---
title: Scanner commands
sidebar:
  label: Commands
description: Every command of the surface binary, with what it does.
---

The scanner binary is `surface`. Most commands need administrator rights: prefix them with `sudo` on macOS and Linux, and run them from an elevated PowerShell on Windows.

| Command | What it does |
| --- | --- |
| `surface init` | Full setup: create folders, enroll or sign in, install and start the service and the tray. Safe to run again |
| `surface status [--json]` | Version, service state, scan interval, server URL, signed-in user, organization |
| `surface scan --once` | Run one scan and report it, with output in the terminal. The quickest check that everything works |
| `surface scan` | Run continuously in the background. This is what the service runs |
| `surface logs [-f] [-n N]` | Show the last N log lines (default 50). `-f` keeps following |
| `surface logs --extension <slug>` | Logs for one prompt collector |
| `surface update [--check]` | Check for, or download and apply, a scanner update |
| `surface unenroll` | Remove this laptop from the organization and delete its credentials |
| `surface logout` | Sign out a laptop that was enrolled with a browser sign-in |
| `surface tray` | Run the menu bar or system tray indicator, as the signed-in user |
| `surface extension install <slug>` | Install a prompt collector such as `claude`, `codex`, or `chrome` |
| `surface extension list` | Show installed prompt collectors |
| `surface extension uninstall <slug>` | Remove a prompt collector |
| `surface --version` | Print version, commit, and build date |

## `surface init` flags

| Flag | Use it when |
| --- | --- |
| `--yes` | You want no prompts |
| `--skip-login` | The token will arrive later from MDM |
| `--no-service` | You only want to enroll, not install the service |

## Three ways to leave

| Command | Use it when |
| --- | --- |
| `surface unenroll` | The laptop was enrolled through MDM and you want it out of the organization |
| `surface logout` | The laptop was enrolled with a browser sign-in and you want to sign out |
| Uninstall | You want the scanner off the laptop entirely. It unenrolls first. See [Update and uninstall](/surface/scanner/update-and-uninstall) |