Surfer

The working surface is the Content Editor: a document Surfer builds around a target keyword, carrying terms and structure targets drawn from the pages currently ranking for it, plus a score that grades the draft against them. Around that sit keyword research, a SERP analyzer, an audit, a plagiarism check, an AI detector and a humanizer, an outline and brief generator, and AI article generation. Auto-Optimize is the part that acts on its own: the capability docs say it rewrites the document directly, with no review step.

The second half of the product is AI Tracker, which reports whether ChatGPT, Gemini, Perplexity and Google AI Overviews mention a brand, which sources they cite, and how that moves over time. Plans differ in how many prompts are tracked and how often they refresh: 25 prompts weekly on Standard, 50 daily on Pro, 100 daily on Peace of Mind, according to the plan cards. The AI Search Analytics plan buys the tracker without the writing allowances.

Five published tiers, priced per month: Discovery, AI Search Analytics, Standard, Pro and Peace of Mind. The pricing page opens with the billing toggle set to yearly, so the first figures a visitor reads are the annual-equivalent rates of 49, 82, 99, 182 and 299 EUR (about $335). Switching the toggle off gives the month-to-month rates: 59, 95, 119, 219 and 359 EUR (about $402). Enterprise is quoted, described as "Tailored packages".

The discount is stated as a range rather than a fixed figure. The pricing FAQ says choosing the annual plan "gives you a discount of up to 17% in comparison to the monthly payments", and annual plans are charged for the entire year upfront, with credits resetting yearly instead of monthly. Payment is by card for both terms and by bank transfer for yearly subscriptions only, processed through Stripe.

Peace of Mind advertises "Create or Optimize Unlimited* Documents", and the asterisk leads to the Fair Usage Policy, which sets that plan at 500 documents a month or 6,000 a year. The same page caps one-click optimization, auto internal linking, keyword research, topical maps and the SERP analyzer at 100 a day each, Humanizer at 50,000 words a month, brands and domains at 100, and tracked pages at 100,000. Reaching the document ceiling early is handled by asking a Customer Success Manager for a one-time reset.

Credit accounting is worth reading before any bulk run. Creating a Content Editor spends a credit, Auto-Optimize draws on its own allowance, and no API or MCP call reports the remaining balance. A second Auto-Optimize run on the same editor charges again and cancels the first, which is not refunded, and deleting a Content Editor does not return its credit.

The hosted MCP server lives at mcp.surferseo.com, speaks Streamable HTTP with OAuth 2.1, and is documented for Claude, Claude Code, ChatGPT web and desktop, Codex, Cursor and VS Code. Over it an assistant can create and read Content Editors, adjust guidelines, generate articles, run Auto-Optimize, read Search Console performance, and read AI Tracker reports. It is included in the Pro, Peace of Mind, Enterprise, and AI Search Analytics plans, which leaves Discovery and Standard out.

The REST API is a separate gate. v2 covers Content Editors, AI articles, Auto-Optimize, guidelines, templates and voices, with webhooks and idempotent creates, but access is limited to Peace of Mind, Enterprise and an API add-on, the key is issued by support rather than self-generated, and there is no sandbox: every call runs against the live account and spends real credits.

The permission model is thin on Surfer's side. A connected client receives the whole tool catalog from its first call, acts as the user who authorized it, and Surfer offers no organization-level switch to allow or deny MCP, no list of connected clients and no revoke button. Confirmation prompts live in the AI client, and the same page warns that imported pages and competitor content can carry prompt injection.

The operator is Surfer sp. z o.o. of Pl. Solny 14/3, Wroclaw, Poland, registered under KRS 0000752993, as stated in both the privacy policy and the Regulations. The customer clause doubles as a data processing agreement accepted by use, with a named subprocessor list that gives a processing location for each entry: Google Cloud as EU or United States, Cloudflare as global, Stripe for billing, HubSpot for CRM. Entrusted data is deleted or returned within 30 days of the contract ending or a written deletion request, a window the policy ties to backup retention, and customers are given an audit right exercisable on seven days' notice during stated business hours at their own cost.

What is named for security is GDPR compliance, encryption in transit and at rest, real-time monitoring, and internal and external security audits with penetration tests, all on the Enterprise page. No SOC 2 report, ISO certificate or trust center is published, and no uptime commitment appears beyond 24/5 support and priority support for Enterprise. Whether customer documents are kept out of model training is not addressed on any page read, which for a tool whose core job is writing text is the gap a buyer is most likely to ask about.

It suits a team that publishes continuously and wants brief, draft, score, optimization and AI-citation tracking in one place, writing in WordPress, Google Docs or Contentful rather than in yet another editor. Agencies get brand spaces, with five on Pro and the Peace of Mind tier topping out at 100 brands and domains under fair usage.

It fits badly in three cases. A buyer who wants programmatic access on a cheap plan cannot have it, because the API starts at Peace of Mind and MCP starts at Pro. A buyer who wants to try before committing gets a 7-day trial that takes a card and converts by itself, not a free tier. And a buyer whose procurement needs a SOC 2 report, an uptime SLA or a written no-training commitment will have to ask for all three, since none is published.