MCP.Market

Surf MCP server

online · 100% uptime
by geckovision.tech·tech.geckovision/surf·v0.2.0·7 stars

Point Gecko at an OpenAPI spec; get first-call-correct, auth-hidden agent tools.

B82/100grade B
What users say
No reviews yet
Be the first
Safety scan
B82/100

full report

Adoption
Growing

7 stars105 downloads/wk

Reviews

Write one

Nobody has reviewed Surf yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Surf tools (2, 1 write)

write = sends, deletes, buys or posts
  • comprehend_apiwrite actionFree

    Submit an API's OpenAPI URL (or a human docs page URL with from_docs=true) and get it comprehended into first-call-correct agent tools — no integration code. Returns the API name, its usable tools, agent-native artifacts (llms.txt / gecko.json / tools.md), and self-host next steps. Comprehends and returns to YOU only: it does not host, publicly list, or register your API.

  • list_surfacesFree

    Every API surface served on this host, with the MCP URL to reconnect to. Use it when you landed on the host root and need a specific API. Free, instant, and it lists only what the public index lists.

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

1 high1 medium
  • Code scan61 source files scanned20/25
  • Live reliabilityremote reachable in 611ms20/20
  • Tool poisoning2 tool descriptions checked15/15
  • Auth qualityopen endpoint exposes 1 write-action tools with no auth3/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Findings (2)

  • highWrite-action tools reachable without authenticationauth.open-write
  • mediumeval / new Function usedexec.eval
    gecko_surf-0.2.0/gecko/evaluate.py: …ntApiClient # --- Golden-set retrieval eval (the frozen bar every semantic-catalog st…
Overall 82/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Surf compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
82/100
higher than 65% of 4,460 AI and agents servers
Tools
2
the typical AI and agents server has 6
Tools that change things
50%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote AI and agents server answers 100%
Response time
482 ms
faster than 28% of 2,331 AI and agents servers
GitHub stars
7
more than 81% of 2,711 AI and agents servers
Downloads a week
105
more than 65% of 1,538 AI and agents servers with a package

What its tools let an agent do: 1 read · 1 change

Install Surf in Claude Code, Cursor or VS Code

claude mcp add --transport http surf https://mcp.geckovision.tech/mcp
Add to Cursor

What the publisher says

From the Surf repository's README, as published. We do not edit it. Read it on GitHub

Stop letting your agent guess

Check the call before it counts. Gecko is open-source and runs on your machine: one command maps any API — messy, paywalled, or on-chain — into a call graph your agent checks instead of guesses from, and anything that spends is simulated to a receipt first. No wallet, no payment rail, no key held — 64 mainnet transactions, 49 with a cost predicted before signing, 47 of those exact to the unit (re-read from the chain, 2026-09-19).

Quickstart · Docs · Architecture · FAQ · Security

<!-- mcp-name: tech.geckovision/surf -->

Built for the calls your agent must not get wrong. Two axes, either one qualifies:

a messy surface (paywalled, drifting, undocumented, on-chain) or a **high-stakes

action** (your agent runs unattended with credentials or money).

What Gecko is

Gecko is an open-source knowledge graph built specifically for AI agents that call APIs. Point it at an OpenAPI spec, a docs site, or a Solana program's IDL and source, and it reads that surface into a graph your agent traverses — every fact tagged with where it came from, and anything it cannot establish flagged rather than guessed.

A specification tells your agent what a call looks like. It cannot tell it whether the call will work. That gap is in every spec, including a perfect one, and it is where agents fail expensively: not on the call that errors, but on the call that is accepted and wrong. Gecko closes it by handing back one specific call — and, for anything that spends, by simulating that call against real state first and returning a receipt.

It is not the agent and not an orchestrator. It holds no key, signs nothing, broadcasts nothing, and stores no response payload — it stores surfaces and correctness metadata, never your data.

Quick start

No install:

npx @geckovision/gecko doctor              # 1. check your environment
npx @geckovision/gecko add <spec-or-docs>  # 2. comprehend it — $0, no live call
npx @geckovision/gecko report <spec>       # 3. get the scorecard — grade + findings
npx @geckovision/gecko serve <spec>        # 4. your agent uses it over MCP

Or install once:

npm install -g @geckovision/gecko          # prebuilt binary — no Python needed
uv tool install "gecko-surf[serve]"        # or pip, if you want the Python package

gecko add <spec-or-docs>

Plug into your agent:

# Claude Code
claude mcp add my-api -- npx -y @geckovision/gecko serve <spec> --stdio

# Cursor / VS Code / any MCP client — mcp.json
{ "mcpServers": { "my-api": { "command": "npx", "args": ["-y", "@geckovision/gecko", "serve", "<spec>", "--stdio"] } } }

Going live is a separate, deliberate step:

gecko auth set <provider>                  # key goes to your OS keychain — never mcp.json

Then your agent asks questions, not endpoints:

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Surf: common questions

Is Surf MCP server safe?
Mostly: it is graded B (82/100). Read the Surf safety report
How do I install Surf?
It runs remotely at mcp.geckovision.tech. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Surf need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Surf maintained?
The last commit was 39 days ago (2026-09-26). The latest release is v0.2.0.
Is Surf up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
What can I use instead of Surf?
Servers from other publishers that do the same job: Basic Memory MCP server, HOL Guard MCP server and Agent-Native Chat MCP server.
How does Surf compare with other AI and agents MCP servers?
safety score 82/100 (higher than 65% of 4,460 AI and agents servers); tools 2 (the typical AI and agents server has 6); tools that change things 50% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Surf

Same job from other publishers: the closest match first, then the best rated.

  • Basic Memory
    Local-first knowledge management with bi-directional LLM sync via Markdown files.
    B
  • HOL Guard
    Local-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.
    A
  • Agent-Native Chat
    Minimal chat-first app with durable threads, actions, and the app-agent loop
    A
  • Butterbase AI
    Butterbase MCP server — manage your backend: schemas, auth, functions, storage, RAG, deploys.
    A
  • Agent Recall
    Correction-first agent memory. Precision KPI tracks if agents heed warnings. 5 layers, local-only.
    A