GitHub
GitHub’s official server lets AI read and manage code, issues and pull requests in your account. Use GitHub’s hosted version or run it locally with Docker.
Description from the maker (original English)
Website QA for your coding agent: audit SEO, performance, security, accessibility over MCP.
These three are never merged into one score: opinions, measurements and popularity are different things.
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
Pick the AI app you use, then copy the settings.
You need
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Works in Claude on the web, desktop and mobile:
https://mcp.squirrelscan.com/mcpRun this in your terminal
claude mcp add --transport http squirrelscan https://mcp.squirrelscan.com/mcpPaste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"squirrelscan": {
"url": "https://mcp.squirrelscan.com/mcp"
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Paste into .vscode/mcp.json in your project
{
"servers": {
"squirrelscan": {
"type": "http",
"url": "https://mcp.squirrelscan.com/mcp"
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
ChatGPT connects only to servers on the internet:
https://mcp.squirrelscan.com/mcpMenu names can differ slightly by plan and over time.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
Tool names and descriptions exactly as the server reported them on Nov 10, 2026. The maker wrote them, not us; we show them as plain text.
run_auditRun a cloud audit of a website (crawl + 300+ rule analysis + report). Only for sites the user owns or is authorized to test. Credits are spent as the audit runs (pay-as-you-go). The dry run is optional: pass confirm: true on the first call to start straight away. Without confirm,
get_audit_statusPoll a running audit by run_id (from run_audit or list_audits). Status queued/pending/running means keep polling (every 15-30 seconds): the response includes a progress field (phase, message, page/link counts) when available. Status queued means cloud audits are busy and the run
list_auditsList the organization's audit runs: currently active (queued/pending/running; queued means waiting for a free cloud slot, and it starts by itself) plus recent runs of any status. Pass website_id (from list_websites) to get one website's full audit history, oldest runs included, a
list_websitesList websites the organization has audited, with their latest run status, health score, and owned/prospect kind. Each row carries last_run_id (the latest run, any status) and last_report_run_id / last_report_id (the latest completed run whose report has not been deleted). Pass la
add_websiteRegister a website with the organization without running an audit (run_audit registers automatically, so this is only needed to set a site up ahead of time). Returns the website_id. Calling it again for the same domain returns the existing website, and a kind or scope passed agai
delete_websiteDelete a website from the organization (soft delete: past audits, reports, and issues are preserved, and published report links keep working). Frees a slot under the plan's website limit. Re-adding the same domain later registers a fresh website with a new website_id. Call once w
delete_websitesDelete up to 50 websites in one call, for cleaning up a dashboard that has filled with one-off or prospect audits. Same soft delete as delete_website (past audits, reports, and issues are preserved, published report links keep working, slots are freed) and the same two-step confi
get_website_settingsRead one website's stored audit settings: its audit level (quick, surface, full or custom) with the page cap, crawl strategy, rendering and external link checks it sets, the crawl depth, crawl scope, include/exclude patterns and internal link checks, whether broken link alerts ar
update_website_settingsChange one website's stored audit settings: level, max_pages, render, external_links, max_depth, scope, include_patterns, exclude_patterns and internal_links, broken_link_alerts (Pro and Team; switching it off is allowed on every plan), disable_rules (rule ids such as eeat/about-
get_reportFetch the finished report for an audit run (use the run_id from run_audit once get_audit_status shows completed). Formats: "summary" (default) is structured JSON with health score, category scores, and the top failing issues (topIssues reference a rule_id; look up its name/descri
compare_auditsCompare two completed audits of one website and get what changed. Defaults to the website's latest completed audit against the one before it; pass base/head run ids to compare any two. Each finding gets one of eight kinds: new, resolved, worsened, improved, unchanged (both audits
list_issuesList a website's open audit issues (like a bug tracker: each issue is one failing rule with occurrences across pages, numbered per website). Returns issues sorted by severity. `total`, `returned` and `has_more` describe the issues matching YOUR filters; `website_totals` (by_statu
get_issueFetch one issue by website_id + issue number, including its full description, recommendation, affected pages, occurrence detail from the latest report (which page/image/URL, snippets), and comment thread. The issue carries `provenance` as in list_issues ("fresh": re-checked this
comment_on_issuePost a comment on a website issue to record analysis, a proposed fix, or what you changed, so the team sees it in the dashboard issue thread. Markdown is supported.
