CLI reference

The surfilCLI is the on-device runtime's control surface. Every command below exists in the shipped binary - run surfil helpto see the same list from the copy you have installed.

Setup & lifecycle

curl -fsSL https://surfil.com/install.sh | sh   install the binary (checks it against the signed manifest)
surfil login         link this device and connect your agents
surfil setup         wire installed agents without linking
surfil doctor        what is installed, what is connected, is the proxy up
surfil connect       manual steps for GUI editors
surfil update        replace this binary with the current published build
surfil uninstall     remove everything Surfil wrote, and unlink this device

Running

surfil service install|uninstall|status   run the relay at login
surfil intercept --cli [--port N]        run the relay here; uploads automatically
surfil mcp serve                         run the MCP aggregator

Your data

surfil report [--since D] [--session S]   what your agents cost, from the local record
surfil sync [--dry-run]                  upload recorded metadata to your dashboard
surfil receipt --sample                  emit an unsigned sample receipt
surfil receipt --paid --edge-url URL     spend a Credit; write the SIGNED receipt
surfil verify <file>                     verify a Weave document offline, no account
surfil audit [--root DIR]                day-0 static waste report
surfil export / import                   move your Weave data

Per-product commands

surfil mind remember <text>          store a fact your agents can reuse
surfil mind recall <query>          recall matching facts, freshest first
surfil mind check                   re-flag facts whose code changed as STALE
surfil mind list | stats            show stored facts / counts
surfil policy simulate --match k=v  replay a rule over your recorded events
surfil proof attest [--out FILE]    signed statement of this device's real state
surfil fleet                        registry + shadow-agent discovery
surfil charter bundle [--out FILE]  index signed evidence into a manifest
surfil bench                        rank the models you used, from measured traffic
surfil pilot ask "<question>"       answer from your own captured knowledge

Conventions

No API key ever lives in a dotfile - authentication is the Ed25519 device token from surfil login, held in the OS keychain. Commands that produce a value-output (audit, bench, receipt) end in a signed artifact you can verify.