squirrelscan for GitHub Copilot

1. 1

   Install the squirrelscan CLI

   One line, works in the same shell Copilot's agent mode drives.

   bash

   curl -fsSL https://install.squirrelscan.com | bash

2. 2

   Ask Copilot to run an audit

   Open Copilot Chat, switch to agent mode, and describe what you want. It runs the CLI in the integrated terminal and reads the output back to you.

   text

   Audit https://example.com with squirrelscan and list the top issues by severity

1. 1

   Or connect the hosted MCP server

   VS Code's built-in MCP client (1.101+) runs the OAuth handshake for you. Add it with Command Palette then MCP: Add Server (choose HTTP), or save this to .vscode/mcp.json, and Copilot gets squirrelscan's tools directly, no CLI parsing required. The file is workspace-scoped and safe to commit; no token is written to it.

   json

   {
     "servers": {
       "squirrelscan": {
         "type": "http",
         "url": "https://mcp.squirrelscan.com/mcp"
       }
     }
   }

   MCP client setup for VS Code
2. 2

   Use an API key for CI or a shared repo config

   Committing .vscode/mcp.json to the repo? Use a prompted secret input instead of a browser sign-in, so teammates aren't forced through OAuth just to open the project. VS Code keeps the entered key in its secret storage, not in the file.

   json

   {
     "inputs": [
       {
         "type": "promptString",
         "id": "squirrelscan-api-key",
         "description": "squirrelscan API key",
         "password": true
       }
     ],
     "servers": {
       "squirrelscan": {
         "type": "http",
         "url": "https://mcp.squirrelscan.com/mcp",
         "headers": { "Authorization": "Bearer ${input:squirrelscan-api-key}" }
       }
     }
   }

   API keys and scopes

Frequently asked questions

How do I get GitHub Copilot to fix my site's SEO and performance?

Ask Copilot in agent mode to audit the site and apply the fixes. It runs squirrelscan in the integrated terminal, reads the prioritized list of issues, then edits the relevant files across your repo the same way it acts on a failing test. Re-run the audit afterwards to confirm the score went up.Fix your site with an AI agent

Is running audits through Copilot free?

Local CLI audits are free and run on your machine, no account needed. The hosted MCP server's cloud audits, which add real browser rendering and shareable reports, use pay-as-you-go credits (every account gets 500 free each month), and Copilot is expected to show you the estimate and confirm before spending.How cloud credits work

Do I need a squirrelscan account?

Not for the CLI path. Copilot agent mode just runs terminal commands, and local audits work signed out. The hosted MCP server needs an account, reached either through VS Code's browser OAuth sign-in or an API key set as a bearer header for CI and shared configs.

Can Copilot audit my site automatically on every deploy?

Copilot runs interactively in your editor, so for an automated check on every push or deploy you run the squirrelscan CLI in CI instead. There it exits non-zero when a --fail-on threshold trips and fails the build like any other check. Use Copilot for the fix loop, CI for the gate.CI gating guide

My org is on Copilot Business, can I still connect squirrelscan?

Yes, but an org or enterprise owner has to allow it first. In the Copilot admin settings they enable the "MCP servers in Copilot" policy (off by default) and set "Restrict MCP access to registry servers" to "Allow all", since squirrelscan is configured manually and is not in GitHub's MCP registry. The CLI path has no such restriction.

Does it work on localhost or a private staging site?

The CLI audits anything your machine can reach, including localhost and private networks. The hosted MCP server crawls from squirrelscan's cloud, so it needs a publicly reachable URL. Use the CLI or the local squirrel mcp server for anything private.