Scanner commands
Every command of the surface binary, with what it does.
The scanner binary is surface. Most commands need administrator rights: prefix them with sudo on macOS and Linux, and run them from an elevated PowerShell on Windows.
| Command | What it does |
|---|---|
surface init |
Full setup: create folders, enroll or sign in, install and start the service and the tray. Safe to run again |
surface status [--json] |
Version, service state, scan interval, server URL, signed-in user, organization |
surface scan --once |
Run one scan and report it, with output in the terminal. The quickest check that everything works |
surface scan |
Run continuously in the background. This is what the service runs |
surface logs [-f] [-n N] |
Show the last N log lines (default 50). -f keeps following |
surface logs --extension <slug> |
Logs for one prompt collector |
surface update [--check] |
Check for, or download and apply, a scanner update |
surface unenroll |
Remove this laptop from the organization and delete its credentials |
surface logout |
Sign out a laptop that was enrolled with a browser sign-in |
surface tray |
Run the menu bar or system tray indicator, as the signed-in user |
surface extension install <slug> |
Install a prompt collector such as claude, codex, or chrome |
surface extension list |
Show installed prompt collectors |
surface extension uninstall <slug> |
Remove a prompt collector |
surface --version |
Print version, commit, and build date |
surface init flags
| Flag | Use it when |
|---|---|
--yes |
You want no prompts |
--skip-login |
The token will arrive later from MDM |
--no-service |
You only want to enroll, not install the service |
Three ways to leave
| Command | Use it when |
|---|---|
surface unenroll |
The laptop was enrolled through MDM and you want it out of the organization |
surface logout |
The laptop was enrolled with a browser sign-in and you want to sign out |
| Uninstall | You want the scanner off the laptop entirely. It unenrolls first. See Update and uninstall |