# GrowSurf MCP server

> The GrowSurf MCP server lets an AI assistant run a referral or affiliate program through the Model Context Protocol, hosted at mcp.growsurf.com with OAuth or locally over stdio.

- URL: https://growsurf.com/developers/mcp/

---

Give an AI assistant a way to run a referral or affiliate program over the Model Context Protocol. It is an interface over the [GrowSurf REST API](https://docs.growsurf.com/developer-tools/rest-api), not a separate product: anything it can do, the REST API can do. If your assistant can send HTTPS requests, you do not need MCP at all.

## Hosted server

Point a compatible MCP client at the hosted endpoint:

Server URL

```
https://mcp.growsurf.com
```

The client completes OAuth while you sign in to GrowSurf, pick a team, and approve the requested scopes. Your assistant never handles an API key. The connection acts only on the team you selected, and API-key rotation is deliberately not available through MCP.

### Discovery metadata

- [OAuth Protected Resource Metadata](https://mcp.growsurf.com/.well-known/oauth-protected-resource) — RFC 9728
- [OAuth Authorization Server Metadata](https://mcp.growsurf.com/.well-known/oauth-authorization-server) — RFC 8414

## Local server and CLI

The same tools run locally over stdio from the official npm package, which also provides the GrowSurf CLI:

Local server and CLI

```
npx -y @growsurfteam/growsurf-mcp
```

Set `GROWSURF_API_KEY` in the client configuration. Optionally set `GROWSURF_CAMPAIGN_ID` to default program-scoped tools to one program; it is not a credential, and an explicit `campaignId` argument overrides it.

Read the [CLI guide](/developers/cli.md) for commands, or the [growsurf-mcp source on GitHub](https://github.com/growsurf/growsurf-mcp).

## No account yet

An assistant whose user has no GrowSurf account can connect with no credentials and call `growsurf_create_account`:

Onboarding endpoint

```
https://mcp.growsurf.com/onboard
```

The account owner then verifies their email address before the key unlocks.

## Public read-only endpoint

GrowSurf also publishes a credential-free Streamable HTTP endpoint for public resources at [growsurf.com/.well-known/mcp](/.well-known/mcp/), described by its [MCP server card](/.well-known/mcp/server-card.json). Use it to read GrowSurf's first-party agent and developer index without signing in.

## Before you connect

A credential proves permission, not intent. Confirm with the account owner before anything destructive or irreversible.

### Ask the owner first

- Deleting participants
- Deleting rewards
- Refunding a sale
- Fulfilling a reward

Keep a new program in `DRAFT` until the owner approves launch.

See [auth.md](/auth.md) for the full credential-handling rules, and [Build with AI](/build-with-ai/) for the customer-facing overview.