Docs / Surface / ai/claude-code

AI Skills

When you connect an AI assistant to the local npx @tendrl/surface-mcp server, it automatically receives skills: guided instructions that teach the assistant how to scan files, interpret results, and integrate security into workflows. No plugins or extra installation needed.

Note

Skills are served by the local stdio server (npx @tendrl/surface-mcp), not the hosted url endpoint. The hosted endpoint serves documentation as resources, but the skills ship with the local server. Use the local-server config below to get skills.

Setup

Add the local Surface MCP server to your Claude Code configuration (.mcp.json in your project root or ~/.claude.json globally):

json


{
  "mcpServers": {
    "surface": {
      "command": "npx",
      "args": ["-y", "@tendrl/surface-mcp"],
      "env": {
        "SURFACE_KEY": "${SURFACE_KEY}"
      }
    }
  }
}

Once connected, Claude automatically discovers the available skills.

How it works

The local Surface MCP server serves skills as MCP resources alongside its documentation. When the MCP client connects, it calls resources/list and sees the available skills. When you ask a question that matches a skill, the AI assistant reads the skill content via resources/read and uses it to guide which tools to call, what parameters to use, and how to interpret results.

This works with Claude Code, Cursor, Claude Desktop, and any MCP-compatible client that can launch a stdio server. No plugins, no file downloads, no extra configuration; the skills ship with the server itself.

Skills

Skill	What it does	Example triggers
`surface-scan`	Scan files and payloads for malware, interpret safety scores, manage scan profiles and API keys	"scan this file for malware", "check this payload for threats", "is this binary safe?"

How skills work

When you ask Claude something like "scan this payload for malware," it reads the surface-scan skill from the server which provides context on:

Which tool to call (scan_payload for inline content; scan_file for files, which can run fully offline via a local scanner binary)
How to interpret the safety score (0-100 scale, threat levels, IOCs)
How to handle deferred scans for large content
How to present results clearly (clean, informational, suspicious, malicious)

Agentic scanning

The skill also covers payload scanning for AI agent workflows: detecting prompt injection, credential leaks, and malicious tool calls in content before your agent processes it.

← Back to Surface docs