Website audits and SEO fixes inside Windsurf
Give Cascade the squirrelscan CLI or the hosted MCP server, and let it audit and fix your site.

Windsurf's Cascade agent is built to run terminal commands and act on what comes back, which is exactly the shape squirrelscan's CLI output takes. Install it once, and Cascade can audit a URL and start working through the issues in the same session.
For the deeper integration, connect the hosted MCP server: cloud audits with real browser rendering, a per-website issue tracker, and the 260+ rule catalog, all as tools Cascade can call directly instead of parsing terminal output.
One naming note: Cognition rebranded Windsurf as Devin Desktop in 2026, and the Cascade agent is folding into the Devin brand as Devin Local. The in-app names changed, but the config file paths and JSON keys below are unchanged, so nothing here breaks if your install already shows the new naming.
Where is the Windsurf MCP config file?
Windsurf reads its MCP servers from ~/.codeium/windsurf/mcp_config.json if you run the standalone editor, or ~/.codeium/mcp_config.json (no windsurf segment) if you run the Windsurf plugin for JetBrains or VS Code. Windsurf does not create either file for you, so if it isn't there yet, make it.
The config is global, at the user level. There is no project-scoped MCP config in Windsurf, so a server you add is available in every workspace, and a .vscode or .idea file won't be picked up.
Servers go under an mcpServers object keyed by name. A remote server takes a serverUrl string; a local stdio server takes command and args instead. After saving the file, open the MCP panel (the MCPs icon at the top right of the Cascade panel, or Devin Settings > Cascade > MCP Servers) and hit refresh, because Cascade reads the file on refresh rather than watching it.
Cascade caps active MCP tools at 100 across every connected server combined. If you are near that ceiling, new servers can load without their tools becoming callable, so disable ones you aren't using in the MCP panel.
The paths survived the rebrand. Cognition renamed Windsurf to Devin Desktop in 2026 and Cascade is folding into the Devin brand as Devin Local, but the .codeium directory and the JSON keys are unchanged.
{
"mcpServers": {
"squirrelscan": {
"serverUrl": "https://mcp.squirrelscan.com/mcp"
}
}
}Setup
Run it locally
free · squirrel CLI on your machine- 1
Install the squirrelscan CLI
Run it from Windsurf's terminal. Local audits are free and don't need an account.
bashcurl -fsSL https://install.squirrelscan.com | bash - 2
Ask Cascade to audit a site
The llm format is compact and structured, so Cascade can work from it directly without you summarizing the report first.
squirrel audit optionsbashsquirrel audit https://example.com --format llm - 3
Or hand Cascade a report you already ran
If you'd rather run the audit yourself and pass the results over, write the report to a file in your project and point Cascade at it. Any stored audit can be re-exported this way without re-crawling the site.
squirrel report optionsbashsquirrel report <audit-id> --format llm > audit.md
Run it hosted
cloud · rendering, scheduling, issue tracker, shareable reports- 1
For cloud audits, add the hosted MCP server
Paste this into your mcp_config.json (see above for where that file lives and how to reload it), then refresh the MCP panel and finish the OAuth sign-in that opens in your browser. For a shared or headless setup, send a bearer API key header instead of using OAuth.
MCP client setup for Windsurfjson{ "mcpServers": { "squirrelscan": { "serverUrl": "https://mcp.squirrelscan.com/mcp" } } }
Frequently asked questions
- Is squirrelscan free to use in Windsurf?
- Local audits are free and need no account: the squirrel CLI runs on your machine and audits any URL. The hosted MCP server adds cloud audits with browser rendering, shareable reports, and a per-website issue tracker on pay-as-you-go credits, and every account gets 500 free credits every month.Credits and pricing
- How do I get Cascade to fix my site's SEO?
- Give it the report. Run an audit in the llm output format, or export a stored report to a file in your project, and Cascade reads the findings, maps them to files in your project, and edits the code. Re-audit afterwards to confirm each fix landed.Fix your site with an agent
- Can I audit localhost or a staging site from Windsurf?
- Yes, with the CLI. It audits anything your machine can reach, including localhost and private staging URLs. The hosted MCP server crawls from squirrelscan's cloud, so it needs a publicly reachable URL; for private networks use the CLI or the local squirrel mcp server.
- Do I need an account or API key to connect the MCP server?
- Not for local CLI audits, which need neither. To connect the hosted MCP server you sign in once: point the config at the server with no auth header and Windsurf runs an OAuth browser flow, or set a bearer API key header instead for shared or headless setups.
- Can it audit my site on every deploy?
- Yes, but from CI rather than the editor. Add a squirrel audit step with a fail-on threshold and the build fails on a regression (exit code 2), or turn on scheduled cloud audits on the Pro plan to re-audit daily, weekly, or monthly from the dashboard.CI gating guide
- Is Windsurf still Windsurf, or is it Devin Desktop now?
- Cognition rebranded Windsurf as Devin Desktop in 2026, and the Cascade agent is folding into the Devin brand as Devin Local. The config file paths (~/.codeium/windsurf/mcp_config.json) and MCP JSON keys are unchanged, so this setup works whichever name your install shows.
Get started
Follow the docs quickstart, or see what a finished audit looks like.