Windsurf (Devin Desktop) MCP Setup: Config Files, Scopes and Registries (2026)

Windsurf is now called Devin Desktop, and its MCP setup has moved with the name. To add a server, open Customize from the Agents window and click MCPs, then install from the Available list. To add one by hand, edit mcp_config.json at one of three scopes: .devin/mcp_config.json (project), .devin/mcp_config.local.json (your private override) or ~/.config/devin/mcp_config.json (user).

The old Windsurf file, ~/.codeium/windsurf/mcp_config.json, is not listed in Devin Desktop's MCP docs. This guide shows the current files, a minimal working config and how to handle sign-in.

Checked against: Devin's Devin Desktop extensibility docs, Devin CLI MCP configuration docs and configuration import docs on 2 November 2026. eSEOspace did not test Devin Desktop.

What changed from Windsurf

On 2 November 2026, windsurf.com redirected (HTTP 308) to devin.ai/desktop, which says "Devin Desktop is the new name for Windsurf." The old Windsurf docs URL for MCP (docs.windsurf.com/windsurf/cascade/mcp) now redirects to the Devin Desktop page. That page describes the "Devin Local agent in Devin Desktop."

Our Cursor vs Windsurf comparison covers the rename and what it means for teams choosing an editor.

Where the config files live

The Windows path comes from the Devin CLI docs, which share these files. Those docs also note the file location changed in Devin v3000.3: older versions kept servers in the main config.json files, and newer versions move them to the dedicated mcp_config.json files "automatically on startup."

Use the local override for personal API keys. The Devin docs say "local configs are gitignored, use these for personal API keys."

Add a server from the app

1. Open Customize from the Agents window and click MCPs.
2. Use the Install MCPs for selector at the top to pick the scope, such as This computer.
3. In the Available list, click Install on a server.
4. Check the This computer list. It shows the servers your agent loads for the folders open in the window, with toggles to turn each on or off and a refresh button.

Minimal config examples

A local (stdio) server, from the Devin docs' project example:

{
  "mcpServers": {
    "server-name": {
      "command": "npx",
      "args": ["-y", "@company/mcp-server"],
      "env": {
        "API_KEY": "your-key"
      }
    }
  }
}

A remote server that signs in with OAuth, from the docs' Linear example:

{
  "mcpServers": {
    "linear": {
      "url": "https://mcp.linear.app/mcp",
      "transport": "http"
    }
  }
}

Remote servers use Streamable HTTP by default. The docs say if a server answers with a 4xx error such as 404 or 405, Devin falls back to SSE on the same URL, but 401 and insufficient-scope 403 errors are reported so you can sign in. Both blocks were checked against the Devin docs on 2 November 2026.

For secrets in a shared project file, the docs support ${env:VAR} and ${file:/path} references in OAuth fields, or putting the value in the gitignored local file.

Sign in to OAuth servers

When stored OAuth credentials expire, a server shows Needs authentication in the This computer list and on its detail page. Click Authenticate to rerun the browser sign-in.

The Devin docs stress one point: "Each MCP client (Windsurf, Claude Code, Devin CLI) maintains its own OAuth session." Signing in to Linear in Claude Code does not sign you in here.

Approvals and admin controls

The Devin Desktop page says "by default the agent prompts for approval before calling any MCP tool." You can allow a tool or a whole server from the permissions settings.

For companies, enterprise admins manage MCP registries in team settings under MCP & ACP. A toggle lets servers matching a registry entry through "in addition to the MCP allowlist." If several registries are set, Devin Desktop uses the union of all of them, and custom registries must follow the official MCP registry schema. Our MCP registry explainer covers that schema.

Bringing old Windsurf servers across

Devin's configuration import page says Devin CLI reads Windsurf MCP servers from ~/.codeium/<channel>/mcp_config.json, such as ~/.codeium/windsurf/mcp_config.json on the stable channel. The Devin Desktop page itself does not mention that file. To be safe, copy each entry from the old file into ~/.config/devin/mcp_config.json and confirm it appears under This computer.

Common mistakes

• Editing the old Windsurf file and expecting Devin Desktop to pick it up. Use the .devin or ~/.config/devin files.
• Committing keys in .devin/mcp_config.json. Put them in .devin/mcp_config.local.json.
• Assuming one OAuth login covers every tool. Each client signs in separately.
• Setting "transport": "sse" on a modern server. Leave it out or set "http"; Devin falls back to SSE on its own when needed.

Next step

Check a server before you install it with our MCP server risk checklist, and use the config generator to draft an mcpServers block. For a wider view of editors, see best AI coding agents with MCP.

Frequently asked questions