# squirrelscan (remote · mcp.squirrelscan.com)

Website QA for your coding agent: audit SEO, performance, security, accessibility over MCP.

- Trust score: 76/100 (medium)
- Change this week: +64
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `mcp.squirrelscan.com`: 76/100 (this document), [markdown](https://verifymcp.io/servers/com-squirrelscan-squirrelscan/mcp.md), [page](https://verifymcp.io/servers/com-squirrelscan-squirrelscan/mcp)

## Channel facts

- Endpoint: `https://mcp.squirrelscan.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.2`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 81/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS not yet verified: we couldn't determine whether a plaintext access path exists.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2843 tokens (~167/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http com-squirrelscan-squirrelscan https://mcp.squirrelscan.com/mcp
```

### Codex

```toml
[mcp_servers.com-squirrelscan-squirrelscan]
url = "https://mcp.squirrelscan.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-squirrelscan-squirrelscan": {
      "type": "remote",
      "url": "https://mcp.squirrelscan.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-squirrelscan-squirrelscan --url https://mcp.squirrelscan.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-squirrelscan-squirrelscan:
    url: "https://mcp.squirrelscan.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-squirrelscan-squirrelscan": {
      "type": "http",
      "url": "https://mcp.squirrelscan.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 75, −6)

- [security regression] HTTPS: pass → unverified
- [security regression] HSTS header: pass → fail

### 2026-07-31 (score 81, +6)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 75, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-28 (score 74, +62)

- [security improvement] Authorization: unverified → pass
- [security improvement] HTTPS: unverified → pass
- [security improvement] HSTS header: fail → pass
- [security improvement] Transport: fail → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.07
- [functional improvement] Tool coverage: unverified → 100

### 2026-07-27 (score 12, −56)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 68)

First indexed and scored.

## MCP tools (17)

### `run_audit` (~243 tokens)

Run a cloud audit

Run a cloud audit of a website (crawl + 260+ rule analysis + report). Credits are spent as the audit runs (pay-as-you-go). Call once without confirm to get a credit estimate; if the response has status "confirmation_required", show the estimate to the user and call again with confirm: true. Audits are asynchronous and take minutes: poll get_audit_status with the returned run_id, then fetch results with get_report. The website is registered automatically on first audit.

Input parameters:

- `confirm` (boolean): Approve the credit spend. Omit on the first call to see the estimate; set true to start the audit after the user approves.
- `coverage` (string): Crawl coverage profile (default fast). Deeper coverage crawls more pages and costs more credits.
- `max_credits` (integer): Spend guard: refuse to start if the upper-bound estimate exceeds this many credits.
- `render` (boolean): Render pages in a headless browser (default true). Catches JavaScript-dependent issues; costs extra credits per page.
- `url` (string, required): Website URL to audit, e.g. https://example.com (scheme optional).

### `get_audit_status` (~113 tokens)

Get audit status

Poll a running audit by run_id (from run_audit or list_audits). Status pending/running means keep polling (every 15-30 seconds) — the response includes a progress field (phase, message, page/link counts) when available. Status completed means the report is ready: call get_report with the same run_id. Status failed/cancelled includes the error and completion reason.

Input parameters:

- `run_id` (string, required): Run id returned by run_audit or listed by list_audits.

### `list_audits` (~69 tokens)

List audits

List the organization's audit runs: currently active (pending/running) plus the most recent runs of any status. Use the run ids with get_audit_status or get_report, and website ids with list_issues.

Input parameters:

- `limit` (integer): Max recent runs to return (default 20).

### `list_websites` (~91 tokens)

List websites

List websites the organization has audited, with their latest run status and health score. Use the website_id with list_issues/get_issue. Websites registered but never audited do not appear; run_audit or add_website registers a new one. Returns total/has_more for pagination.

Input parameters:

- `limit` (integer): Page size (default 50).
- `offset` (integer): Pagination offset (default 0).

