Skip to content

Surfing Dog Search

by surfingdog.ai · remote · no sign-in to list tools · v1.0.0 · published by ai.surfingdog

Find businesses an AI agent can message, book or buy from, and check what an agent can do on a site.

Deletes · 1Final · 1Changes · 7

14 tools: 1 can delete or cancel things, 1 do something that can't be undone, 7 change things and 5 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http search https://surfingdog.ai/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "start_inbox" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "start_inbox" says "start": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

14 tools

Deletes or cancels 1Claude Code: deny
  • update_businessFor a business's own AI: correct its listing (set any field register_business takes), add or remove doors, turn the listing off or on, or hide its agentic score result (score_page)…No findings

    Why it is in this group

    • The name "update_business" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    For a business's own AI: correct its listing (set any field register_business takes), add or remove doors, turn the listing off or on, or hide its agentic score result (score_page), with its claim_token or a proof as register_business asks. opt_out stops this network listing the site (list), reading it (crawl), or both (all). With no proof it removes only a listing nobody claimed; a claimed or registered listing is taken out only with its claim_token or a proof as strong as its claim.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
    • title: Change a business's listing
Can't be undone 1Claude Code: ask
  • ask_businessSends your person's question to a business's own inbox, as a message.No findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    Description, as the server wrote it
    Sends your person's question to a business's own inbox, as a message. Only for a business in this directory with its own inbox (its listing names one), and only when your person asked you to contact it. The business can answer your person by email, at the address they agreed to give it; never a phone number. This network carries the request and keeps only a record that it was delivered. The answer is the inbox's: the business's own words, and an access token to read the request's state.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
    • title: Ask a business
Changes things 7Claude Code: ask
  • check_businessChecks what an AI agent can do with a business's website: message, book, order, sign up, pay, change or cancel.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Checks what an AI agent can do with a business's website: message, book, order, sign up, pay, change or cancel. Waits up to 25 seconds; if the read isn't finished, returns what it found so far, and you call it again for the score. A result read in the last hour is answered as it is; after a business changes its site, set fresh to true to read it again (allowed a few minutes after the last read). A done result also carries door_history: what this network's own reads found of the site's doors, kept for good: when each was seen answering and on how many days, and for a door read every day (a member's, a claimed listing's), from 14 days checked, the share of days every check answered, as a count and a share ("answered 41 of 42 days (97%)"): a day with a failed or a refused check counts as a missed day, and a refused one is shown as refused. Use it when a person asks how agent-ready a business is, or wants to improve their own. To find businesses, use search_businesses instead. A setup link in the answer is for the owner to fill in themselves. Capability ids are defined at https://surfingdog.ai/spec/capabilities/.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
    • title: Check a business's website
  • check_dnsChecks whether AI agents are led from the business's website and DNS to its agent inbox, and whether the inbox answers at inbox.<domain> (or the host given): for a business's own A…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Checks whether AI agents are led from the business's website and DNS to its agent inbox, and whether the inbox answers at inbox.<domain> (or the host given): for a business's own AI. Reads the inbox's DNS record (against target, when given) and manifest, the site's robots.txt (no AI assistant kept out), and five ways the domain can point to the inbox: four on the website (/.well-known/agent-inbox.json, a line in llms.txt, <link rel="agent-inbox">, a schema.org potentialAction) and a _agent-inbox TXT record. ready needs one of the four on the website. Every item not in place comes with the exact record, line or file to add (fix_lines: the text to paste). Reads the site as a browser would, and nothing it asked crawlers not to read; what it read is kept for a minute.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Check an inbox's DNS and discovery
  • register_businessFor a business's own AI: put the business in this directory with its doors (MCP, A2A, OpenAPI, an API, UCP, ACP, a platform's door) and its facts: name, what it is (a category of l…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    For a business's own AI: put the business in this directory with its doors (MCP, A2A, OpenAPI, an API, UCP, ACP, a platform's door) and its facts: name, what it is (a category of list_categories or a place category, and one line), where (a storefront, a service area, or online with the countries it ships to), its languages, and agree. One call when its proof is already in place; otherwise the answer gives a challenge to put on its domain (a well-known file, its inbox manifest, a DNS record), a key's signature, or a code sent to an address at its domain, and the next call proves it. The answer names every part not taken and why, its readiness level, and what the next level takes. Doors count once this network's crawler has checked them; a door on another host counts only when the site leads to it or its own document names the business's domain. Mail, phone, messaging, forms and web pages are never doors. Every kind of business is listed except adult services, gambling, weapons, tobacco, cannabis and vaping, payday loans and bail bonds. agree accepts the listing terms (/bot#terms). Being listed is free, and nothing about the order can be bought.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
    • title: Put a business in the directory
  • report_doorRecords how a business's door went (its inbox, MCP, A2A or API) when you used one: it answered (ok), refused (slot_taken, out_of_stock…), the request was your own fault (invalid), …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Records how a business's door went (its inbox, MCP, A2A or API) when you used one: it answered (ok), refused (slot_taken, out_of_stock…), the request was your own fault (invalid), it failed (could not connect, a server or tool error), or it needs a person (info); up to 100 uses in one call. A report is private to the business and may make this network check a door that agents say is down (at most twice a day per door, for the doors it reads itself); it changes nothing public by itself, and carries no person and nothing that was said. Reports signed with your own key or your platform's, about businesses your own signed searches here returned, earn a larger reading allowance (this network's /report.md).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
    • title: Report how a door went
  • request_bookingWithout start: the business's free times for one of its services, read from its own inbox; nothing is sent.No findings

