Windsurf MCP server: add Sume's hosted MCP in Devin Desktop

Windsurf is now Devin Desktop, and its default agent, Devin Local, reads MCP servers from the Devin CLI config files: to add Sume, put a sume entry with "url": "https://mcp.sume.com/mcp", "transport": "http", and an Authorization header in ~/.config/devin/mcp_config.json. The legacy Cascade agent has its own MCP setup, an mcp_config.json you open from the Cascade panel, where the same server takes serverUrl and headers.

Devin's documentation, where Windsurf's docs now live, supplies the editor side: the Devin Desktop FAQ, Devin Local Agent, Cascade MCP Configuration, and the Devin CLI's MCP Configuration. Sume's side comes from OAuth and API keys, MCP tools and gates, and MCP quickstart, all read on 2026-09-27. Sume does not publish a Windsurf or Devin extension; the agent connects to Sume's remote MCP server directly. Sume's basics page says hosted MCP still works but is not part of the primary path today.

What changed for Windsurf MCP servers?

Devin's FAQ dates the change to June 2, 2026: Devin Desktop is the new name for Windsurf, the same IDE with the same features, and the documentation moved to docs.devin.ai. New tabs start with the Devin Local agent by default, and new conversations never start on Cascade, though existing Cascade conversations stay available from the history and sidebar.

Devin's Cascade page says its mcp_config.json setup applies to the legacy Cascade agent only, and that Devin Local configures MCP servers in the Devin CLI config files instead. So set up Sume for the agent you actually use.

How do I add Sume for the Devin Local agent?

Edit the user file, ~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows), which applies to all your projects, or a project's .devin/mcp_config.local.json, which is gitignored. Skip .devin/mcp_config.json: that file is committed and shared through version control. Devin's docs say a server that expects a static token takes it in headers, and that API keys never belong in version control. Versions before v3000.3 kept mcpServers in the config.json files instead; newer versions migrate those entries on startup.

"transport": "http" is Streamable HTTP, the default for URL-based servers and the transport Sume's quickstart asks for. Replace <SUME_API_KEY> with your key; Sume also accepts it as an x-api-key header. An API-key session sees the full hosted tool set, write and paid tools included. Devin's docs also describe OAuth sign-in for remote servers, and Sume's docs prefer OAuth for interactive clients; this post uses the key header, which both sides document and which Sume keeps for existing users and automation.

{
  "mcpServers": {
    "sume": {
      "url": "https://mcp.sume.com/mcp",
      "transport": "http",
      "headers": { "Authorization": "Bearer <SUME_API_KEY>" }
    }
  }
}

What about the legacy Cascade agent?

Devin's pages give different locations for Cascade's mcp_config.json, so open it from the Cascade panel rather than by path: click the … (Actions) menu at the top right of the panel, then the Open MCP config file icon in the MCPs section, add the server under mcpServers, and save. Remote servers take serverUrl or url plus headers. The file supports ${env:VAR_NAME} interpolation in headers, so the key can stay in an environment variable; an unset variable resolves to an empty string. Enterprise users must first turn MCP on in settings.

{
  "mcpServers": {
    "sume": {
      "serverUrl": "https://mcp.sume.com/mcp",
      "headers": { "Authorization": "Bearer ${env:SUME_API_KEY}" }
    }
  }
}

How do I keep paid Sume tools behind an approval?

Unlike Cascade, Devin Local asks for approval before calling any MCP tool by default. Standing rules go in the permissions config as allow, deny, and ask lists that match patterns such as mcp__sume__generate_video or mcp__sume__*. Sume's own gates still apply: an idempotency_key on write and paid tools, dry_run=true for an admission and cost preview that submits nothing, and max_spend_usd when you want a cap.

How do I check that Sume is connected?

Ask the agent to call mcp_health, which confirms the endpoint, the auth source, and the safety posture, then tools_list for every tool the session can see; Sume MCP tools list groups them by read, write, and paid. Hosted MCP cannot read files from your laptop, so local files reach Sume through an upload URL, a client PUT, and assets_complete. For VS Code's built-in MCP support, see VS Code remote MCP server.