### `add_website` (~82 tokens)

Add a website

Register a website with the organization without running an audit (run_audit registers automatically, so this is only needed to set a site up ahead of time). Returns the website_id; idempotent per domain, so calling it again returns the existing website.

Input parameters:

- `url` (string, required): Website URL to register, e.g. https://example.com (scheme optional).

### `delete_website` (~137 tokens)

Delete a website

Delete a website from the organization (soft delete: past audits, reports, and issues are preserved, and published report links keep working). Frees a slot under the plan's website limit. Re-adding the same domain later registers a fresh website with a new website_id. Call once without confirm to see what will happen; call again with confirm: true to delete.

Input parameters:

- `confirm` (boolean): Approve the deletion. Omit on the first call to see the effect; set true to delete after the user approves.
- `website_id` (string, required): Website id from list_websites, run_audit, or add_website.

### `get_report` (~321 tokens)

Get audit report

Fetch the finished report for an audit run (use the run_id from run_audit once get_audit_status shows completed). Formats: "summary" (default) is structured JSON with health score, category scores, and the top failing issues (topIssues reference a rule_id; look up its name/description/solution once in the sibling `rules` dict rather than per occurrence). Each topIssues row carries `provenance`: "carried" means the finding is re-injected from a page not re-crawled this run (not a fresh result) — check `lastSeenAt` for when it was last actually observed. `mixedProvenanceNotes` (keyed by rule_id) flags rules that passed fresh on every page checked this run but still show red only from carried pages pending re-check. Also includes a `history` array of prior audits of this website with score/issue deltas when available; "llm" is a compact text rendering optimized for LLM context (carried findings marked inline); "markdown" is a full human-readable report. Start with summary, then pull llm or markdown when you need every issue and page detail.

Input parameters:

- `format` (string): summary (default): JSON scores + top issues. llm: compact text for LLM context. markdown: full report.
- `run_id` (string, required): Run id returned by run_audit or listed by list_audits.
- `top_issue_limit` (integer): summary format only: max top issues to include (default 25).

### `list_issues` (~169 tokens)

List website issues

List a website's open audit issues (like a bug tracker: each issue is one failing rule with occurrences across pages, numbered per website). Returns issues sorted by severity, plus severity and status summaries. Use the issue number with get_issue for full detail and comments. Filter by status/severity/category to narrow down.

Input parameters:

- `category` (string): Filter by rule category code (e.g. seo, performance, security).
- `limit` (integer): Page size (default 50).
- `offset` (integer): Pagination offset (default 0).
- `severity` (string): Filter by severity.
- `status` (string): Filter by issue status (omit for all statuses).
- `website_id` (string, required): Website id from list_websites, run_audit, or list_audits.

### `get_issue` (~112 tokens)

Get issue detail

Fetch one issue by website_id + issue number, including its full description, recommendation, affected pages, occurrence detail from the latest report (which page/image/URL, snippets), and comment thread. Use comment_on_issue to add analysis or a fix note to the thread.

Input parameters:

- `issue_number` (integer, required): Issue number from list_issues.
- `occurrence_limit` (integer): Max occurrences to include (default 20); see occurrence_count/truncated.
- `website_id` (string, required): Website id the issue belongs to.

### `comment_on_issue` (~87 tokens)

Comment on an issue

Post a comment on a website issue — use it to record analysis, a proposed fix, or what you changed, so the team sees it in the dashboard issue thread. Markdown is supported.

Input parameters:

- `body` (string, required): Comment body (markdown supported).
- `issue_number` (integer, required): Issue number from list_issues.
- `website_id` (string, required): Website id the issue belongs to.

### `list_rules` (~110 tokens)

List audit rules

Browse the catalog of 260+ audit rules that run during an audit, grouped into categories (crawlability, meta tags, performance, security, accessibility, content, and more). Filter by category code or search by keyword to find what a specific rule checks. Use get_rule for one rule's full detail.

