Releases

The Team plan arrives, plus clearer auth guidance from the local MCP server.

New

• Team plan. Invite teammates into an org at $29/seat/month (2-seat minimum, billed monthly), with a shared pool of 3,000 credits per seat. Assign roles (admin, editor, viewer, billing) and manage seats from Settings → Team in the dashboard.

Improvements

• Clearer auth errors from the local MCP server. Calling an authenticated tool without a session now returns an actionable error naming both fixes: set SQUIRRELSCAN_API_KEY for headless and CI use, or run squirrel auth login for an interactive session.

squirrelscan v0.0.64

• Four new performance and image rules (249 total): LCP images without fetchpriority="high", slow web font delivery (font-display, preload), hidden carousel slides eagerly loading images, and rendered vs intrinsic image aspect-ratio mismatches.
• Four score groups: every report now rolls categories up into SEO, Performance, Security, and Agents scores, with a redesigned report UI and shareable OG cards to match. Category scores also weigh how many items each finding affects, so one big issue no longer counts the same as one tiny one.
• Fewer false positives across the rule set: service-area businesses without a street address pass LocalBusiness checks, phone matching understands country codes and trunk zeros in tel: links, FormShield counts as form protection, license banners no longer flag minified JS, keyword-stuffing ignores stopwords and repeated CTA buttons, sitemap coverage respects the crawl page cap, and hidden carousel slides are no longer told to lazy-load above the fold.
• Hosted MCP server: point any MCP client at https://mcp.squirrelscan.com and your agent gets the full toolset with OAuth, no local install. Tool responses got smarter for fixing agents: rule lookups now include a concrete recommendation and a docs link, and audit status reports live progress and a completion reason.
• Free cloud audits got the full treatment: logged-in free accounts now run the same scan pipeline as Pro, differing only in included credits.
• New tutorials: step-by-step guides for fixing your site with an AI agent, running local audits with the CLI, and going deeper with cloud audits at https://docs.squirrelscan.com/guides.

See https://docs.squirrelscan.com for documentation and the full rule set.

squirrelscan v0.0.63

• New install endpoint: curl -fsSL https://install.squirrelscan.com | bash now installs from a dedicated, edge-cached delivery that no longer rides on the marketing site. The old install URL keeps working.
• WAF challenge detection: audits flag DataDome and Kasada challenge pages that answer with a 200 instead of a real block, so a bot wall no longer looks like a healthy page.
• Bigger cloud audits finish: raised the cloud audit time budget so larger sites (~20+ pages) complete instead of timing out.
• Better domain data for country-code TLDs: WHOIS lookups fall back to a secondary source when a ccTLD registry (e.g. .au) times out.
• Clearer reports: pages that were render-blocked and recovered via a direct fetch are now called out in the report.
• Faster, fairer per-host crawling, plus internal hardening and reliability improvements.

See https://docs.squirrelscan.com for documentation and the full rule set.

squirrelscan v0.0.62

• Audits of down, blocked, or empty sites now report an honest N/A score and a failed/blocked status instead of a misleading "A / 100%" — across console, JSON, Markdown, LLM, text, and XML output.
• Internal audit-engine hardening and reliability improvements.

See https://docs.squirrelscan.com for documentation and the full rule set.

Reliability and hardening release — bug fixes across Site Profile, cloud rules, and custom headers, plus a faster, cheaper cloud-audit default.

Fixes

• Site Profile capture fixed. Domain metadata (registrar, domain age, nameservers) captures reliably again — a rule-matching regression that could leave the Site Profile section blank on some audits is resolved.
• More reliable registrar/age lookups for .au and other ccTLD sites. Domain-fact lookups that were timing out from the cloud now retry with a proper user-agent and log the reason on failure, so Site Profile data shows up more consistently.
• Custom request headers are validated. Header values containing control characters (CR, LF, or NUL) are now rejected, closing a header-injection vector on the -H / [crawler] headers feature added in v0.0.60.
• Site-metadata cloud rule fixed on Google models. A schema-compatibility error (HTTP 400) that could make the site-metadata rule fail is resolved.
• Honest smart re-audit status. A smart re-audit whose first run crawls zero pages no longer reports itself as "completed" — it surfaces the real state instead.

Improvements

• Faster, cheaper cloud audits. Cloud audits now default to Gemini Flash 3.1, trimming latency and cost on the cloud-backed rules with no change to results.

New

• Custom request headers. Send any header on every crawl request with -H "Name: Value" (repeatable) or a [crawler] headers block in squirrel.toml — handy for auth tokens, feature flags, or getting past a WAF on a staging site. Header values are treated as secrets and redacted in output.
• Cloaking detection. A new opt-in differential probe re-fetches suspicious pages as a search-engine crawler and flags any that serve different content to bots than to real visitors.
• Threat-intelligence checks. New opt-in rules scan for known-bad indicators and exploit-kit signatures, so a compromised site gets caught early.

Improvements

• Accurate cloud spend on cache hits. A cached render now shows as its own line in the spend summary instead of the full render estimate, so the total matches what you're actually charged.
• Sharper author detection. A bare "Editor" or "Editorial" byline no longer counts as real author attribution (fewer false E-E-A-T author signals), while a genuine byline like "Jane Smith, Editor" is still recognized.
• Faster audits. Page rules now run on a synchronous fast-path, trimming per-rule overhead across the whole run.
• Recurring findings, badged. The dashboard Issues tracker now badges findings carried over from a previous audit, so you can see what keeps coming back.

---

Install or update

curl -fsSL https://squirrelscan.com/install.sh | sh
# already installed:
squirrel self update

New

• Clearer audit outcomes. When a crawl is blocked by a bot wall or can't finish, the audit now reports its real state — blocked, failed, or partial — instead of showing a misleading health grade for a site it never fully reached. The CLI also exits non-zero on a blocked or failed audit, so it won't quietly pass in CI.

Improvements

• Tougher against bot walls. When cloud rendering hits a WAF or anti-bot challenge, squirrel now falls back to a direct fetch so the page is still analyzed instead of being dropped.
• Organic search positions, charted. HTML reports now render the keyword position breakdown as a clean bar chart instead of a plain text list.

Fixes

• Scheduled audits are off by default on every plan. Switching on a scheduled audit is always an explicit opt-in now — the dashboard and docs no longer imply Pro plans get one turned on for you.

---

Install or update

curl -fsSL https://squirrelscan.com/install.sh | sh
# already installed:
squirrel self update

Fixes

• Signed-in Pro audits now run the full rule set by default. A bare squirrel audit <url> on a Pro account now defaults to surface coverage, so the cloud-backed rules (AI, E-E-A-T, blocking) and the editor's summary run automatically — no need to pass --coverage surface. Free and anonymous runs keep the fast quick default (no cloud calls). Pass --coverage (or set [crawler] coverage in squirrel.toml) to override either way.
• A Pro audit that can't reach the cloud (transient network blip) no longer silently drops to the smaller quick crawl — it keeps the full crawl depth while skipping the unavailable cloud steps.

New Audit Rules — Agent Experience (AX)

Three new rules in the Agent Experience category, focused on how well your site serves AI agents and crawlers (242 rules total):

• ax/llms-txt — detects /llms.txt (and /llms-full.txt) at the domain root and checks its basic Markdown format. An emerging standard that gives AI agents a curated, machine-readable map of your site.
• ax/markdown-response — checks whether your site serves text/markdown via content negotiation (or exposes a .md variant of the homepage). Agents increasingly prefer clean Markdown over rendered HTML.
• ax/content-without-js — flags significant main content that only appears in the JS-rendered DOM and is invisible to agents that read raw HTML.

Browse the full rule set → https://docs.squirrelscan.com/rules

Improvements

• MCP server — API-key authentication with scope-gated tools for the local stdio server.
• Faster cloud rendering — render submissions are batched and poll loops coalesced for quicker audits.
• Faster large-site crawls — URL dispatch and row cleanup are batched to cut overhead on big sites.
• More accurate domain detection — refreshed the bundled Public Suffix List snapshot.

Fixes

• Cloud audits that stall past their deadline are now finalized automatically instead of hanging.
• More efficient handling of error and empty pages during analysis.

---

Install or update

curl -fsSL https://squirrelscan.com/install.sh | sh
# already installed:
squirrel self update

squirrelscan v0.0.56 — more signal, fewer surprises. 🐿️

📊 Domain Stats tracking

A new Domain Stats section in the dashboard surfaces your site's off-page footprint: backlinks, referring domains, organic keywords & traffic, and paid search — with month-over-month trend history so you can watch it move over time. Pro accounts get the full history and monthly auto-refresh; free accounts get a preview.

🎯 Per-website audit rule selection

Pick which audit rules run on a per-website basis (it used to be one setting for the whole account). Tune each site to the checks that actually matter for it.

☁️ Cloud audit reliability

Fixed a bug where a cloud audit could fail at the very last step — publishing the report — for some sites, so the crawl and analysis ran but no report ever appeared. Cloud audits now publish reliably.

---

Install or upgrade: https://squirrelscan.com/download · squirrel self update

squirrelscan v0.0.55

A reliability-focused patch — better technology detection, sturdier crawling, and more accurate reporting.

Fixes & improvements

• Technology detection on every audit. Your site's detected stack — CMS, framework, CDN, analytics and more — now appears in the CLI output, the report, and the dashboard for every audit, including quick scans. Previously it only showed up on some runs.
• Sturdier crawling. Audits no longer skip pages when a server sends malformed or mislabeled compression, and a crawl can no longer get stuck on an unresponsive connection — a hard time budget always finalizes with the pages collected.
• Accurate render credits. Cached page renders now report the credits actually charged instead of the full estimate.
• Cleaner run history. Interrupted or cancelled audits are recorded correctly instead of lingering as phantom "timed out" failures in your dashboard.

squirrelscan v0.0.54

A new Agent Experience audit category and smarter signed-in audits. 🐿️

New

• Agent Experience (ax) audit category — checks for how well your site serves AI agents and crawlers, starting with ax/ai-crawlers (does your robots.txt allow or block the major AI bots?). More ax rules are on the roadmap.

Audits & accounts

• Signed in? You get the full audit by default. Logged-in and Pro audits now run the complete cloud rule set + site profile automatically — no extra flags or prompts. Pass --http any time you want a local-only run.
• Detected technologies now appear in your dashboard for signed-in audits, even before you publish a report.

Under the hood

• Default models updated to Gemini Flash 3.1, plus reliability and telemetry fixes.

---

Update with squirrel self update (or it'll auto-update within 24h).

squirrelscan v0.0.53

Incremental crawling you can toggle, hardened webhooks, and faster repeat audits. 🐿️

New

• Incremental crawls — re-audits now skip pages that haven't changed since the last run, so repeat scans are faster and gentler on the sites you audit. Toggle with --incremental / --no-incremental, and crawls stay politeness-aware with per-host rate limits and staggering.

Webhooks

• Hardened delivery — outbound webhooks are now protected against SSRF and DNS-rebinding, so a webhook URL can't be pointed at private or internal addresses.
• Secret rotation — roll a webhook signing secret without downtime.
• Polished settings — edit existing webhooks, see delivery status at a glance, and get URL validation up front.

Performance

• Faster cloud audits — cloud prefetch now runs in parallel after the first stage instead of strictly one-at-a-time.
• Single-pass parsing — each page is parsed once and reused across crawl and audit rather than twice.
• Leaner rules — removed redundant overhead in the per-page rule loop.

Reliability & fixes

• API errors now return a consistent, typed shape across endpoints.
• Switching a report between public and private no longer errors out when you're low on credits — it tells you clearly instead.

---

Update with squirrel self update (or it'll auto-update within 24h).

squirrelscan v0.0.52

New

• Local MCP server — squirrel mcp runs squirrelscan over stdio so any MCP-compatible agent (Claude, etc.) can crawl and audit directly.
• Per-website crawl & audit config — set max pages, depth, and coverage per site, with trigger attribution on every run.
• Redesigned report header + one-click "open report" from the dashboard.

Cloud

• Smart audits — cross-audit finding merge with a union rescore, so a partial re-audit carries prior findings forward instead of inflating your score; removed findings are retired cleanly.
• More reliable cloud-render crawls — interruptible fetches, a crawl-phase watchdog, a stale-run reaper, and an HTTP-first hybrid mode for faster runs that no longer stall.

Reliability & fixes

• Publishing no longer fails when a site's own security findings look "code-like"; a failed publish is now recorded as an error audit with a clear status instead of vanishing silently.
• Website title/description are taken from the page's real metadata rather than an AI paraphrase.
• Existing reports pick up renderer changes when their HTML is regenerated.
• Crawler: quick-mode sitemap discovery is restored when resuming a crawl.

Performance

• Faster crawls — lower hot-path overhead and higher single-host throughput with politeness-aware staggering.
• Rules & reports — Core Web Vitals hints computed once per page, O(N²)→O(N) result accumulation, and batched result persistence.