Windsurf MCP Config: Marketplace and Server Setup in Devin Desktop

You search for a Windsurf MCP config tutorial, follow it line by line, and the marketplace icon it describes is nowhere on your screen. That is not a mistake on your end. Windsurf was renamed Devin Desktop in June 2026, the old docs now redirect to docs.devin.ai, and the default agent for new tabs changed from Cascade to Devin Local. The two agents set up MCP servers in different ways, and only one of them has a marketplace.

This article sorts out which setup you are on, where each config file lives, how to add servers through the marketplace or by hand, and what to check when a server stays silent. It also shows how to connect PicassoIA's image and video models over MCP, so your editor can produce assets while you code. Every config below comes from the official Devin docs unless I say otherwise, and where those pages disagree with each other, I point it out.

What Changed With Windsurf

Windsurf Is Now Devin Desktop

Cognition renamed the editor in June 2026. Search results and older tutorials still say Windsurf, but the changelog, the product pages and the documentation now sit under the Devin name. Cascade survives as the name of the legacy agent, while Devin Local is the default.

That split is the reason so many tutorials feel wrong. The official Cascade MCP page opens with a warning: its instructions apply to the legacy Cascade agent only, and Devin Local configures MCP servers through the Devin CLI config files instead.

Two Agents, Two Setups

💡 Quick check: New tabs open with Devin Local by default. Unless you switched agents on purpose, assume the Devin Local column describes your editor.

Where the Config File Lives

Before you edit anything, know which file your agent reads. A correct edit in the wrong file produces the most confusing kind of failure: nothing happens, and nothing complains.

Legacy Cascade Paths

The current Cascade page gives ~/.config/devin/mcp_config.json on macOS and Linux (or the same file under $XDG_CONFIG_HOME/devin/ when that variable is set) and %APPDATA%\devin\mcp_config.json on Windows. To open it from the editor, click the ... (Actions) menu at the top right of the Cascade panel, then choose Open MCP config file in the MCPs section.

Tutorials written before the rename point somewhere else: ~/.codeium/windsurf/mcp_config.json, or %USERPROFILE%\.codeium\windsurf\mcp_config.json on Windows. Third-party write-ups report that an entry in the old file still loads, but the official pages don't confirm it. Treat the old path as a fallback, not as the plan.

Devin Local Config Layers

Devin Local reads the Devin CLI config files, which come in three layers:

One wrinkle: the Devin Local page lists config.json files with the same three scopes, while the CLI page says older versions (before v3000.3) kept mcpServers inside those main config files and newer ones use the separate mcp_config.json. The docs disagree about which is current. Run devin mcp list to see what your install actually loaded before you edit a file.

Using the MCP Marketplace

The official Cascade page is blunt: Cascade does not have an MCP Marketplace or one-click install, and those features exist only for the Devin Local agent. If a tutorial tells you to click an MCPs icon in the Cascade panel and press Install, it describes the old editor.

Where to Find It

On Devin Local, the release notes point to the Customize page in the sidebar, where Browse marketplace sits on the Plugins tab. Menu labels move between releases, so if you don't see them, start with Customize and look from there.

Many listings are one-click OAuth integrations. The release notes mention services such as Dropbox, ClickHouse Cloud, Typeform, Coda, GitBook, Railway, Retool, Smartsheet and Make. Installing one returns an authorization URL, you approve it in the browser, and the server connects with no token pasted into a file. If stored credentials expire later, the server shows a Needs auth state with an Authenticate button.

When to Skip It

The marketplace is the fastest route, but not always the right one. Edit the config by hand when:

• You need to pin a package version in args instead of taking whatever is latest.
• The server is internal and will never appear in a public listing.
• You want the setup committed to the repo so teammates get it on checkout.
• You need exact control over environment variables and launch arguments.

OAuth installs trade control for convenience: no secret sits on your disk, but you also have no say in the launch arguments. A hand-edited entry gives you both, at the cost of rotating tokens yourself.

Add a Server by Hand

Stdio Server Example

A stdio server is a local process that the editor starts and talks to over standard input and output. This is the official GitHub example, with the token moved into an environment variable:

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${env:GITHUB_PERSONAL_ACCESS_TOKEN}"
      }
    }
  }
}

Copy Prompt

command and args are what you would type in a terminal. The -y flag lets npx install the package without stopping to ask. The env block is passed to the process, and nothing else from your shell is guaranteed to reach it.

Remote Server Example

Remote servers need a URL instead of a command. Legacy Cascade accepts serverUrl or url:

{
  "mcpServers": {
    "remote-http-mcp": {
      "serverUrl": "<your-server-url>/mcp",
      "headers": {
        "Authorization": "Bearer ${env:AUTH_TOKEN}"
      }
    }
  }
}

Copy Prompt

The Devin CLI format uses url and an explicit transport:

{
  "mcpServers": {
    "server-name": {
      "url": "https://mcp.example.com/mcp",
      "transport": "http",
      "headers": {},
      "disabled": false
    }
  }
}

Copy Prompt

When transport is "http" or left out, the CLI tries Streamable HTTP first and falls back to SSE if the server answers 404. Cascade documents three transports in total: stdio, Streamable HTTP and SSE, each with OAuth support.

Here is a quick field reference for both formats:

CLI Commands and Secrets

You can skip the JSON entirely. The Devin CLI manages servers with these commands:

Config files support two interpolation patterns: ${env:VAR_NAME} swaps in an environment variable, and ${file:/path/to/file} swaps in a file's contents, with ~ paths allowed.

