Compared on architecture, not adjectives.
There are three real alternatives to Surfil: build a proxy, stitch point tools, or route through a cloud gateway. Each is legitimate - here's the honest capability map.
What you'd actually be choosing between
Steelmanned on purpose - a comparison table only means something if the other columns are described fairly.
DIY proxy
A mitmproxy or custom gateway you build and maintain. Total control, but the proxy sees every prompt, you own its security surface, and it becomes an unfunded internal product.
Point tools
One cost tracker, one secret scanner, one memory plugin - per agent. Each is fine alone; together they're N configs, N failure modes, and no shared source of truth.
Cloud gateway
Route agent traffic through a vendor's cloud. Easy to adopt - but the gateway reads everything, cost scales with traffic, and leaving means unpicking your workflow.
Capability by capability
Every row is an architectural fact - checkable from how each approach is built, no benchmarks required.
| Capability | Surfil | DIY proxy | Point tools | Cloud gateway |
|---|---|---|---|---|
| Source never leaves device | ✓ By construction | ✗ Proxies see prompts | ~ Varies by tool | ✗ Cloud gateway sees all |
| Signed, offline-verifiable output | ✓ Ed25519, no account | ✗ | ✗ | ~ Vendor attestation only |
| One interception layer | ✓ One-Layer rule | ✗ You maintain it | ✗ One per tool | ✓ |
| Cost flat per user | ✓ Device does the work | ~ Your infra cost | ✓ | ✗ Scales with traffic |
| Portable memory (export) | ✓ .surfilpkg | ✗ | ~ | ✗ Lock-in |
| Honest, measured cost | ✓ measured + signed | n/a | ~ Marketing rates | ~ Marketing rates |
When Surfil is the wrong choice
A comparison page that never concedes anything is an ad. Three cases where an alternative genuinely wins.
You need traffic inspected in a central cloud
Some org policies require a cloud chokepoint that reads content. Zero-trace is the opposite architecture - a gateway fits that mandate; we don't.
You want one metric, once
If all you need is a spend counter for a single agent, a point tool is less to install. Surfil earns its place when cost, safety and memory stack up.
You enjoy owning the proxy
Some platform teams want interception as their own product. Genuinely fine - our One-Layer rule just means Surfil won't sit behind it.
The missing column you might expect
No competitor names, no “X% better than BrandY” - here's the reasoning, not just the rule.
Named-competitor tables need fixed numbers to look decisive, and fixed numbers about someone else's moving product are exactly the unmeasured claims our honest-claims policy forbids. Architecture classes don't change week to week; vendor feature lists do. So we compare against the class - and let your own measured receipt settle the rest.
Settle it with a receipt, not a table
One Core install. One week of your real traffic beats every row above - and uninstalling restores everything byte-for-byte if we lose.