How do I add a remote MCP server to Windsurf?

To add a remote MCP server to Windsurf, add an entry with the server's URL under mcpServers in the MCP config file of the agent you use, save the file, and sign in if the server uses OAuth. Windsurf's MCP docs page, docs.windsurf.com/windsurf/cascade/mcp, now opens the Devin Desktop docs. They say the mcp_config.json setup there applies to the legacy Cascade agent only, and that the Devin Local agent, the default agent for new tabs, configures MCP servers in the Devin CLI config files instead.

The examples below add the Wireflow server, https://www.wireflow.ai/api/mcp, so your agent can build, inspect and run your workflows and generate and edit media across 100+ models. Wireflow signs you in with OAuth, so there is no API key or header to add.

Using another agent? The same URL and sign-in work there too. See Cursor setup, GitHub Copilot setup or the guide to connecting your AI agent.

Where is the MCP config file in Windsurf now?

It depends on the agent: the default Devin Local agent uses the Devin CLI config files, and the legacy Cascade agent uses mcp_config.json, which is at ~/.config/devin/mcp_config.json on macOS and Linux.

Agent	File	Scope
Devin Local	`~/.config/devin/mcp_config.json`, or `%APPDATA%\devin\mcp_config.json` on Windows	All your projects
Devin Local	`.devin/mcp_config.json` in a project	That project, shared with your team through version control
Devin Local	`.devin/mcp_config.local.json` in a project	That project, excluded from git, for your personal keys
Legacy Cascade	`~/.config/devin/mcp_config.json` (or `$XDG_CONFIG_HOME/devin/mcp_config.json` if `XDG_CONFIG_HOME` is set), or `%APPDATA%\devin\mcp_config.json` on Windows	Every server Cascade can connect to

How do I add a remote MCP server to the Devin Local agent?

Add an entry with a url field under mcpServers in one of the Devin CLI config files above, then save the file. For Wireflow:

{
  "mcpServers": {
    "wireflow": {
      "url": "https://www.wireflow.ai/api/mcp"
    }
  }
}

A URL entry uses Streamable HTTP when you leave out the transport field, and that is the transport the Wireflow endpoint uses. If the file already lists servers, add the wireflow entry inside the same mcpServers object.

If you use Devin CLI, you can add the server from the terminal instead. devin mcp add saves to the local scope, .devin/mcp_config.local.json, by default, and -s user saves to ~/.config/devin/mcp_config.json:

devin mcp add -s user wireflow https://www.wireflow.ai/api/mcp

How do I add a remote MCP server to Cascade's mcp_config.json?

Open mcp_config.json from the Cascade panel, add an entry with a serverUrl or url field under mcpServers, and save the file. Cascade has no MCP Marketplace or one-click install, so you add servers by editing this file.

Click the ... (Actions) menu in the top right of the Cascade panel.
Click the Open MCP config file icon in the MCPs section.
Add the entry under mcpServers, then save the file.

{
  "mcpServers": {
    "wireflow": {
      "serverUrl": "https://www.wireflow.ai/api/mcp"
    }
  }
}

Cascade also accepts url in place of serverUrl. For an HTTP server, use the endpoint URL itself, which should look like https://your-server-url/mcp. Devin Desktop supports three MCP transports: stdio, Streamable HTTP and SSE. Enterprise users must turn MCP on manually in settings first.

You sign in through the server's OAuth flow instead of pasting a key: for Wireflow, the client walks you through the Wireflow sign-in and a consent screen, where you sign in with your Wireflow account and approve the permissions. Devin Desktop supports OAuth for each transport type.

The consent screen lists exactly the permissions the client asked for, and you can revoke access at any time from your Wireflow settings. The MCP connector page lists every permission and tool.

Wireflow supports Dynamic Client Registration, so the client registers itself and you leave out the oauthClientId and oauthClientSecret fields. Those are for servers that don't support it.