list_entitiesList the entities a site declares in its JSON-LD, collapsed across every crawled page into one graph, so an Organization declared identically on 60 pages is one row rather than 60. Declarations collapse by resolved @id, or by type and name when there is no @id, so the SAME real-w
get_entityGet one entity as the map recorded it: the properties the map keeps (name, url, logo, image, sameAs, telephone, email, address, description), the pages that declare it, the properties whose values disagree between those pages, and the references in and out of it. The map keeps th
get_entity_graphGet the whole entity graph, or a filtered part of it, in a chosen format: json for the canonical document, jsonld for a validator, mermaid or markdown to read in a conversation, dot or graphml for a graph tool. Defaults to json. Takes the same filters as list_entities. mermaid ca
compare_entitiesCompare two audits of a site and get the change set: entities added and removed, entities that gained or lost an @id, occurrence changes, new and resolved conflicts and dangling references, summary deltas, and the pages each audit saw that the other did not. Defaults to the previ
get_entity_findingsGet the schema/entity-* rule verdicts for an audit: what is wrong with the site's entity graph, which entity keys and pages each finding affects, and the fix text for each. Use this instead of re-deriving the problems from the graph yourself. Each finding names one problem across
list_rulesBrowse the catalog of 300+ audit rules that run during an audit, grouped into categories (crawlability, meta tags, performance, security, accessibility, content, and more). Filter by category code or search by keyword to find what a specific rule checks. Each rule carries cloud (
get_ruleFetch one audit rule by id (e.g. "core/meta-title"), including what it checks, how to fix it (recommendation), its severity and score weight, a docs link, and whether it is a cloud (credit-billed) rule (`requires_cloud`) and whether it needs the render step (`requires_render`). R
whoamiIdentify the current credentials: how you are authenticated, which organization you act for, the plan, and the current credit balance. Useful at the start of a session, to see which organization the other tools act for.
get_credit_balanceGet the organization's credit balance: monthly credits (reset each billing period) and pack credits (purchased, never expire). Audits spend credits pay-as-you-go while they run; run_audit shows an upper-bound estimate before starting. An audit costs 50 credits plus 2 per audited
list_credit_transactionsAudit the organization's credit accounting log: grants (signup/monthly/pack/promo), debits (audit_base 50cr + audit_page 2cr per audited page + external_link 1cr per checked link + folded 0-cost services; older audits carry render rows instead of audit_page), refunds, and adjustm
create_api_keyMint a new squirrelscan API key for this organization and return it. The result contains a secret, a live credential for the organization, returned exactly once and never retrievable again; it is meant to be saved as the SQUIRRELSCAN_API_KEY environment variable for the CLI, CI,
send_feedbackSend feedback to the squirrelscan team: a bug, a missing feature, what worked, what was confusing, missing report data, or tool ergonomics. Use it when the user wants to report something or share their experience. Works with any authenticated credentials, including read-only API
list_notificationsRead the organization's notification feed, newest first: what finished, what broke, and what changed since you last looked. Categories include audit_complete, issues_detected, audit_failed, broken_links, third_party_added, third_party_spread, third_party_digest, third_party_compr
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 10, 2026
The registry name was verified against the domain squirrelscan.com (the registry checks domain ownership)
We have not read this repo from GitHub yet
We have not read this repo from GitHub yet
Responded in 1675 ms (HTTP 200)
No sign-in needed
Read 27 tool descriptions and found no hidden instructions to the AI
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
The registry does not list a required key, though some servers ask you to sign in on first use.
It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.
The GitHub repo last changed –, and the latest version (1.0.2) reached the registry 4 months ago.
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.
In the same category: GitHub, Desktop Commander, Cloudflare MCP
Servers in the same category from other makers, sorted by stars.
Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
GitHub’s official server lets AI read and manage code, issues and pull requests in your account. Use GitHub’s hosted version or run it locally with Docker.
MCP server for terminal commands, file operations, and process management
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
The website QA tool for your coding agent
squirrelscan is an Open Source cli tool that audits websites for SEO, performance, security, accessibility, agent experience and other issues, and gives your coding agent exact fixes. Run it from the CLI, inside your coding agent, in the cloud, or over MCP.
Combine your coding agent with a deterministic and extensible audit tool.
A real run on a tiny test site, with the released CLI (signed out, so free) and Claude Code. We cut the two minutes the agent spent working, because nobody wants to watch an agent think.
Ordered by how much a failure usually costs you, not by how many rules each one has.
