squirrelscan

The website QA tool for your coding agent

squirrelscan is an Open Source cli tool that audits websites for SEO, performance, security, accessibility, agent experience and other issues, and gives your coding agent exact fixes. Run it from the CLI, inside your coding agent, in the cloud, or over MCP.

Combine your coding agent with a deterministic and extensible audit tool.

A real run on a tiny test site, with the released CLI (signed out, so free) and Claude Code. We cut the two minutes the agent spent working, because nobody wants to watch an agent think.

Features

• 300+ Rules, 22 Categories - Comprehensive coverage across SEO, accessibility, performance, and security
• Fast crawler - Highly optimized memory efficient crawler
• Agent Experience - Audit agent experience to assist agents in using your site
• Security Audit - Detect phishing kits, leaked credentials, and more
• Smart Incremental Crawling - ETag, Last-Modified, content hashing. Resume from checkpoints.
• Developer-First CLI - Single binary, zero dependencies, shell completions, self-update
• Crawl History & Changes - Track site evolution, compare crawls, spot regressions
• Multiple Output Formats - Console, JSON, HTML, Markdown, Text, LLM, XML
• MCP Connection - Connect your agent to local or cloud MCP to run audits, fixes, etc.

Rule categories

Ordered by how much a failure usually costs you, not by how many rules each one has.

Category	Rules	What it covers
Crawlability	20	Whether search engines and agents can reach and index you at all: robots.txt, sitemap validity and coverage, indexability conflicts, redirect and canonical chains, soft 404s
Core SEO	14	The per-page fundamentals: title, meta description, H1, canonical, charset, doctype, robots meta, Open Graph and Twitter cards, plus canonical form drift across the site
Agent Experience	17	How ready you are for AI agents to read, discover and act on the site: whether GPTBot and Claude-User get the same content a browser does, AGENTS.md, llms.txt, Markdown responses, API and MCP discovery, licensing and noai signals, pay-per-crawl, response token weight
Site Integrity	9	Signs the site has been compromised: injected doorway pages, phishing kit signatures, obfuscated scripts, brand impersonation, cloaking, known-malicious URLs
Security	22	Transport and header hygiene: HTTPS and HSTS, CSP, cookie flags, mixed content, subresource integrity, leaked secrets, tokens in web storage, unprotected and downgraded forms, open GraphQL introspection and mutations over GET
Links	16	Internal and external link health: broken and dead links, in-page anchors whose target is gone, redirect chains, anchor-text quality, orphan and dead-end pages, pages linked only from sitewide chrome, HTTPS downgrades
Content	24	Text quality and honesty: common misspellings, duplicate titles and descriptions, title-template consistency, readability, word count, freshness, heading hierarchy, keyword stuffing, hidden text, placeholder media and contact details, encoding damage
Performance	30	Core Web Vitals and delivery: LCP, CLS and INP hints, TTFB, compression, caching, render-blocking resources, DOM size, font delivery, legacy and unminified JS/CSS
Reliability	2	Scripts, stylesheets and fonts that fail to load (a first-party bundle that answers 404 or 500 after a deploy, third-