Skip to content
BuildBase
BuildBase in your AI tools

Use BuildBase in Windsurf

BuildBase in your AI tools: connect Windsurf to BuildBase's own MCP server and manage your BuildBase organization from Windsurf. You sign in as yourself, and Windsurf can do only what your role and your organization allow.

Add BuildBase to Windsurf

The address is the same in every AI tool: https://api.console.buildbase.app/mcp. BuildBase signs you in the first time Windsurf connects.

  1. In Windsurf, add a remote MCP server: Customize > MCPs, or ~/.config/devin/mcp_config.json. Use the address https://api.console.buildbase.app/mcp, or the command or config below.
  2. Sign in. A server that needs sign-in shows Needs authentication; choose Authenticate and sign in in the browser.
  3. On BuildBase's sign-in page, sign in as you do to the console, then approve the consent screen, which names Windsurf and what it asks for.
  4. Ask Windsurf something, such as "List my BuildBase organizations."
~/.config/devin/mcp_config.jsonJSON
{
  "mcpServers": {
    "buildbase-console": {
      "url": "https://api.console.buildbase.app/mcp",
      "transport": "http"
    }
  }
}

The plan it needs

Devin Desktop's MCP page does not name a plan. Team admins can limit servers to an allowlist under MCP & ACP.

How sign-in looks in Windsurf

A server that needs sign-in shows Needs authentication; choose Authenticate and sign in in the browser.

What is different in Windsurf

  • The agent asks before each MCP tool call by default; you can allow one tool or a whole server.
  • BuildBase adds its own rules on top: each organization is Off, Read only or Read and change for AI agents (Read only by default), and deletes, member and role changes, sends and money moves need your approval in the chat.
  • For a job with nobody to sign in, send one of your organization's API keys as the bearer instead. Add a headers object, with Authorization: Bearer <key>, to the server entry beside url and "transport": "http" in mcp_config.json.
  • Windsurf's MCP docs now lead to Devin's: the agent is Devin Local, in Devin Desktop.

If it does not work in Windsurf

Windsurf needs to sign in again
Choose Authenticate on the server, which clears the stored sign-in and runs it again.
Windsurf does not connect
Customize > MCPs lists the installed servers and their state. Devin Desktop's documentation names more than one place for mcp_config.json, so check the one its settings open.
Windsurf says the organization does not let agents in
An owner or admin sets the organization's AI agents setting in the console, under Account, then Security. Off turns every agent away, and an owner or admin can also block one agent for one member there.
Windsurf cannot change anything
The organization is Read only, the default. An owner or admin can switch it to Read and change, and Windsurf can then make changes without signing in again. Deleting, sending to an audience, roles and money still ask you to approve each change.

Frequently Asked Questions

Which Windsurf plan do I need?

Devin Desktop's MCP page does not name a plan. Team admins can limit servers to an allowlist under MCP & ACP.

Can Windsurf change things in my BuildBase organization?

Only where the organization allows it: Read only is the default. Even then, deletes, member and role changes, sends and money moves need your approval in the chat, and secrets never reach Windsurf.

Can I connect Windsurf with an API key instead of signing in?

Yes, for a job with nobody to sign in: send one of your organization's API keys as the bearer. Add a headers object, with Authorization: Bearer <key>, to the server entry beside url and "transport": "http" in mcp_config.json. The key works in its own organization only, and the organization's AI agents setting still applies.

Where next