In Devin CLI, devin mcp login wireflow opens a browser window where you can authorize access. The CLI also prompts you to sign in the first time it uses a server that supports OAuth, and it stores the tokens locally and refreshes them automatically.

Each MCP client, such as Windsurf, Claude Code or Devin CLI, keeps its own OAuth session, so sign in separately in each one, even if you already signed in elsewhere.

How do I add an API key or header to a remote MCP server?

Add a headers object to the server's entry, with the header your server expects. Wireflow needs none, because it signs you in with OAuth. If a server expects a static token, it goes in headers: oauthClientId and oauthClientSecret are OAuth client credentials for the sign-in, not per-request ones.

In Cascade's mcp_config.json, you can keep the secret out of the file. ${env:VAR_NAME} is replaced with the value of an environment variable, and ${file:/path/to/file} with the trimmed contents of a file, in serverUrl, url, headers and other fields:

{
  "mcpServers": {
    "my-server": {
      "serverUrl": "https://mcp.example.com/mcp",
      "headers": {
        "API_KEY": "Bearer ${env:AUTH_TOKEN}"
      }
    }
  }
}

For the Devin Local agent, put personal keys in .devin/mcp_config.local.json, which is excluded from git, and never commit keys or secrets to version control.

How do I check that the remote MCP server is connected?

Ask the agent a question only the server can answer. For Wireflow, this prompt only reads your account, so it spends no credits, and the agent should call whoami, get_credit_balance and list_workflows:

Use Wireflow. Tell me which Wireflow account you are connected as and my credit balance, then list my five most recent workflows.

If the reply names your Wireflow account and lists your workflows, the server is connected and signed in. You can also check the client side. In the legacy Cascade agent, the MCPs section of the Cascade panel's ... (Actions) menu lists your configured servers and how many tools each has enabled. In Devin CLI, devin mcp list lists all configured servers.

Then try a first run. This prompt asks for the cost before anything runs, and the run spends credits from your Wireflow account:

Use Wireflow to make a landscape image of a lighthouse on a rocky coast at dawn. Tell me which model you will use and its credit cost, and wait for my yes before you run it.

See the pricing page for credits and plans. To run a saved workflow from your own code instead of the agent, use an API key, which starts with sk-, with Run Workflows.

Why won't my remote MCP server connect in Windsurf?

The entry can be in the wrong file, the server can be turned off, the sign-in can be unfinished, or a team rule can block the server, so check each in turn.

The entry is in the wrong file. Match the file to your agent with the table above. In the Devin CLI config files, versions before v3000.3 (the Local 3.6 release) keep MCP servers in the mcpServers key of config.json, and newer versions move those entries to the dedicated files on startup.
The server is turned off. In Cascade, use the toggle next to the server in the MCPs section. In Devin CLI, a server with "disabled": true is skipped, and devin mcp enable wireflow turns it back on.
The sign-in is unfinished or has expired. In Devin CLI, an Auth required or AuthRequired error means the server needs OAuth, so run devin mcp login wireflow. To sign in again from scratch, run devin mcp logout wireflow, then devin mcp login wireflow.
A team rule blocks the server. Once a team admin allowlists even one MCP server, all other servers are blocked for the team, and the allowlisted Server ID must match the key name in your mcp_config.json, case included. In Devin CLI, a server can also be blocked if MCP is disabled for your team, or if it isn't on your team's allowlist or in an enforced MCP registry.
The server only speaks SSE. Devin CLI tries Streamable HTTP first and falls back to SSE on the same URL after a non-authentication 4xx error, such as 404 or 405. If the SSE endpoint is at another path, such as /sse, set "transport": "sse" with that URL.
Cascade has too many tools. Cascade can use 100 tools in total at any given time. To turn off single tools, list their names in the server's disabledTools array.
The tools still don't appear. The Devin CLI docs suggest asking the agent to list its MCP servers and tools, since a server may need a moment to initialize.