squirrelscan for Codex

1. 1

   Install the squirrelscan CLI

   Local audits are free and run wherever your Codex session has shell access.

   bash

   curl -fsSL https://install.squirrelscan.com | bash

   CLI install and quickstart
2. 2

   Ask Codex to audit a site

   In a Codex CLI session, describe the task in plain language. It runs the CLI and summarizes the results.

   text

   Run squirrel audit https://example.com --format llm and tell me the top 3 issues to fix first

1. 1

   Connect the hosted MCP server

   codex mcp add registers the streamable HTTP server, codex mcp login runs the browser OAuth sign-in. The token lands in Codex's own credential store, not in config.toml, so a committed config stays clean.

   bash

   codex mcp add squirrelscan --url https://mcp.squirrelscan.com/mcp
   codex mcp login squirrelscan

   MCP client setup for Codex CLI
2. 2

   Or use an API key for headless runs

   For CI or a machine without a browser, skip OAuth and point Codex at an environment variable holding a squirrelscan API key. Codex reads it at connect time and sends it as a bearer token.

   bash

   codex mcp add squirrelscan --url https://mcp.squirrelscan.com/mcp \
     --bearer-token-env-var SQUIRRELSCAN_API_KEY

Frequently asked questions

How do I get Codex to fix my site's SEO?

Install the squirrel CLI, then in a Codex session ask it to run squirrel audit <url> --format llm and fix the top issues. Codex reads the compact report, maps each finding to the file it comes from, edits the code, and can re-run the audit to confirm the fix. For a guided loop, install the skills with npx skills add squirrelscan/squirrelscan and prompt Codex to use the audit-website skill.Fix your site with an AI agent

Do I need an account, or is it free?

No account is needed for local CLI audits: they are free and run wherever Codex has shell access. Signing in unlocks the cloud, which adds browser rendering, scheduled audits, the issue tracker, and shareable reports. Every account gets 500 free credits per month, and cloud audits beyond that spend credits pay-as-you-go. run_audit returns a cost estimate for Codex to show you before anything runs.How credits work

Can Codex use squirrelscan as native tools instead of parsing terminal output?

Yes. Run codex mcp add squirrelscan --url https://mcp.squirrelscan.com/mcp then codex mcp login squirrelscan to connect the hosted server. Codex then calls tools like run_audit, get_report, and list_issues directly, so it can poll a running audit, work the issue tracker, and browse the rule catalog without shelling out each time. Piping squirrel report --format llm into a prompt still works with zero setup for one-off audits.Hosted MCP server

Can I connect squirrelscan from CI or a headless container?

Yes. Instead of the browser OAuth flow, add the server with --bearer-token-env-var SQUIRRELSCAN_API_KEY and export a squirrelscan API key. Codex reads the variable at connect time and sends it as an Authorization bearer token, so no browser is needed. Mint a key with squirrel keys create --shell.

Can I limit squirrelscan to one project instead of every Codex session?

codex mcp add and codex mcp login only write the global ~/.codex/config.toml. To scope it to a single project, hand-write the same [mcp_servers.squirrelscan] block into that project's .codex/config.toml, which Codex loads once the project is trusted.