Windsurf MCP servers for business tools

Windsurf is now called Devin Desktop. Add PopMCP to its MCP config and sign in, and its agent can read real orders, payments, tickets and analytics next to your code. No API keys.

https://app.popmcp.com/mcp

Connect PopMCP to Devin Desktop See the setup steps

Steps checked against Cognition's documentation on 30 October 2026

Connect Windsurf to PopMCP

One entry in the MCP config, then a browser sign-in. Enterprise teams may need an admin to allow it first.

Add PopMCP to Devin Desktop (formerly Windsurf)

A remote server needs a serverUrl or url. Devin registers itself with PopMCP when you sign in, so there is no client ID or secret to paste.

Sign in at app.popmcp.com, connect Shopify, Stripe or any other tool, and check each one shows as Verified.
In Devin Desktop, open the Customize page from the Agents window and click MCPs.
Add popmcp with a serverUrl to mcp_config.json. Nothing else is needed: no headers and no API key.
mcp_config.json
```
{
  "mcpServers": {
    "popmcp": { "serverUrl": "https://app.popmcp.com/mcp" }
  }
}
```
Follow the OAuth sign-in when it opens. On the PopMCP consent screen, tick only the connectors Devin should reach.
Devin asks for approval before it calls an MCP tool. Ask it to run list_connections, then start with a read-only request.

What you save and run, in order. Drawn from the steps beside it, not a screenshot.

Devin docs: Customizations (MCP)

The short answer

Devin Desktop is the new name for Windsurf, from Cognition. Its local agent supports the Model Context Protocol (MCP) over stdio, Streamable HTTP and SSE, with OAuth for each, and a remote server is added with a serverUrl or url in its MCP config. PopMCP is a hosted MCP server that puts 100+ business tools behind one URL, https://app.popmcp.com/mcp, so one entry reaches every tool you connect in PopMCP. Devin prompts for approval before it calls an MCP tool by default.

What to ask Devin Desktop

Devin Desktop calls PopMCP's tools, PopMCP reads your connected accounts, and the answer comes back in the chat. The tool names are the real ones Devin Desktop calls.

WindsurfPopMCP connected

Pull three recent Shopify orders so I can see the real field shapes before I write the parser.

PopMCP, 1 tool call

shopify_get_ordersThe three most recent orders, with line itemsread

Ask Devin Desktop about your tools

The reply is drawn as bars on purpose: the figures come from your own accounts, so this page does not make any up.

More to paste into Devin Desktop

Pull three recent Shopify orders so I can see the real field shapes.
Which Stripe products referenced in this project no longer exist?
List the HubSpot deal properties we use, so I can type them.

PopMCP's consent screen. Tick only the connections Devin should reach, then Authorize. Drawn from PopMCP's own consent screen, not a screenshot. Your layout may differ.

You decide what Devin Desktop can reach

That is set in PopMCP, not in Windsurf. The sign-in ends on a consent screen that lists your connections.

OAuth sign-in, no API keys: Devin Desktop signs in to PopMCP with OAuth 2.1. There is nothing to paste, and your Shopify or Stripe credentials stay encrypted inside PopMCP.
You pick the connectors: The consent screen lists your connections. Devin Desktop reaches only the ones you tick.
Read-only where you want it: A workspace owner or admin sets each teammate to no access, read, or read and write, per connection.
Every call is on the record: Usage shows each request by user, connector and tool. Removing someone's access applies on the next request.

Where PopMCP works in Windsurf

Each row is one place Windsurf runs, and what its vendor says about adding a remote MCP server there.

Where	Remote MCP	How it signs in
Devin Desktop (formerly Windsurf)macOS, Windows, Linux	Supported	OAuth sign-in, with dynamic client registration
Windsurf for JetBrainsJetBrains IDEs	Supported	Remote servers by serverUrl in mcp_config.json
Enterprise teamsTeam settings, MCP & ACP	Advanced setup	An admin's allowlist blocks every server not on it

Before you connect Windsurf

Windsurf changed its name and its MCP screens recently. Here is what its docs say now.

Windsurf is Devin Desktop: Cognition renamed Windsurf to Devin Desktop; windsurf.com and its docs now redirect to devin.ai. Windsurf for JetBrains is still available under its old name.
No marketplace step: The Customize page lists servers from your MCP registries under Available. PopMCP is added by URL in the config instead.
Allowlists block everything else: On Enterprise, once an admin allowlists even one MCP server, every server not on the list is blocked. Ask the admin to add PopMCP first.
Approval before tools: Devin prompts for approval before it calls any MCP tool by default. Keep that on for anything that writes.

Questions about Windsurf and PopMCP

Answered from Cognition's documentation, checked on 30 October 2026.

Is Windsurf now Devin Desktop?

Yes. Cognition says Devin Desktop is the new name for Windsurf, and windsurf.com redirects to devin.ai/desktop. Windsurf for JetBrains keeps its name.

How do I add a remote MCP server to Windsurf?

Add "popmcp": { "serverUrl": "https://app.popmcp.com/mcp" } under mcpServers in mcp_config.json, then follow the OAuth sign-in. In Devin Desktop the servers are managed from Customize, then MCPs.

Does Windsurf support OAuth for MCP?

Yes. Devin Local supports OAuth for stdio, Streamable HTTP and SSE servers, and registers itself with dynamic client registration, which is what PopMCP uses.

Why can't I add PopMCP on an Enterprise team?

If an admin has allowlisted any MCP server, every server not on the list is blocked. An admin adds PopMCP to the team's registry or allowlist first.

Can the agent change data in my tools?

Only where you allow it. Devin asks before it calls a tool, and in PopMCP Free is read-only, while on paid plans a new connection starts read-only until an owner or admin turns on write actions.

Sources

3 references, checked 30 October 2026

Every step on this page comes from these sources. Community sources are labelled, and we used them only where the vendor has not documented a step.

Cognition: Devin DesktopDevin Desktop is the new name for Windsurf.devin.ai
Devin docs: Customizations: MCPThe Customize page and its MCPs list, the serverUrl or url key, transports and OAuth with dynamic client registration, and approval before MCP tools.docs.devin.ai
Devin docs: Windsurf for JetBrains: MCPmcp_config.json with serverUrl, and that an Enterprise allowlist blocks every server not on it.docs.devin.ai