What Surge Sends

A publish sends your project and the details the platform needs to put it online. This page lists all of it, so you can check it against the source and against your own network traffic.

With every publish

  • Your project's files, packed as a gzipped tarball under the project folder's name. For projects over 1 MB, files the domain already has are left out.
  • Your credential: the token from surge login, SURGE_TOKEN, or --token.
  • The domain you're publishing to.
  • The file count and total size of the project.
  • The arguments you passed, as you typed them, so the platform can act on flags like --preview, -m and --private. A project path typed in full, like /Users/you/site/dist, travels as typed.
  • The CLI's version, its command name (surge, or the tool embedding it), and the time the publish started.
  • A User-Agent saying how the CLI was called (below).

Like any request, a publish also reaches us from your IP address.

The User-Agent

surge/0.54.0 (auth=env; ci=0; tty=0; via=npx; agent=claude-code)
Field Values Meaning
auth netrc, env, flag Where the credential came from: the saved login, SURGE_TOKEN, or --token
ci 0, 1 Whether the CI environment variable is set
tty 0, 1 Whether a terminal is attached
via npx, installed Whether the CLI ran through npx or from an installed copy
agent a name, or absent The AI agent running the CLI, when it identifies itself

agent comes from the AI_AGENT environment variable (only the name before any _, / or @, so claude-code_2-1-300_agent is sent as claude-code). Without it, the CLI looks for a few variables agents set in the shells they run: CLAUDECODE, CURSOR_AGENT, GEMINI_CLI, CODEX_SANDBOX, REPL_ID and E2B_SANDBOX. It checks whether they're set, and never sends what they contain.

We use it to see how Surge is used—by people at a terminal, by CI, and by agents—so we can make each of them work well.

Never sent

  • The value of any environment variable
  • Your hostname or operating system
  • Any file outside the project you're publishing
  • Anything about other software on your machine, beyond the agent name above

The User-Agent's fields are names and 0/1 only. A change to what the CLI sends will be listed in the release notes and on this page.

See the Privacy Policy for how Surge handles what it receives.

This page as markdown · every page in llms-full.txt