How to add an MCP server to Windsurf (now Devin Desktop)

# Before you start: Windsurf is now Devin Desktop

Windsurf was renamed Devin Desktop on June 2, 2026, and Devin’s docs now give a new location for mcp_config.json. Devin’s announcement says your plan, pricing and extensions stay the same.

# Add the server to Windsurf’s mcp_config.json

Add one entry under mcpServers with your Zyflow link as its url, save, and refresh the server list. Open the file from inside the app, not by path: Devin’s docs list more than one location, and the app opens the file it reads.

1. Open the MCP config file from the app.

1. Paste the Zyflow entry. If other servers are already listed, add “zyflow” inside the same mcpServers object and put a comma after the entry before it.

{
  "mcpServers": {
    "zyflow": {
      "url": "https://app.zyflowcrm.com/mcp"
    }
  }
}

1. Save, then refresh the MCP servers or switch Zyflow on. Your AI’s first call to Zyflow starts sign-in.

Use url as the key: the legacy Cascade agent accepts serverUrl or url, and Devin’s agent config uses url. Devin Desktop signs in to Zyflow with OAuth, so you don’t need the npx mcp-remote bridge or the personal access token that some older Windsurf guides use.

Where is mcp_config.json?

Current Devin Desktop reads ~/.config/devin/mcp_config.json on macOS and Linux, and %APPDATA%\devin\mcp_config.json on Windows. Windsurf builds from before June 2026 read ~/.codeium/windsurf/mcp_config.json.

Devin’s rename FAQ lists one more path, ~/.codeium/mcp_config.json (docs.devin.ai, checked Oct 3, 2026). Opening the file from the app, as in step 1, gets you the file the app reads. On a build from before June 2026, write serverUrl in place of url.

Read-only access with an API key (optional)

To let your AI look things up without changing anything, send a read-only API key as a header instead of signing in. Create the key on Zyflow’s Connect page. The ${env:ZYFLOW_API_KEY} value reads the key from an environment variable, so the key itself stays out of the file.

{
  "mcpServers": {
    "zyflow": {
      "url": "https://app.zyflowcrm.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:ZYFLOW_API_KEY}"
      }
    }
  }
}

Set ZYFLOW_API_KEY before you start Devin Desktop. A read-only key can still export your data and works until you revoke it, so keep it private.

Other MCP apps

# Sign in and approve one workspace

The first time your AI calls Zyflow, Zyflow answers with a sign-in challenge and Devin Desktop opens Zyflow in your browser. It works like “Sign in with Google”: you sign in, pick one workspace and approve. You never paste a password into your AI app.

1. Your browser opens Zyflow’s sign-in. If the server shows “Needs auth” instead, click Authenticate.

2. Log in, or create a free account. New to Zyflow? Choose “Create a free account” under the “Welcome back” form.

3. On the screen that reads “[App name] wants to use your Zyflow”, pick one workspace and click Approve within 10 minutes.

4. Back in Devin Desktop, Zyflow is ready to use.

Under the hood, sign-in uses OAuth 2.1 with PKCE (S256) and either dynamic client registration or a client ID metadata document. Refresh tokens rotate on every use, and every token is stored as a hash. One connection reaches one workspace.

MCP server overview

# Use your customer records from the Windsurf editor

Ask in plain words, the way you’d tell a colleague. Your AI picks the Zyflow tool, and Zyflow keeps the record. Start by adding a customer, so the other prompts have something to find.

Add Maya Chen at Northwind as a customer, maya@northwind.example

Log a call with Maya: she approved the staging build and wants the invoice by Friday

What do we know about Northwind?

What’s on my plate today?

Undo what you just did

What you’ll see

Check that it worked

Read the MCP reference

# Windsurf MCP server not working? Common fixes

Most problems come from a file the app doesn’t read, a sign-in that didn’t finish, or an admin’s allowlist. Find your symptom below.

• Spot an error? Tell us
• See the setup guides

# Questions about Windsurf and MCP

Read the security page