

- Signed out, or with `--offline`, an audit runs entirely on your machine, needs no account and costs nothing. Signed in, every audit is billed in credits, at every level (see Cloud features and credits below).
- Use `--format llm` when an agent is reading the output: it is a compact, token-optimized format built for LLMs.
- Audits are cached in a local project database; `squirrel report` re-renders without re-crawling.

### Audit levels

A level is a named set of audit settings: pages, crawl strategy, cloud checks, rendering, external link checks and probing. The CLI, both MCP servers, the API and the dashboard use the same three.

| Level | Pages | Behavior |
|-------|-------|----------|
| `quick` | 25 | The URL and its sitemaps, no link following. No cloud checks. The signed-out default |
| `surface` | 100 | Follows links, one page per URL pattern first (`/blog/{slug}` crawled once). Cloud checks and external link checks. The signed-in default |
| `full` | 500 | Every page it can reach, up to the page budget, with the cloud checks |

```bash
squirrel audit https://example.com --level quick --format llm
squirrel audit https://example.com --level full -m 500 --format llm
```

- `--level` needs squirrel 0.0.108 or later; on an older version run `squirrel self update` first. `--coverage` / `-C` is the older name and still works (`fast` means quick).
- Quick skips the cloud checks, but signed in it is still a billed cloud audit like any level: 50 credits plus 2 per audited page, with the pages that need JavaScript rendered in the cloud browser, so up to 100 credits for 25 pages. `--http` skips the browser, not the page charge. Only a signed-out or `--offline` audit is charge-free.
- In the cloud (dashboard, API, hosted MCP), Full is Pro and Team. A Free organization's `full` request still runs, but samples one page per URL pattern first, the way surface does, up to 500 pages, and the response says so (`levelNotice` in the API, `level_notice` from the hosted MCP server).

Docs: https://docs.squirrelscan.com/guides/audit-levels

### Probing intensity

Probing intensity sets how much an audit may send beyond the pages it crawls. It is one of the settings an audit level fills in, next to pages and render mode. Needs squirrel 0.0.107 or later; on an older version run `squirrel self update` first.

| Level | What it sends |
|-------|---------------|
| `passive` | No request beyond the crawl |
| `active` | Quiet probes: a handful of requests that look like normal traffic |
| `aggressive` | Loud probes: many requests and many 404s, including paths `robots.txt` disallows, on purpose. It can trip a WAF |

The audit level sets the default: `passive` at quick, `active` at surface and full, signed in or not (squirrel 0.0.108 and later; before that, probing followed sign-in). `aggressive` is never a default. The run banner shows the level in force, such as `Probing   active · budget 30s`.

```bash
squirrel audit https://example.com --passive --format llm     # a site the user does not own
squirrel audit https://example.com -P active --format llm     # same as --probe active
squirrel audit https://example.com --aggressive --probe-budget 1m --format llm
squirrel audit https://example.com --pentest --format llm     # --level full --probe aggressive
```

From squirrelscan/skills, MIT.

More from squirrelscan/skills