    Why it is in this group

    • The name "request_booking" says "request": a word for a change.
    Description, as the server wrote it
    Without start: the business's free times for one of its services, read from its own inbox; nothing is sent. With start: asks the business's own inbox to book that time for your person. A priced service first answers with its terms (confirm): show them to your person, and send terms_sha only after their yes. Only for a business in this directory with its own inbox (its listing names one), and only when your person asked you to contact it. The business can answer your person by email, at the address they agreed to give it; never a phone number. This network carries the request and keeps only a record that it was delivered.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
    • title: Request a booking
  • request_quoteAsks a business for a price, in its own inbox, for something your person describes.No findings

    Why it is in this group

    • The name "request_quote" says "request": a word for a change.
    Description, as the server wrote it
    Asks a business for a price, in its own inbox, for something your person describes. Only for a business in this directory with its own inbox (its listing names one), and only when your person asked you to contact it. The business can answer your person by email, at the address they agreed to give it; never a phone number. This network carries the request and keeps only a record that it was delivered. The answer is the inbox's: the business's own words, and an access token to read the request and its quote.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
    • title: Ask a business for a quote
  • start_inboxFor a business's own AI: the link where the business's owner sets up their own agent inbox, hosted by Surfing Dog, at inbox.<domain>.1 finding

    Why it is in this group

    • The name "start_inbox" says "start": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "start_inbox" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "start_inbox" says "start": a word for a change.

      What this check looks for
    Description, as the server wrote it
    For a business's own AI: the link where the business's owner sets up their own agent inbox, hosted by Surfing Dog, at inbox.<domain>. Give the owner the link; they check the details and type their own email there. This tool never signs anyone up and takes no email. It says so when the business already runs an inbox, or when one cannot be hosted for the domain (an address at a hosting platform, where no DNS record can be added). The open-source inbox, to run on the business's own servers instead, is always named. After the owner adds the DNS record, check_dns says whether agents can reach the inbox.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Set up an agent inbox
Only reads 5Claude Code: allow
  • get_businessOne business's full listing, by its domain: its address (a town and country for one this network found), the week's opening hours and closures, its doors and what each takes, its s…No findings

