WEIR
Get a key
Theme

Windsurf MCP Setup in 2026: Config for Devin Desktop

Windsurf MCP servers now go in Devin Desktop's mcp_config.json. The url key that both agents read, sign-in, the 100-tool cap and a real X call we ran.


Published · Updated · 6 min read

Cover image: X data in Devin Desktop

Windsurf MCP setup in 2026 means one url entry in ~/.config/devin/mcp_config.json, because Windsurf is now Devin Desktop.

This guide adds Weir, a remote MCP server for X (Twitter) data, to Devin Desktop's two built-in agents. Weir only reads, so it never posts as you. We run Weir.

Paste this into that file, or %APPDATA%\devin\mcp_config.json on Windows:

{
  "mcpServers": {
    "weir": { "url": "https://api.weirapp.io/mcp" }
  }
}

Windsurf MCP server setup: add Weir to Devin Desktop

Devin's docs give the same user file for both built-in agents, Devin Local and Cascade.

  1. Open the file~/.config/devin/mcp_config.json, or %APPDATA%\devin\mcp_config.json on Windows.
  2. Add WeirPaste the JSON above and save.
  3. Sign inApprove Weir in your browser when asked. If Weir shows Needs auth, click Authenticate.
  4. Ask the free question"What's my Weir usage?" The agent calls get_usage, which costs nothing.

Devin Local is the default. New tabs start with it, and it reads MCP servers from Devin CLI's config files. Cascade is now the legacy agent, and new conversations never start on it.

Prefer a command? Devin CLI's docs give this, which writes the same user file:

devin mcp add -s user weir https://api.weirapp.io/mcp
devin mcp login weir

We couldn't run Devin Desktop here, so its details come from Devin's docs, current as of version 3.10.67.

serverUrl or url? The Windsurf MCP config JSON

Use url. Older Windsurf guides use serverUrl and ~/.codeium/windsurf/mcp_config.json, which predate the rename.

Setting Devin Local Cascade (legacy)
Remote URL key url serverUrl or url
User file ~/.config/devin/mcp_config.json same file
Turn off tools deny rules disabledTools
Tool cap none documented 100 in total
Asks before calls yes, by default not by default

Devin CLI's field list has url, transport, headers and OAuth options, with no serverUrl. So a serverUrl entry may work in Cascade and be missed by Devin Local.

Windsurf MCP config with an API key

Use a key on a machine where no browser can open. Create one under API keys in your Weir dashboard, export it as WEIR_API_KEY, then add a header:

{
  "mcpServers": {
    "weir": {
      "url": "https://api.weirapp.io/mcp",
      "headers": { "Authorization": "Bearer ${env:WEIR_API_KEY}" }
    }
  }
}

Cascade's docs say ${env:VAR} works in headers. Devin CLI's docs use the same syntax for OAuth secrets but don't list headers, so we can't promise Devin Local fills it in.

Keep a key in your user file, never in a project's .devin/mcp_config.json, which teammates share through git.

How many MCP tools can Windsurf use?

Cascade allows 100 tools in total across all servers. Weir lists 44 on a default sign-in, so with a few other servers you can hit the cap.

In Cascade, each server has an on/off toggle in the panel's MCPs section. To turn off only Weir's Reddit tools, add disabledTools to its entry:

"disabledTools": [
  "search_reddit", "search_subreddit", "search_subreddits", "lookup_reddit",
  "get_reddit_post", "get_reddit_comments", "get_reddit_user",
  "get_reddit_user_posts", "get_reddit_user_comments",
  "get_subreddit", "get_subreddit_posts", "get_subreddit_comments"
]

Using a key instead? Create it with the read:x scope and without read:reddit. Weir then lists no Reddit tools at all, in either agent.

Devin Local names tools mcp__weir__search_x and asks before each call. You can allow one tool or the whole server, for the session or for good.

To skip the prompt for one tool, add mcp__weir__search_x to permissions.allow in ~/.config/devin/config.json. You stop seeing each call's limit, though, and the limit sets the cost.

Can Windsurf read X (Twitter)? A worked task

Yes. With Weir added, the agent picks the tool and its arguments.

Use Weir to see what @cognition posted on X in the last 30 days.
Skip reposts and replies. List anything about Devin Desktop or MCP.

The tool it needs is search_x. We ran that call through Weir's MCP server on 22 October 2026:

→ search_x {"fromUsers": ["cognition"], "query": "-filter:nativeretweets",
            "since": "2026-09-22T00:00:00Z", "onlyOriginal": true, "limit": 3}
← 3 posts · 4 credits (1 + 3 × 1) · nextCursor set
  2026-10-20   94 likes  an invite to a Devin launch party in San Francisco
  2026-10-20  440 likes  what working at Cognition is like
  2026-10-19  410 likes  Devin Fusion's score on a coding-agent index

onlyOriginal drops replies, and -filter:nativeretweets drops reposts, which X search returns by default.

None of the three was about Devin Desktop or MCP. Three posts for 4 credits showed that before the agent paid for thirty.

The reply still carried a cursor. Weir's docs say only a null nextCursor means the end, so a second call could find more.

4credits for our 3-post search
21credits for a 20-post search
0credits for get_usage
5,000free Weir credits every month

Weir bills 1 credit per call plus 1 per X post, and failed calls are free. Packs start at $5 for 25,000 credits and never expire, as of October 2026. Your Devin Desktop plan is separate. Every Weir rate is on our pricing page.

If it doesn't work

  • Weir is missing from a new chat. New tabs use Devin Local, so change serverUrl to url.
  • Signed in elsewhere, asked again. Each MCP client keeps its own sign-in, so sign in once per tool.
  • Your team blocks it. Once an admin allowlists one server, all others are blocked. The allowlisted ID must match weir exactly.
  • MCP is off entirely. On Enterprise plans, MCP must be turned on in settings first.
  • Sign-in fails. We haven't tested it in Devin Desktop. Weir supports dynamic client registration, so if it fails, use the key.
  • A tool returns 402. Your Weir credits ran out, and retrying won't help.

When not to use Weir

  • The agent has to post or DM on X. Weir is read-only, so pick a tool with write access to your account.
  • You want your private data. Weir reads public posts, not your bookmarks, DMs or home timeline.
  • Price per post matters most. TwitterAPI.io lists $0.15 per 1,000 tweets as of October 2026, less than our $5 pack.
  • You need a guarantee. Weir isn't licensed by X or affiliated with it, so access can change.

FAQ

Where is the Windsurf MCP config file now?

At ~/.config/devin/mcp_config.json, or %APPDATA%\devin\mcp_config.json on Windows. For one repo, Devin CLI's docs add .devin/mcp_config.json, shared through git, and .devin/mcp_config.local.json, which git ignores.

Is Weir in the Windsurf MCP marketplace?

Not that we know of. Devin's docs say the marketplace serves Devin Local only; Cascade has none. Weir is in the official MCP Registry as io.weirapp/weir, but Devin's docs don't say where the marketplace gets its servers, so add Weir by URL. Enterprise admins can swap the marketplace for their own registries.

Does Windsurf support remote MCP servers?

Yes, over stdio, streamable HTTP or SSE, with OAuth on each. Weir uses streamable HTTP at https://api.weirapp.io/mcp.

Can Windsurf post to X through Weir?

No. Weir only reads public X data, so nothing can post, like or follow through it. To post, you need a tool that holds your own X account's access.

Sources

Keep reading