squirrelscan for OpenCode

1. 1

   Install the squirrelscan CLI

   Local audits are free and run wherever your OpenCode session has shell access.

   bash

   curl -fsSL https://install.squirrelscan.com | bash

2. 2

   Ask OpenCode to audit a site

   Describe the task in plain language. OpenCode runs the CLI and summarizes the results.

   text

   Run squirrel audit https://example.com --format llm and tell me the top 3 issues to fix first

1. 1

   Connect the hosted MCP server

   Add a remote server to opencode.json, then run opencode mcp auth to sign in. OpenCode detects the 401, uses dynamic client registration, and stores the token securely outside the config file.

   json

   {
     "$schema": "https://opencode.ai/config.json",
     "mcp": {
       "squirrelscan": {
         "type": "remote",
         "url": "https://mcp.squirrelscan.com/mcp",
         "enabled": true
       }
     }
   }

   Hosted MCP server guide
2. 2

   Or use an API key for headless runs

   For CI or a machine without a browser, skip OAuth and pass a squirrelscan API key as a bearer header instead. Interpolate SQUIRRELSCAN_API_KEY so the key stays out of the file.

   json

   {
     "mcp": {
       "squirrelscan": {
         "type": "remote",
         "url": "https://mcp.squirrelscan.com/mcp",
         "headers": { "Authorization": "Bearer sq_your_api_key" }
       }
     }
   }

   API keys and scopes

Frequently asked questions

How do I get OpenCode to fix my site's SEO?

Connect the hosted squirrelscan MCP server (or install the squirrel CLI), then ask in plain English, for example: audit example.com and fix the top SEO issues in this repo. OpenCode runs the audit, reads the report, and edits your source to fix what it finds. Deploy, then re-audit: issues close on their own once the rule stops firing.Fix your site with an agent

Can OpenCode audit my site on every deploy, or in CI?

Yes. For unattended runs, use the squirrel CLI with a --fail-on threshold so the build exits non-zero on a regression, or pass a squirrelscan API key as a bearer header for a headless OpenCode run over MCP. Both skip the browser sign-in. Recurring cloud audits (daily, weekly, or monthly) are also available from the dashboard on the Pro plan.CI gating guide

Is auditing through OpenCode free, and do I need an account?

Local squirrel CLI audits are free, run offline, and need no account. Cloud audits over the hosted MCP server need a squirrelscan account and spend credits, but every account gets 500 free credits a month with no card. run_audit returns a cost estimate for OpenCode to show you before it spends anything.Cloud credits

Can I limit squirrelscan to one project instead of every OpenCode session?

Yes. Put the squirrelscan block in a project-level opencode.json and it only applies inside that directory, keeping it out of your global config. Run opencode mcp list to see which servers are active and their auth status.

What can OpenCode do over MCP that piping CLI output can't?

Piping squirrel report --format llm into a prompt works with zero setup and is fine for one-off audits. The MCP server gives OpenCode native tools, run_audit, get_audit_status, get_report, list_issues, and get_rule, so it can poll a running audit, work the per-website issue tracker, and browse the rule catalog without shelling out each time.