Docs / Surface / resources

Resources

Downloads, configs, and tools for integrating with Surface.

• Data Retention: how long scan history is kept, by plan

MCP Server

Connect AI assistants to the Surface API. Works with Cursor, VS Code, Claude Desktop, and any MCP-compatible client. See the MCP across Tendrl overview (Contact docs → AI) for how Surface fits alongside the other servers.

Hosted endpoint: https://app.tendrl.com/surface/mcp

Copy this config into a url-based MCP client:

{
  "mcpServers": {
    "surface": {
      "url": "https://app.tendrl.com/surface/mcp",
      "headers": {
        "Authorization": "Bearer <SURFACE_API_KEY>"
      }
    }
  }
}

For file scanning, API key management, and skills, use the local server instead; the easiest way is the one-click desktop extension. (The interactive scan card works on both the hosted endpoint and the local server.)

One-click install (recommended)

Download the Surface extension, surface.mcpb, and open it in Claude Desktop. It prompts for your API key in a secure field (stored in your OS keychain), pre-fills the base URL, and needs no JSON editing. This build renders the interactive scan card.

Manual config

{
  "mcpServers": {
    "surface": {
      "command": "npx",
      "args": ["-y", "@tendrl/surface-mcp"],
      "env": {
        "SURFACE_KEY": "${SURFACE_KEY}"
      }
    }
  }
}

The interactive scan card

On clients that support the MCP Apps extension (Claude Desktop, claude.ai, VS Code Copilot, Goose, Postman), scan results render as an interactive card instead of raw JSON, from both the hosted endpoint and the local server: a safety score, per-engine results, and a proceed / block gate. The card factors in prompt-injection findings, so a payload that scores "clean" for malware but contains an instruction-override attack is flagged and blocked, not waved through. On any other client you get the same result as text.

Full MCP documentation →

Claude Code Skills

When you add the local npx @tendrl/surface-mcp server to Claude Code, skills are served automatically; no plugins needed. Add the local-server config above and Claude discovers the surface-scan skill via the server's resources endpoint. (The hosted url endpoint does not serve skills.)

Full Claude Code documentation →

Scanner Binary

For offline scanning where files never leave your machine. Install with one command — it detects your platform, verifies checksums, and puts surface-scanner on your PATH (the exact name the docs invoke it by):

# macOS / Linux
curl -fsSL https://app.tendrl.com/api/public/tools/surface-scanner/v1/latest/install.sh | sh

# Windows
powershell -c "irm https://app.tendrl.com/api/public/tools/surface-scanner/v1/latest/install.ps1 | iex"

The installer downloads with curl, so macOS Gatekeeper and Windows SmartScreen never flag the binary. The same install command is shown in the dashboard under Scanner → Scan offline instead. Prefer a raw artifact? Direct downloads:

Verify a direct download against SHA256SUMS.txt, chmod +x it, and rename it onto your PATH as surface-scanner — noting that browser downloads of unsigned binaries get flagged by Gatekeeper/SmartScreen, which the install command avoids.

The scanner binary can be used standalone or as a local backend for the MCP server. See Scanner Binary documentation for details.

← Back to Surface docs