Input parameters:

- `category` (string): Filter to one category code (see the categories list in the response).
- `search` (string): Case-insensitive keyword match on rule id, name, and description.

### `get_rule` (~93 tokens)

Get rule detail

Fetch one audit rule by id (e.g. "meta/title-length"), including what it checks, how to fix it (recommendation), its severity and score weight, a docs link, and whether it is a cloud (credit-billed) rule. Rule ids appear in report topIssues and issue rule_id fields.

Input parameters:

- `rule_id` (string, required): Rule id like "crawl/canonical-chain" (category/slug).

### `whoami` (~46 tokens)

Who am I

Identify the current credentials: how you are authenticated, which organization you act for, the plan, and the current credit balance. Call this first in a session to orient yourself before running audits.

### `get_credit_balance` (~69 tokens)

Get credit balance

Get the organization's credit balance: monthly credits (reset each billing period) and pack credits (purchased, never expire). Audits spend credits pay-as-you-go while they run; run_audit shows an upper-bound estimate before starting. Top up at https://app.squirrelscan.com/billing.

### `list_credit_transactions` (~153 tokens)

List credit transactions

Audit the organization's credit accounting log: grants (signup/monthly/pack/promo), debits (audit_base 50cr + render 2cr/page + folded 0-cost services), refunds, and adjustments — newest first, paginated. Each debit/refund carries `run_id` so you can group a single audit's spend. Use this to explain why an audit cost what it cost or to reconcile a balance. For one audit's per-feature breakdown, use get_report (its `cost` field). Read-only.

Input parameters:

- `cursor` (string): Opaque pagination cursor from a previous page's `next_cursor`.
- `limit` (integer): Max transactions to return (default 25, max 100).

### `create_api_key` (~183 tokens)

Create an API key

Mint a new squirrelscan API key for this organization (requires credentials carrying the keys:write scope, which OAuth sign-in grants). The key is returned EXACTLY ONCE: show it to the user immediately and suggest saving it as the SQUIRRELSCAN_API_KEY environment variable for the CLI, CI, and MCP. Minted keys cannot themselves mint keys.

Input parameters:

- `expires_in_days` (integer): Expire the key after this many days (default: never expires).
- `name` (string, required): Human-readable label shown in the dashboard, e.g. "ci" or "claude-code".
- `scopes` (array): Scopes to grant (default: audits:write, audits:read, credits:read, org:read). Grantable: audits:write, audits:read, credits:read, org:read, org:write.

### `send_feedback` (~249 tokens)

Send feedback

Report your experience using squirrelscan mid-session: a bug, a missing feature, what worked, what confused you, missing report data, or tool ergonomics. Reviewed by the team to improve the product — use it any time something surprises you, not just at the end of a session. Works with any authenticated credentials, including read-only API keys.

Input parameters:

- `category` (string, required): bug_report (a defect in squirrelscan itself — wrong or missing rule result, crash, broken tool), feature_request (something squirrelscan should do but doesn't), what_worked (something worked well), c…
- `message` (string, required): Free-text feedback (truncated at 2000 chars).
- `run_id` (string): Audit run id this feedback relates to, if any (from run_audit/get_report). Verified against your credentials' runs before being attached.
- `website_id` (string): Website id this feedback relates to, if any (from list_websites). Verified against your org's websites before being attached.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-squirrelscan-squirrelscan/mcp#diagnostics

## Score history

- 2026-08-03: 76
- 2026-08-02: 75
- 2026-08-01: 81
- 2026-07-31: 81
- 2026-07-30: 75
- 2026-07-29: 74
- 2026-07-28: 74
- 2026-07-27: 12
- 2026-07-26: 68

## Links

- Remote endpoint: https://mcp.squirrelscan.com/mcp
- Repository: https://github.com/squirrelscan/squirrelscan
- Website: https://squirrelscan.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-squirrelscan-squirrelscan/mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-squirrelscan-squirrelscan/mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-squirrelscan-squirrelscan/mcp