The system-of-record your AI agents write to.
Grounded, defensible, and shared across every project. Your agents log what they built and why — with sources you can defend to a client weeks later. Built for operators running real work with AI, not demos.
Provenance ledger
Three weeks later, someone questions a number — and a new agent traces it back to the source.
You finish the work and move on. Weeks pass and the context is gone — then a teammate or client asks, “wait, where did this number come from?” Instead of digging through old chats, a fresh agent opens the project, reads the record, and traces that exact figure to its source: the commit, the data, and the decision behind it. No re-explaining, no archaeology.
Cold start, fully grounded. The agent connects with no prior memory and immediately has the whole project's record.
| Decision | Apply banker’s rounding (half-to-even) to every line item |
| Why | Client call, May 30 — match Acme’s books for the audit |
| By | cursor · 15:40, May 30 |
The chain, not just the diff. A line from a call → the decision it drove → the commit that shipped it. Git keeps the last link; ctlsurf keeps all three.
Weeks later, the number is challenged. Without a record, this is a scramble. With ctlsurf, it's a lookup.
| Source | Before | After | Δ |
|---|---|---|---|
| Raw line items #1283 | $48,210.00 | $48,210.00 | $0.00 |
| Banker's rounding adr-014 | $48,210.00 | $48,209.96 | −$0.04 |
| Reconciled total 7d20be1 | — | $48,209.96 | verified |
7d20be1. Reply drafted with all three sources.Defended, not guessed. The agent cites the commit, the datastore row, and the client call — and drafts the reply.
Agents ship work you can't defend later
The artifacts that should hold the truth either don't hold it, or are gone by next week.
CLAUDE.md is read-only
Your instructions go in; nothing comes back out. The agent can't record what it actually measured, decided, or chose to skip.
Chats evaporate
The reasoning, the denominators, the “as-of” context — it lived in a chat window that's now closed. Next session starts from zero.
PR diffs hide the truth
A diff shows what changed in code — never what was assumed, what was tried and failed, or what got quietly simplified to ship.
“Memory” is given away free
Vendor memory recalls vibes from past chats. Notion deliberately cripples agent writes. Neither gives you a dated, sourced record you can defend.
Read → work → write it down, grounded
One loop, agent-agnostic, over MCP. The record is a first-class part of the workflow, not an afterthought.
The agent reads the record
On session start it pulls the project's pages, datastores, decisions, and prior corrections — instantly grounded in everything that came before.
It does the work
Builds, measures, migrates, reconciles — in your codebase with your tools. ctlsurf doesn't change how it works; it captures what it produces.
It writes it down, grounded
Findings with denominators, numbers with an as-of date and a source, decisions with rationale, commits with SHAs — appended to a record that's kept forever.
Every write carries its own evidence
This is what “defensible” looks like in the product — not a buzzword, a data model.
| Item | Before | After |
|---|---|---|
| Raw line items | $48,210.00 | $48,210.00 |
| Rounding adj. (ADR-014) | $0.00 | −$0.04 |
| Reconciled total | $48,210.00 | $48,209.96 |
1,284 invoices migrated; total reconciled to $48,209.96 against the source ledger.
Banker's rounding applied per ADR-014; USD only.
Bulk Stripe update hit rate limits at 800 rows; fell back to 100-row batches.
EU tax recompute deferred — out of scope this pass. The agent logged what it skipped, on the record.
| id int | invoice text | amount money | status enum |
|---|---|---|---|
| 1281 | ACME-0419 | $3,120.00 | reconciled |
| 1282 | ACME-0420 | $8,940.00 | reconciled |
| 1283 | ACME-0421 | $48,209.96 | in audit |
The neutral record — by design
The combination is the moat: agent-writable, MCP-native, provenance on every write, neutral across vendors and content, scoped across all your projects and clients.
Agents don't just read context — they author the record. Pages, datastores, decisions, completions, all written through MCP.
Claude Code today, Cursor tomorrow, Codex next quarter — the same record. Switch agents without losing your history.
Sources, denominators, and as-of dates aren't a feature you remember to add — they're part of every write, scoped per project and client.
The fastest way to give any coding agent a memory and a paper trail
You don't need client audits to feel this. Point your agent at ctlsurf and its work compounds across sessions instead of evaporating — next time it picks up exactly where it left off.
- Persistent memory — decisions, gotchas, and TODOs survive between sessions and machines.
- A real paper trail — what was tried, what failed, what got simplified, captured automatically.
- One setup, every project — pages, tables, trees, diagrams, datastores, all in one place.
- Two-minute install — add the MCP server and you're writing to the record on the next prompt.
{
"mcpServers": {
"ctlsurf": {
"type": "http",
"url": "https://app.ctlsurf.com/mcp",
"headers": {
"Authorization": "Bearer $CTLSURF_KEY"
}
}
}
}
Works the same in Claude Code, Cursor, Windsurf, VS Code & any MCP client.
Turn a good run into a repeatable playbook
Encode a workflow once — inputs, ordered steps, and guardrails — then attach it to any task. Personal, project, or public; forkable from a shared marketplace.
Guardrails travel with the skill, so the same safety rules apply every time an agent runs it — and the run is recorded like everything else.
required · file or datastore
log rows checked / rows total
before → after, penny-exact
enforced on every run
Your data is yours.
Built for people running real work for real clients.
- No one else can see your work. No other user — or their agents — can read or touch your projects.
- Share one project, not your portfolio. Invite a client to a project and they see only that one — never your other engagements.
- Encrypted in transit. Every connection is HTTPS, and you can delete a project — and its record — anytime.
- Never used to train models. Your work, and your clients' data, are never used to train anything.
Start free. Upgrade when it's load-bearing.
Every plan includes full MCP access and the complete tool set. No credit card to start.
Free
- 5 projects
- 100 requests / min
- 500 MB storage
- 10 project skills
- MCP access
Pro
- 20 projects
- 100 requests / min
- 10 GB storage
- 100 project skills
- Block version history
Super admins bypass all limits. Stripe is optional — the system works without it.
The record, in plain terms
CLAUDE.md is read-only and chats evaporate. ctlsurf is agent-writable and persistent: the agent records what it built, measured, decided, and skipped — on the record — so the next session starts grounded instead of from zero. Work compounds instead of evaporating.Give your agents a record
you can defend.
Two minutes to connect. The next prompt writes to a grounded, sourced, version-kept system-of-record — across every project.