Skip to content
BuildBase
Agent-ready apps

Let your users connect Windsurf to your app

Agent-ready apps: make the app you build with the SDK ready for Windsurf. Your users add your app's MCP server to Windsurf, sign in on your hosted page and approve it, and Windsurf acts as them, never as more.

How your users add your app to Windsurf

Give your users your app's MCP address. npx buildbase agent install --url <your MCP address> prints the setup for each AI tool, Windsurf included, with your address filled in.

  1. In Windsurf, your user adds a remote MCP server: Customize > MCPs, or ~/.config/devin/mcp_config.json. They use your app's MCP address, https://app.example.com/api/mcp in these examples, or the command or config below.
  2. Sign in. A server that needs sign-in shows Needs authentication; choose Authenticate and sign in in the browser.
  3. Your hosted sign-in page opens. Your user signs in and approves the consent screen, which names Windsurf and what it asks for.
  4. Windsurf can now use your tools, as that user and with that user's permissions.
~/.config/devin/mcp_config.jsonJSON
{
  "mcpServers": {
    "acme": {
      "url": "https://app.example.com/api/mcp",
      "transport": "http"
    }
  }
}

The plan it needs

Devin Desktop's MCP page does not name a plan. Team admins can limit servers to an allowlist under MCP & ACP.

How sign-in looks in Windsurf

A server that needs sign-in shows Needs authentication; choose Authenticate and sign in in the browser.

What is different in Windsurf

  • Windsurf runs on your user's own computer, so it reaches any address that computer can, including a development server while you test.
  • Your server's built-in tools are read-only until you allow changes. The agent asks before each MCP tool call by default; you can allow one tool or a whole server.
  • Windsurf's MCP docs now lead to Devin's: the agent is Devin Local, in Devin Desktop.

If it does not work in Windsurf

Windsurf cannot register or sign in
Turn on Let agents register themselves, with a base client, in the console under Authentication, then Agent readiness. Windsurf registers its own client the first time it connects.
Windsurf does not connect
Customize > MCPs lists the installed servers and their state. Devin Desktop's documentation names more than one place for mcp_config.json, so check the one its settings open.
Windsurf needs to sign in again
Choose Authenticate on the server, which clears the stored sign-in and runs it again.
Check your server the way Windsurf will
Run npx buildbase agent doctor --url <your MCP address>. It walks the first contact a client makes (the sign-in challenge, the metadata, redirects, a stable tool list) and exits 1 when a check fails.

Frequently Asked Questions

Which Windsurf plan do your users need?

Devin Desktop's MCP page does not name a plan. Team admins can limit servers to an allowlist under MCP & ACP.

Does my MCP server need to be public for Windsurf?

No. Windsurf runs on your user's computer, so it reaches what that computer reaches. Your users still need an address they can open, and production should be public HTTPS.

Can Windsurf change data in my app?

Only through tools you allow, and only as the user who connected it. The built-in tools are read-only by default, and a tool that needs extra scopes is hidden until the user grants them.

Where next