    Why it is in this group

    • The name "get_business" says "get": a word for reading.
    Description, as the server wrote it
    One business's full listing, by its domain: its address (a town and country for one this network found), the week's opening hours and closures, its doors and what each takes, its services, its standing in words, a member's track record (promises kept, broken and still open, and when, once enough have closed; self_reported when it rests on the business's own word, with no score and no count of customers), and how many of its promises closed with each outcome; for one that is not a member, every fact with its source and date; and its doors' history from this network's own reads: when each was first and last seen answering, and on how many days, and for a door read every day (a member's, a claimed listing's), from 14 days checked, the share of days every check answered, as a count and a share ("answered 41 of 42 days (97%)"): a day with a failed or a refused check counts as a missed day, and a refused one is shown as refused. This server takes no orders or payments; the listing names the business's own doors, and request_booking can ask its inbox for a time. Its agentic score, if checked, is at https://surfingdog.ai/b/<domain>. Capability ids are defined at https://surfingdog.ai/spec/capabilities/.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: One business
  • get_censusMonthly counts of what AI agents can do at the websites this network checked: how many an agent can message, book, order from or pay, through which doors, by country, kind of busin…No findings

    Why it is in this group

    • The name "get_census" says "get": a word for reading.
    Description, as the server wrote it
    Monthly counts of what AI agents can do at the websites this network checked: how many an agent can message, book, order from or pay, through which doors, by country, kind of business (group), website platform, where the sites came from (source) or city. Counts only; no business is named. Without edition, the latest published one; without scope, the whole; with a scope and no key, each key's headline counts; with a key, all of its counts. Open data under CC BY 4.0: credit "Surfing Dog census, surfingdog.ai, CC BY 4.0", and "© Overture Maps Foundation" with city counts. Capability ids are defined at https://surfingdog.ai/spec/capabilities/.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: The census
  • list_attributesThe attributes a search may ask for (delivery, walk_ins, wifi…), each with its labels, and the payments accepts takes.No findings

    Why it is in this group

    • The name "list_attributes" says "list": a word for reading.
    Description, as the server wrote it
    The attributes a search may ask for (delivery, walk_ins, wifi…), each with its labels, and the payments accepts takes. Pass keys as attributes to search_businesses, and payments as accepts.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Attributes
  • list_categoriesThe categories list: every slug with its English and Portuguese labels and its kind (local_and_retail, or software_and_ai for software, API and AI companies, kept apart).No findings

    Why it is in this group

    • The name "list_categories" says "list": a word for reading.
    Description, as the server wrote it
    The categories list: every slug with its English and Portuguese labels and its kind (local_and_retail, or software_and_ai for software, API and AI companies, kept apart). Pass a slug as category to search_businesses.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Categories
  • search_businessesFind businesses in the directory by what they do (query, category: a group or a place category), where (near, country), the language they speak, whether they are open now, their at…No findings

    Why it is in this group

    • The name "search_businesses" says "search": a word for reading.
    Description, as the server wrote it
    Find businesses in the directory by what they do (query, category: a group or a place category), where (near, country), the language they speak, whether they are open now, their attributes (list_attributes), price band, what their doors take and how they are paid (accepts: kinds, and ways to pay such as card, apple_pay, paypal or x402; each result's accepts.pay_with says whether the business declared each or it was only seen, on its site or in its shop platform's standard profile, and where), whether a door answers asks or quotes (requestable), the type of door, their readiness level, whether they have an inbox, and whether they are members, registered or found. Results come in the directory's published order, which nobody can pay to change; every filter only leaves businesses out. This server takes no orders or payments and books nothing itself: request_booking asks a business's own inbox for a time, and the business confirms it there. Each result lists the business's own doors. A business this network found on its own website is marked as found, with the date it was checked; a local one is listed once its site is matched to its entry on public maps or in a business register, or its owner proves the site is theirs. Software, API and AI companies (category software-ai) are kept apart: they come only when category names that group or one of its categories, query names their kind, or every word of query is in one's name. Pages of up to 20; pass next_cursor as cursor for more.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Find businesses

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http search https://surfingdog.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__search__search_businesses",
      "mcp__search__get_business",
      "mcp__search__list_categories",
      "mcp__search__list_attributes",
      "mcp__search__get_census"
    ],
    "ask": [
      "mcp__search__check_business",
      "mcp__search__report_door",
      "mcp__search__ask_business",
      "mcp__search__request_quote",
      "mcp__search__request_booking",
      "mcp__search__register_business",
      "mcp__search__start_inbox",
      "mcp__search__check_dns"
    ],
    "deny": [
      "mcp__search__update_business"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as search. Review it before you use it.