| Category | Rules | What it covers |
|---|---|---|
| Crawlability | 21 | Whether search engines and agents can reach and index you at all: robots.txt, sitemap validity and coverage, indexability conflicts, redirect and canonical chains, soft 404s |
| Core SEO | 14 | The per-page fundamentals: title, meta description, H1, canonical, charset, doctype, robots meta, Open Graph and Twitter cards, plus canonical form drift across the site |
| Agent Experience | 17 | How ready you are for AI agents to read, discover and act on the site: whether GPTBot and Claude-User get the same content a browser does, AGENTS.md, llms.txt, Markdown responses, API and MCP discovery, licensing and noai signals, pay-per-crawl, response token weight |
| Site Integrity | 9 | Signs the site has been compromised: injected doorway pages, phishing kit signatures, obfuscated scripts, brand impersonation, cloaking, known-malicious URLs |
| Security | 23 | Transport and header hygiene: HTTPS and HSTS, CSP, cookie flags, mixed content, subresource integrity, leaked secrets, tokens in web storage, unprotected and downgraded forms, open GraphQL introspection and mutations over GET |
| Links | 14 | Internal and external link health: broken and dead links, in-page anchors whose target is gone, redirect chains, anchor-text quality, orphan and dead-end pages, pages linked only from sitewide chrome, HTTPS downgrades |
| Content | 25 | Text quality and honesty: common misspellings, duplicate titles and descriptions, title-template consistency, readability, word count, freshness, heading hierarchy, keyword stuffing, hidden text, placeholder media and contact details, encoding damage |
| Performance | 32 | Core Web Vitals and delivery: LCP, CLS and INP hints, TTFB, compression, caching, render-blocking resources, DOM size, font delivery, legacy and unminified JS/CSS |
| Reliability | 5 | Scripts, stylesheets and fonts that fail to load (a first-party bundle that answers 404 or 500 after a deploy, third-party and font failures), and forms that lose submissions |
| Images | 16 | Alt text, modern formats, responsive srcset, intrinsic dimensions and aspect-ratio mismatches, lazy loading above versus below the fold, file weight |
| Structured Data | 26 | JSON-LD validity and rich-result eligibility for Article, Product, FAQ, Review, Breadcrumb, Organization, LocalBusiness, Video and site search, the markup a page's classified type should carry, plus thirteen site-wide checks on the entity map: whether the site declares one identity for itself or a new one on every page, and rating markup that is not about the page it sits on |
| Accessibility | 61 | WCAG coverage: ARIA roles and names, form labels and autocomplete tokens, colour contrast, heading order, landmarks, tables and lists, focus visibility, touch targets, captions |
| Mobile | 8 | Viewport configuration, tap-target size, legible font sizes, horizontal scroll, blocked zoom, form fields small enough to zoom the page on focus, intrusive interstitials, the web app manifest and its icons |
| Social Media | 5 | Open Graph and Twitter Card completeness, image dimensions, canonical URL match, social profile links, site-chrome assets that disagree across pages |
| URL Structure | 9 | Length, casing, hyphenation, stop words, query parameters, special characters, trailing-slash consistency, site-wide convention consistency |
| E-E-A-T | 15 | Experience, expertise, authority and trust signals: author bylines and credentials, about and contact pages, citations, editorial policy, disclaimers, YMYL detection |
| Legal Compliance | 4 | Privacy policy, terms of service, real cookie-consent machinery, subprocessor disclosure |
| Internationalization | 2 | hreflang correctness and the document language declaration |
| Local SEO | 3 | NAP (name, address, phone) consistency across every crawled page, geo metadata, service-area businesses |
| Video | 3 | VideoObject markup, captions and accessibility, thumbnails |
| Analytics | 2 | Google Tag Manager presence and consent-mode wiring |
| Blocking | 3 | Content, links and trackers that ad blockers and privacy filters strip for a large share of your visitors |
Total: 300+ rules across 22 categories
See the rules reference for full details.
Paste into your coding agent (Claude Code, Codex, Cursor, opencode and friends):
Fetch and follow the setup instructions for squirrelscan at https://docs.squirrelscan.com/agent-setup/prompt.md
Your agent installs the CLI, connects MCP and runs a first audit. You can read exactly what it will follow first.
macOS / Linux:
curl -fsSL https://install.squirrelscan.com | bash
Windows:
iwr -useb https://install.squirrelscan.com/install.ps1 | iex
Homebrew (macOS):
brew install --cask squirrelscan/tap/squirrel
The cask installs a launcher that runs the regular installer on first use. The CLI then updates itself with squirrel self update; brew upgrade leaves it alone.
npm (all platforms):
npm install -g squirrelscan
npx (run without installing):
npx squirrelscan audit example.com
# Audit a website
squirrel audit example.com
squirrel audit example.com -f html -o report.html
squirrel audit example.com --format llm | claude
squirrel audit example.com --level quick
squirrel audit example.com --rule-include ax,performance
squirrel auth login
A health score and grade, group scores for SEO, performance, security and Agent Experience (AX) colored by score, a ranked list of issues, and a copy fix prompt for each one that you can paste into your coding agent. Publish reports to the web to share with team members or coding agents (fix instructions are embedded).
See an example report, or read how to read your report.
squirrelscan ships as an MCP server (hosted at mcp.squirrelscan.com), skills (autonomous audit + fix workflows), and a plugin for Claude Code and Cursor. Cursor installs in one click from the badge above; the rest are a single copy-paste.
Cl
Only the beginning is shown; read the rest in the repo