💡 Tip: Put personal tokens in .devin/mcp_config.local.json, which is gitignored, and keep the shared .devin/mcp_config.json free of secrets. A token committed once stays in git history.

Limits, Approvals, and Allowlists

The 100 Tool Ceiling

Cascade can hold 100 tools in total across every connected server. Big servers use that budget fast, and once you pass it, some tools simply won't be available. Trim what you don't need with the disabledTools array:

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "disabledTools": ["create_repository"]
    }
  }
}

Copy Prompt

A smaller toolset also helps the agent pick the right tool, so disabling the ones you never call is worth doing even under the limit.

Approval Prompts in Devin Local

Devin Local behaves differently from Cascade here. Its default configuration prompts for approval before calling any MCP tool. You can grant permission to a single tool or an entire server, either for the session or permanently. Enterprise administrators can default-allow specific servers or tools so trusted integrations stop interrupting people.

Team Allowlists

Admins on Teams and Enterprise plans can set a custom MCP registry and an allowlist. Two rules matter. Once any server is allowlisted, every non-allowlisted server is blocked for the whole team. And patterns are regular expressions matched against the full string, so a loose pattern won't match the way you expect. Enterprise users also have to switch MCP on manually in settings.

A safe rollout looks like this: list the servers your team already uses, write one anchored pattern per server, switch the allowlist on for a small test group, then ask someone in that group to add a server you did not list and confirm it gets blocked. Only then widen it to everyone.

Troubleshoot a Silent Server

Check the Basics

Work through this list in order:

1. Validate the JSON. A trailing comma or a missing quote makes the whole file unreadable.
2. Run the command in a terminal. If npx -y @modelcontextprotocol/server-github fails there, it fails in the editor too.
3. Check Node.js. Third-party setup write-ups list Node.js 18 or newer for npx servers.
4. Run devin mcp list. It shows what actually loaded, which beats guessing.
5. Restart the editor. The official page doesn't say whether a restart is required, while third-party write-ups recommend one, so restarting is cheap insurance.
6. Look at the environment. A server that runs fine in your terminal can depend on a variable the editor never saw. Set it in env, or use ${env:VAR} and launch the editor from a shell that has it.

Rule Out the Wrong File

If the server never appears, check whether you edited the file your agent reads. A pre-rename tutorial sends you to ~/.codeium/windsurf/mcp_config.json, and Devin Local reads the CLI layers instead. Add a throwaway entry, then confirm it shows up in devin mcp list before you build the real config.

If you are moving an old Windsurf setup across, copy its mcpServers block into your user-level mcp_config.json, run devin mcp list, and only then delete the old file. Doing it in that order means you never lose a working server while you test.

When a team allowlist is on, the docs give four checks: confirm the pattern exactly matches the user's configuration, verify regex escaping, review the logs (invalid patterns are logged with warnings), and test the patterns in a regex tester.

How to Use PicassoIA Over MCP

Once the config is sorted, an MCP server is useful only if it does something for your project. A good first candidate is image generation, because blog heroes, app screenshots and README banners all come up mid-build. PicassoIA exposes four models through its MCP connector and its developer API:

Here is how to wire it in:

1. Open your MCP connections page. It lives at picassoia.com/en/mcp/accounts and needs a login. Create a connection and copy the server URL shown there. The URL isn't published on the public site, so don't guess it.
2. Add it from the CLI. Run devin mcp add picassoia <URL from step 1>. This is the documented command form for an HTTP server.
3. Sign in if asked. If the server uses OAuth, run devin mcp login picassoia.
4. Confirm it loaded. devin mcp list should show picassoia.
5. Ask for an asset. Tell the agent what you need, for example a 16:9 hero photo for a post. It starts the job with PicassoIA Image, then polls until the status is succeeded and hands you the URL.

Connector Tools and Limits

The PicassoIA connector exposes nine tools: generate_image, edit_image, generate_video_picassoia, generate_video_seedance, get_generation, list_generations, cancel_generation, list_models and get_account. That is a small slice of a 100-tool budget.

Jobs are asynchronous. A generate call returns a prediction id, and the agent polls get_generation until the job succeeds or fails. A failure is final, so retry with a new generation. The platform allows 5 concurrent predictions per account, shared across API tokens and MCP connections, and prompts are capped at 4,000 characters.

Prefer scripts to an editor? The developer API lives at https://api.picassoia.com/v1 and takes a Bearer token that starts with pia_sk_, created from the API section of your account. Predictions are created with POST /v1/models/{owner}/{name}/predictions and read back with GET /v1/predictions/{id}. The pricing page and the API docs word plan access differently, so check which plan your account needs before a team rollout.

💡 Tip: Need help drafting a prompt before the agent runs it? The language model collection on PicassoIA includes Claude Sonnet 5 and GPT 5.6 Sol.

Try It With Your Own Images

Your config is only as good as the first thing it produces, so produce something. Connect the server, ask for one hero image for the project you are working on today, and see how it reads. Change the lighting, the lens and the framing in your prompt, run it again, and compare. A few rounds is enough to find a style that suits your blog or your app.

Three first prompts make good connection tests:

• A hero photo. Ask PicassoIA Image for a 16:9 photograph of a desk at golden hour, with a specific lens and lighting named in the prompt.
• An edit. Hand an existing screenshot or photo to PicassoIA Image Editor Pro and ask for one precise change.
• A short clip. Turn the hero photo into motion with PicassoIA Video, then check the result before you commit to a longer render.

Open Picasso IA, pick a model from the lineup, and generate your first image. Every model, from text to image and video to language, is listed at picassoia.com/en/all-models.