Devin / Windsurf

Connect Gazebo to Devin, the current successor to Windsurf, using HTTP and OAuth. This guide covers Devin's hosted agent, with manual-token guidance for older Windsurf/Cascade clients below.

Devin hosted setup

Open the MCP integrations settings in Devin web or Desktop and add a custom MCP:

• Server name: Gazebo
• Icon (optional): https://gazebohq.com/favicon.png
• Transport: HTTP
• Server URL: https://app.gazebohq.com/api/mcp
• Authentication: OAuth
• Access: Personal, so each member authenticates separately
• Execution location: Automatic (connects from Devin's servers)
• OAuth grant type: Authorization code
• Client ID and client secret: leave blank for automatic registration
• Scope: gazebo.credentials.read offline_access
• Resource: Default (discovered)
• Custom headers and secrets: none required

Leave Devin's callback URL unchanged. Install and enable, then use Connect or Complete OAuth. Sign in to Gazebo, select only the service keys this connection needs, choose an access deadline and approve. Do not create a manual agent token for this OAuth path.

Personal authentication is not a session-privacy boundary: Devin warns that other organization members may still interact with sessions. The selected provider key is delivered to Devin's runtime and can be accessed by its host.

In the web configuration page, Test tools validates the server and discovers tool schemas; the tested panel did not execute tools. Use Use MCP to start an agent session, then ask it to call get_identity without retrieving credentials. Desktop and web settings differ; do not expect identical buttons.

OAuth retrieval must include the approved key name:

get_credential({ service: "your-test-service", key_name: "api_key", method: "GET" })

Use a fictional key for first-run verification and do not ask the agent to display the returned value. A hosted agent session needs available usage quota; check your current plan rather than assuming MCP validation includes agent credits.

Tested with Devin's hosted agent. See the compatibility guide for detailed results.

To disconnect, revoke the Devin grant in Gazebo → