Releases

New Audit Rules — Agent Experience (AX)

Three new rules in the Agent Experience category, focused on how well your site serves AI agents and crawlers (242 rules total):

• ax/llms-txt — detects /llms.txt (and /llms-full.txt) at the domain root and checks its basic Markdown format. An emerging standard that gives AI agents a curated, machine-readable map of your site.
• ax/markdown-response — checks whether your site serves text/markdown via content negotiation (or exposes a .md variant of the homepage). Agents increasingly prefer clean Markdown over rendered HTML.
• ax/content-without-js — flags significant main content that only appears in the JS-rendered DOM and is invisible to agents that read raw HTML.

Browse the full rule set → https://docs.squirrelscan.com/rules

Improvements

• MCP server — API-key authentication with scope-gated tools for the local stdio server.
• Faster cloud rendering — render submissions are batched and poll loops coalesced for quicker audits.
• Faster large-site crawls — URL dispatch and row cleanup are batched to cut overhead on big sites.
• More accurate domain detection — refreshed the bundled Public Suffix List snapshot.

Fixes

• Cloud audits that stall past their deadline are now finalized automatically instead of hanging.
• More efficient handling of error and empty pages during analysis.

---

Install or update

curl -fsSL https://squirrelscan.com/install.sh | sh
# already installed:
squirrel self update

squirrelscan v0.0.56 — more signal, fewer surprises. 🐿️

📊 Domain Stats tracking

A new Domain Stats section in the dashboard surfaces your site's off-page footprint: backlinks, referring domains, organic keywords & traffic, and paid search — with month-over-month trend history so you can watch it move over time. Pro accounts get the full history and monthly auto-refresh; free accounts get a preview.

🎯 Per-website audit rule selection

Pick which audit rules run on a per-website basis (it used to be one setting for the whole account). Tune each site to the checks that actually matter for it.

☁️ Cloud audit reliability

Fixed a bug where a cloud audit could fail at the very last step — publishing the report — for some sites, so the crawl and analysis ran but no report ever appeared. Cloud audits now publish reliably.

---

Install or upgrade: https://squirrelscan.com/download · squirrel self update

squirrelscan v0.0.55

A reliability-focused patch — better technology detection, sturdier crawling, and more accurate reporting.

Fixes & improvements

• Technology detection on every audit. Your site's detected stack — CMS, framework, CDN, analytics and more — now appears in the CLI output, the report, and the dashboard for every audit, including quick scans. Previously it only showed up on some runs.
• Sturdier crawling. Audits no longer skip pages when a server sends malformed or mislabeled compression, and a crawl can no longer get stuck on an unresponsive connection — a hard time budget always finalizes with the pages collected.
• Accurate render credits. Cached page renders now report the credits actually charged instead of the full estimate.
• Cleaner run history. Interrupted or cancelled audits are recorded correctly instead of lingering as phantom "timed out" failures in your dashboard.

squirrelscan v0.0.54

A new Agent Experience audit category and smarter signed-in audits. 🐿️

New

• Agent Experience (ax) audit category — checks for how well your site serves AI agents and crawlers, starting with ax/ai-crawlers (does your robots.txt allow or block the major AI bots?). More ax rules are on the roadmap.

Audits & accounts

• Signed in? You get the full audit by default. Logged-in and Pro audits now run the complete cloud rule set + site profile automatically — no extra flags or prompts. Pass --http any time you want a local-only run.
• Detected technologies now appear in your dashboard for signed-in audits, even before you publish a report.

Under the hood

• Default models updated to Gemini Flash 3.1, plus reliability and telemetry fixes.

---

Update with squirrel self update (or it'll auto-update within 24h).

squirrelscan v0.0.53

Incremental crawling you can toggle, hardened webhooks, and faster repeat audits. 🐿️

New

• Incremental crawls — re-audits now skip pages that haven't changed since the last run, so repeat scans are faster and gentler on the sites you audit. Toggle with --incremental / --no-incremental, and crawls stay politeness-aware with per-host rate limits and staggering.

Webhooks

• Hardened delivery — outbound webhooks are now protected against SSRF and DNS-rebinding, so a webhook URL can't be pointed at private or internal addresses.
• Secret rotation — roll a webhook signing secret without downtime.
• Polished settings — edit existing webhooks, see delivery status at a glance, and get URL validation up front.

Performance

• Faster cloud audits — cloud prefetch now runs in parallel after the first stage instead of strictly one-at-a-time.
• Single-pass parsing — each page is parsed once and reused across crawl and audit rather than twice.
• Leaner rules — removed redundant overhead in the per-page rule loop.

Reliability & fixes

• API errors now return a consistent, typed shape across endpoints.
• Switching a report between public and private no longer errors out when you're low on credits — it tells you clearly instead.

---

Update with squirrel self update (or it'll auto-update within 24h).

squirrelscan v0.0.52

New

• Local MCP server — squirrel mcp runs squirrelscan over stdio so any MCP-compatible agent (Claude, etc.) can crawl and audit directly.
• Per-website crawl & audit config — set max pages, depth, and coverage per site, with trigger attribution on every run.
• Redesigned report header + one-click "open report" from the dashboard.

Cloud

• Smart audits — cross-audit finding merge with a union rescore, so a partial re-audit carries prior findings forward instead of inflating your score; removed findings are retired cleanly.
• More reliable cloud-render crawls — interruptible fetches, a crawl-phase watchdog, a stale-run reaper, and an HTTP-first hybrid mode for faster runs that no longer stall.

Reliability & fixes

• Publishing no longer fails when a site's own security findings look "code-like"; a failed publish is now recorded as an error audit with a clear status instead of vanishing silently.
• Website title/description are taken from the page's real metadata rather than an AI paraphrase.
• Existing reports pick up renderer changes when their HTML is regenerated.
• Crawler: quick-mode sitemap discovery is restored when resuming a crawl.

Performance

• Faster crawls — lower hot-path overhead and higher single-host throughput with politeness-aware staggering.
• Rules & reports — Core Web Vitals hints computed once per page, O(N²)→O(N) result accumulation, and batched result persistence.

squirrelscan v0.0.51

Your audits now show up live, your scores stop fibbing on partial re-runs, and repeat audits got cheaper. 🐿️

🔴 Live audits in the dashboard

Signed in? Your audit now appears in the dashboard the instant it starts — not just when it finishes.

• Live page-by-page progress as a run crawls.
• Org "running now" feed — see every audit in flight across all your sites, plus your live credit balance.
• Richer run details — who ran it, the source/runner, and coverage mode, right on the run card.
• The dashboard "Reports" surface is now Audits (an audit is the run; the report is its output).

📊 Smart audits — no more score inflation on partial re-audits

Run a quick re-audit of a few pages and your health score used to jump because the pages you skipped silently dropped out. Not anymore.

• Issues on pages you didn't re-crawl carry forward, so your score reflects your whole known site — not just what you scanned this run.
• Pages that 404/410 get their old issues retired automatically.
• Reports tag each finding as fresh vs carried and show an "audited N of M known pages" coverage line.

⚡ Faster, cheaper repeat audits

Cloud render results are now cached across audits. When a page hasn't changed since last time, we reuse the stored render instead of re-rendering — repeat audits are quicker and cost 1 credit instead of 2 for each unchanged page.

🧹 Under the hood

• Org-homepage audit-status loads in one batched query (no more per-site N+1).
• Expanded API + CLI test coverage; settings tests no longer touch your real ~/.squirrel.

---

Update with squirrel self update (or it'll auto-update within 24h). Full diff: v0.0.50…v0.0.51.

squirrelscan v0.0.50

A speed-and-polish release: audits default to fast mode, reports are deterministic, the rule set is leaner, and published reports are CSP-ready. 🐿️

⚡ Fast by default

• quick is now the default coverage mode — audits run fast, local, and free by default (seed + sitemaps, no link discovery, ~25 pages) with no credit prompt. Opt into deeper crawls + cloud rendering/enrichment with -C surface or -C full. (#259)

🐛 Fixes

• Deterministic reports — finding and affected-URL ordering is now stable across repeat audits of the same site, so report diffs reflect real changes instead of nondeterministic ordering churn (a side effect of concurrent rule execution). (#150)
• CSP-safe screenshots — the published-report screenshot's hide-on-error now uses a single static, hash-whitelistable <script> instead of a per-element inline onerror, so reports keep working under a Content Security Policy. (#254)

🧹 Under the hood

• Page-finding compaction — the local smart-audit finding store now prunes terminal (resolved/stale) findings and removed pages on churny sites, keeping the store bounded over time; open and carried findings are never touched. (#197)
• Dead-code removal — deleted an unregistered legacy SEO rule module whose title-length threshold had drifted from the active rule. (#249)

Full changelog: https://github.com/squirrelscan/squirrelscan/compare/v0.0.49...v0.0.50

squirrelscan v0.0.49

A polish release with one big headline: real-time dashboard sync goes live. Alongside it, a focused report-quality pass makes audits sharper and more honest — clearer blocking warnings, cache reframed, sitemap 4xx false-positives gone, technologies that actually sync, screenshots in public reports, and a smarter title-length rule. Plus -C quick is now genuinely free. 🐿️

⚡ Real-time dashboard sync is live

• Live-sync enabled — audits and website add / edit / delete now reflect in the dashboard instantly, no refresh. Org-scoped, WebSocket-pushed, ticket-authenticated. (#204, #211)

🐛 Report fixes

• Blocking section, fixed — now one warning per blocked script (vendor-labelled) with accurate "pages affected" counts, instead of a single lumped "0 pages affected" warning. (#240)
• Cache, reframed — demoted from a headline figure to subtle metadata in the report, dashboard, and CLI output; it's a feature of the audit, not a score. (#239)
• Sitemap 4xx false-positives gone — a Range request was making some servers answer 416, which looked like a broken page. (#235)
• Technologies sync to the dashboard — tech detected during an audit now appears in the dashboard Technologies view on publish, and broken tech icons are fixed. (#238, #234)
• Screenshots in public reports — published reports now show the site screenshot alongside the category breakdown. (#241)
• Smarter title-length warning — the "title too long" threshold relaxed 60 → 75 chars to match Google SERP truncation, so good titles stop tripping it. (#236)

✨ CLI

• -C quick is truly free — quick coverage now skips all cloud services, so there's no credit prompt and nothing to spend. (#237)
• Sturdier cloud preflight — hardened coverage validation, a NaN guard on the update-check cadence, and a more resilient preflight. (#226, #227)
• Install fix — install via squirrelscan.com/install (the old install.squirrelscan.com host was NXDOMAIN). (#222)

🧹 Under the hood

• Render-cache foundation — schema, credit accounting, R2 blob storage, and live-path wiring land behind a flag for repeat-audit speedups (rolling out separately). (#193, #217, #218)
• Legacy consent migration — existing cloud_render_consent users migrated to the newer disclosing prompt. (#215)

Full changelog: https://github.com/squirrelscan/squirrelscan/compare/v0.0.48...v0.0.49

squirrelscan v0.0.48

squirrelscan grows up into a platform. This release makes it programmable — org-scoped API keys, a documented public REST API, and outbound webhooks — and CI-native — an official GitHub Action, build-gating exit codes, and token auth that just works in a pipeline. Plus auto-publish to your dashboard, faster re-audits, and a stack of sharp fixes. 🐿️

🔌 The squirrelscan API

• Org-scoped API keys with scopes — mint keys per org, scoped to exactly what they're allowed to do, with rate limiting built in. Create and revoke them from a new API Keys page in the dashboard (scope picker, presets, one-time secret reveal). (#154, #158)
• Public REST API — a documented, stable surface with an OpenAPI spec and a consistent error envelope, so you can drive audits and pull results from your own tooling. (#175)
• Outbound webhooks — get notified when audits happen; org-scoped delivery with retries. (#171)
• Developers hub — a brand-new docs section pulling REST API, CI/CD, webhooks, authentication, and Agents & MCP together in one place → docs.squirrelscan.com/developers (#183)

⚙️ Built for CI

• Official GitHub Action — uses: squirrelscan/audit-action@v1: install, audit, and gate your build in a few lines. (#168, #169)
• --fail-on build gating — fail the pipeline on a threshold you choose (score<90, score:perf<80, severity>=error, errors>0, …). Exit code 2 means a threshold tripped, 1 means the run itself broke — so CI can tell a regression from a crash. (#167)
• SQUIRREL_API_TOKEN env auth — set one env var and the CLI authenticates with no login step, fail-closed (no silent fallback) — built for CI secrets. squirrel whoami now shows your token's scopes. (#159)

✨ New

• Audits auto-publish to your dashboard — signed-in audits now publish automatically (unlisted + free by default), so your audit history is always there. Public reports cost 2 credits; opt out anytime with --no-publish / --offline. (#170)
• Sub-resource caching + a bad-caching rule — crawls now cache CSS, JS, images, and fonts like a browser would, so repeat audits are noticeably faster, and a new performance rule flags pages serving poor caching headers. (#107, #108)
• Smart audits (experimental, opt-in) — a local per-page finding store with union scoring across runs; off by default, enable with smart_audits = true in squirrel.toml. (#110)
• One up-front cloud consent prompt — logged-in audits now ask once, with a clear cost estimate, before spending any credits — no more per-step surprises. (#191)

🐛 Fixes

• Cleaner console output — run-relative timestamps and no more raw ISO date dumps cluttering the audit log. (#190)
• Hardened auto-update — skips CI, respects opt-out, configurable cadence, and a doctor health check, so background updates stay quiet and predictable. (#201)
• Rendered audits no longer 413 — technology detection now bounds its payload so large rendered pages don't blow the request size limit. (#192)
• musl / Alpine installs — the installer ensures libstdc++ is present, so the binary runs on Alpine out of the box. (#163)

🧹 Under the hood

• Live-sync foundation — a new org-scoped sync engine (Durable Object oplog + WebSocket push with ticket auth) lands behind a flag, paving the way for a real-time dashboard. (#205, #220)

squirrelscan v0.0.47

A big one — the overnight batch plus a couple of sharp fixes. Faster re-audits, a new site-integrity category, an editor's-style summary for Pro, and brand-impersonation detection that finally understands every TLD on the planet. 🐿️

✨ New

• Editor's-style audit summary (Pro) — logged-in Pro audits now include a short prose summary with point-form big-ticket items, written like a quick email to management. (#101)
• Site-integrity checks — a new integrity category flags signs of a compromised or abused site: brand-impersonation sign-ins, obfuscated inline scripts, fake auth overlays, template discontinuity, orphan pages, and SEO doorways. Findings require ≥2 corroborating signals before they escalate, so false positives stay low. (#116)
• Browser-like crawl caching — repeat audits now reuse fresh cached resources (honoring cache-control / conditional GET 304 / content-hash), so a second run is dramatically faster. Sub-resources (CSS/JS/images/fonts) are cached too, and a new performance rule flags pages with poor caching headers. (#104)

🐛 Fixes

• Brand-impersonation now handles every TLD — registrable-domain (eTLD+1) detection uses the real Public Suffix List, so multi-label suffixes (.com.au, .co.uk, …), deeper tiers, and free-hosting platforms no longer let an off-brand sign-in slip past the check. (#144)
• Clearer auth & cloud behavior — auth login errors now name the server and tell you how to fix them; an expired session no longer silently drops you into a degraded run — the audit keeps working with local checks only, prints why on the Account line, and (in an interactive terminal) asks before continuing. Cloud steps skip cleanly when signed out — no more confusing "failed" noise. Agents and CI proceed automatically. (#161)
• More resilient crawling — TLS / status-0 fetch failures fall back to a standard fetch, with clearer logging. (#119)
• Better E-E-A-T detection — about/contact/privacy pages with .html or non-English URLs are recognized, as are author bylines and dates in Kadence hCard / Yoast @graph markup. (#121, #122)
• No more hang when every sitemap URL is filtered — link discovery re-enables so the crawl proceeds instead of stalling at zero pending. (#123)

⚡ Performance

• Faster audits — content-walk, link-position, and rule-execution optimizations. Output is identical; the run is just quicker. (#114)

🧹 Internal

• Site-metadata and cloud results are now threaded per-run (no more process globals), making concurrent audits safe. (#126)
• Retired the deprecated ai/site-type rule in favor of the Stage-0 site-metadata profile. (#127)
• squirrel audit --max-pages is now documented with a limit-reached hint. (#124)

Site profiles land — squirrelscan now figures out what kind of site it's auditing and tailors both its cloud analysis and its audit rules to match. Plus a dashboard polish pass and unified scoring everywhere.

New: Site profiles

• squirrel audit now resolves a per-domain site profile — site type, business category, primary country & audience, the publisher/business behind the site, contact details, social profiles, languages, and domain age/registrar (via RDAP). Logged-in audits resolve it automatically (12 credits/scan); it's report-only and never affects your health score, and shows up as a dedicated Site profile section in every format (console, HTML, Markdown, JSON, XML, LLM).

Smarter, site-aware rules

• Audit rules now run only when they apply to your site. Privacy & legal checks gate by jurisdiction, E-E-A-T checks by whether the site is YMYL (your-money-or-your-life), local-business checks by whether it's actually a local business, and social-presence checks by the profiles we detect. Rules that don't apply are shown as a visible skipped check — never silently dropped.
• Fully backward-compatible — offline audits, low-confidence profiles, or sites without a resolved profile run exactly as they did before. New rules.ignore_applicability config escape hatch turns gating off entirely.
• Two new rules — legal/subprocessor-disclosure and social/social-match (verifies the social links on your site actually point back to your profiles). (partly addresses #15 — Legal Compliance)

Publish

• Publishing a report now auto-fills its public page with the site's title and description pulled from the resolved profile, so shared reports read cleanly without manual editing.

Dashboard

• New read-only Site profile page for each website, surfacing everything the audit detected.
• Unified scoring across the whole product — a single source of truth for score thresholds (90 / 70), colors, grades, and bands, now shared by the CLI, every report format, the dashboard, audit emails, and GitHub PR comments.
• Settings redesigned — website, org, and user settings are now full-width, independently-savable section cards.
• Track Issue surfaced at the top of report findings (create-or-open the linked issue), and notifications are now correctly org-scoped.

Under the hood

• The older ai/site-type check is superseded by the richer site profile — it's now report-only (weight 0) and no longer double-charges.
• Cloud analysis moved to a two-stage decision graph: the site profile resolves first (Stage 0), then gates which downstream cloud services run — so cloud features no longer fire indiscriminately. Spend is confirmed before any charge.

Technology detection lands, cloud rendering turns on by default for logged-in audits, scheduled audits move to Pro, and a batch of community-requested audit fixes — plus a ~3 MB smaller binary.

New: Technology detection

• squirrel audit now identifies the tech behind any site — 385 fingerprints across CMS, frameworks, CDN & hosting, analytics, tag managers, payments, chat, and security/consent tools, rendered as a dedicated Technologies section in every format (console, HTML, Markdown, JSON, XML, LLM) with logos. Logged-in audits run it automatically (5 credits/scan); it's report-only and never affects your health score. (Partly addresses #10 — thanks @wildfiremedia.)
• Per-domain history — squirrelscan remembers what it last saw on each domain and flags what changed since. The current snapshot is free; the historical timeline is a paid-plan feature.

Cloud rendering, on by default

• Logged-in audits now render pages in a real cloud browser by default, after a one-time consent prompt — so JavaScript-heavy and SPA sites are audited the way users actually see them, no extra flags. Your choice is remembered. --render forces rendering for a single run, --http forces a plain fetch, and non-interactive runs stay on HTTP until you've opted in (--yes alone doesn't grant consent).

Scheduled audits

• Recurring scheduled audits are now part of the Pro plan — free orgs see an upgrade prompt where scheduling used to be.
• Every audit carries a source badge — cli, cloud, scheduled, or github — across the CLI, report lists, and dashboard, so you can see at a glance where each run came from.

Audit rules

• New "Blocking" category — the old ad-blocker check is now its own Blocking section with two sub-groups, ad blocking and privacy blocking, surfaced everywhere reports render. Blocked-link and privacy-tracker findings are now warnings (previously informational). --category adblock still works as an alias and older saved reports normalize automatically.
• LCP hints read cleanly across pages (#16 — thanks @wildfiremedia) — the LCP Optimization Hints check now shows a per-page count ("3 likely-LCP images loaded without preload") instead of dumping every image URL into one confusing cross-page list.
• Sharper response-header checks (#20 — thanks @wildfiremedia) — HSTS max-age=0 is now flagged as "HSTS disabled" (it tells browsers to stop enforcing HTTPS) rather than "0 days too short", a malformed HSTS header with no max-age is caught, and sites advertising only HTTP/2 get a nudge toward HTTP/3.

Dashboard

Alongside this release, the dashboard moved its org, settings, website, and schedule pages onto the shared component kit — consistent cards, forms, inputs, badges, and loading/empty/error states, with proper disabled-during-submit behavior on every form.

Under the hood

• The binary is ~3 MB smaller — the bundled EasyList/EasyPrivacy filter lists and their parser were dead weight (ad/privacy detection runs in the cloud now), so they're out of the download.