# Rocky Surf

> An open-source CLI tool for software engineers to create and manage Linux VMs on their own cloud accounts, pre-installed with AI coding agent harnesses and GitHub repos.

Rocky Surf is an open-source productivity tool built by John Damask for software engineers who want to run AI coding agents on dedicated cloud VMs rather than their local machines. It installs via `npx -y rockysurf`, runs as a local Node.js web app and optional MCP server, and connects to your existing cloud accounts on AWS, GCP, Azure, or Hetzner. The project is MIT-licensed and currently at v0.1.4.

## What It Is

Rocky Surf sits between your laptop and your cloud provider, giving you a lightweight management layer for spinning up Linux VMs purpose-built for agentic coding. Instead of running Claude Code, Codex CLI, Cursor, or other AI coding agents on your personal machine — competing for CPU, memory, and potentially exposing credentials — Rocky Surf provisions isolated cloud boxes with those agents pre-installed. The tool follows a "Bring Your Own Everything" philosophy: your cloud account, your API keys and agent licenses, your GitHub repos.

## How the Surge Pack System Works

The core abstraction for agent installation is the **Surge Pack** — a software bundle that defines which coding agents and tools get pre-installed on a VM. Rocky Surf ships eleven official packs out of the box:

- Claude Code
- Codex CLI
- Cursor CLI
- Amp
- Grok Build
- DeepSeek Harness
- opencode
- OpenClaw
- OMP
- Pi
- Gas Town

Developers can write their own Surge Packs using agent skills from the Rocky Surf repository, and the **Rocky Surf Shop** serves as a community registry where custom packs and cloud Providers can be published and installed after script review.

## Deployment Model and Architecture

Rocky Surf runs entirely on your local machine — no SaaS, no telemetry, no external service. The web app listens on `127.0.0.1:3000` by default. Cloud credentials are never stored by Rocky Surf; each cloud authenticates through its own standard path (AWS credential chain, `az login`, `gcloud auth`, or a Hetzner API token in an environment variable). VM state is tracked in a local SQLite database at `~/.rockysurf`.

The optional MCP server surface lets local coding agents manage cloud boxes directly without the GUI. Granular MCP permission scopes (`read`, `stop`, `start`, `create`, `terminate`) are configurable, and server-count, create-rate, and monthly spend caps are enforced server-side so they apply equally to the web app, CLI, and MCP.

## Security Approach

The homepage describes the primary security benefit as isolation: agents running on their own VMs minimize the blast radius of anything going wrong. Additional controls include:

- No credential storage — keys, passwords, and secrets are never retained by Rocky Surf
- Security groups and firewall rules on AWS, Azure, and GCP that open only TCP port 22 inbound
- Optional CIDR restrictions on which networks can reach SSH on provisioned servers
- MCP scopes that suppress tools entirely when a permission is not granted

## Update: v0.1.4

The GitHub repository shows the latest release as **v0.1.4**, published on September 10, 2026, with the repository created in August 2026. The project is in early active development (39 open issues, TypeScript primary language) and is deliberately scoped: the README notes it does not support devcontainers, per-task sandboxes, Windows, or multi-tenancy. The Rocky Surf name and logo are trademarked separately from the MIT-licensed code.

## Features
- Create and manage Linux VMs on AWS, GCP, Azure, and Hetzner
- Pre-install AI coding agents via Surge Packs (Claude Code, Codex CLI, Cursor, Amp, and more)
- Local web app and MCP server running on your own machine
- Bring Your Own Cloud, Keys, and Repos (BYOC, BYOK, BYOR)
- SSH access with reusable or auto-generated keys
- GitHub repo auto-cloning on server creation (public and private)
- Community Surge Pack and Provider registry (Rocky Surf Shop)
- Configurable server count, create-rate, and monthly spend caps
- MCP permission scopes for agent-controlled VM management
- Agent Skills for writing custom Surge Packs and cloud Providers
- No credential storage — credentials stay in your environment
- Security group/firewall rules restricting inbound to TCP 22
- Single config file with Settings UI for all configuration

## Integrations
AWS, Google Cloud Platform (GCP), Microsoft Azure, Hetzner, Claude Code, Codex CLI, Cursor CLI, Amp, Grok Build, DeepSeek, opencode, OpenClaw, GitHub, MCP (Model Context Protocol)

## Platforms
WINDOWS, LINUX, WEB, API, CLI

## Pricing
Open Source

## Version
v0.1.4

## Links
- Website: https://www.rockysurf.com
- Documentation: https://github.com/amroja-biz/rockysurf
- Repository: https://github.com/amroja-biz/rockysurf
- EveryDev.ai: https://www.everydev.ai/tools/rocky-surf