GrowSurf REST API and hosted MCP

GrowSurf is automatable today through the REST API at https://api.growsurf.com/v2 and a GrowSurf-hosted MCP server. REST requests send an API key as Authorization Bearer. Scoped keys can read and write programs, participants, rewards, analytics, and webhooks. Referral-program API access requires a paid subscription, and affiliate programs require a payment method on file. New programs start as drafts. Reward fulfillment and API-key rotation are separate scopes. Official API libraries are documented for TypeScript, Python, PHP, Ruby, and Java. The hosted MCP uses https://mcp.growsurf.com for GrowSurf sign-in, or https://mcp.growsurf.com/mcp with a bearer API key. A local server is published as npx @growsurfteam/growsurf-mcp. Approved MCP access can read and update programs and participants and can approve rewards, and the docs say it does not request key rotation, program deletion, or reward fulfillment. GrowSurf documents Zapier and Make for reward and data sync. Power Automate and n8n listings were not opened. Computer-use viability is unassessed. API and MCP both score 7. API is the best path because it includes fulfillment and key rotation, which the MCP scopes exclude, and a server-side key does not need an interactive consent screen.

Best path today: api · Overall automatability: 7/10