Connect Windsurf
Register Poliogo once in Windsurf and ask your agent to check compliance as you build.
npx poliogo-mcp initRun this in your project, then ask your agent to check your compliance. MCP access is included from the Starter plan.
How the connection works
- Run one commandnpx poliogo-mcp init registers the server in your editor, once per project.
- Ask your agentIt calls check_compliance and scans the workspace locally.
- Detection on demandRe-ask any time — or wire the same tools into CI as subcommands.
What it looks like once connected
An illustration of this connection inside your Poliogo dashboard — not live data.
Detected in this project
- Next.jsnext in package.json
- Pineconesrc/lib/vectors.ts
- OpenAIfetch to api.openai.com
- ResendRESEND_API_KEY in .env.example
Exact permissions requested
Every permission this connection asks for, named as Windsurf names it on its own consent screen — so you can compare this table to what you are shown.
| Permission | Grant | What it is used for |
|---|---|---|
| No account grant | Not requested | There is no OAuth step. The MCP server runs on your machine under your own user. |
| Workspace files | Read | Read locally, in the folder you ran the scan in. Nothing is uploaded. |
| Writing documents | Write | Only when you ask the agent to. generate_docs and install_pages write into your project, and you review the diff. |
Setting it up
What you do, and what you will be looking at while you do it.
Run the command in your project
It adds the Poliogo MCP server to Windsurf's configuration. One command, once per project, and no account grant of any kind.
Reload Windsurf
MCP servers are read at startup, so reload the window before asking the agent to use it.
Ask as you build
Your agent can call scan_stack or check_compliance at any point, so a new integration gets flagged while you are still in the file that added it — rather than during an audit months later.
Let it write the documents
generate_docs and install_pages write your policies and their routes into the project, as real pages in your framework rather than an embedded iframe.
Keep the rules block current
inject_rules refreshes the fenced compliance block in your agent rule files, so the instructions your agent follows stay in step with what your product actually does.
Choose how to scan your app
Pick one. We scan your code and settings to find the services your app uses — the scan keeps that list, not your files.
Generate your licence key
MCP Server Access
The licence key the poliogo-mcp package uses in Cursor, Windsurf and Claude Code. Included from Starter.
Copy it now — it is never shown again.
poliogo_••••••••••••••••••••••••Set it as POLIOGO_API_KEY in the environment your editor launches npx poliogo-mcp with.
Paste this into Windsurf
npx poliogo-mcp initCopyYour agent runs it and writes the server into ~/.codeium/windsurf/mcp_config.json — nothing else in that file is touched.
{
"mcpServers": {
"poliogo": {
"command": "npx",
"args": [
"-y",
"poliogo-mcp"
]
}
}
}Ask your editor to scan
What Poliogo detects from Windsurf
The right-hand column is the part worth reading: it is what this connection cannot reach even if we wanted it to.
What it reads
- The workspace open in your editor, scanned on your own machine.
- Manifests and source text, exactly as a repository scan reads them.
- Drift against the last snapshot your documents were generated from.
What it never reads
- Your source code. It never leaves the machine — only the list of detected services is sent.
- Anything outside the workspace you ran the scan in.
- Any file, unless you ask the agent to write the documents.
Ready to connect Windsurf?
The free plan covers one project with no credit card. You approve everything before a single document is written.
Poliogo is a compliance management platform, not a law firm. What it produces is not legal advice. See exactly what each connection reads.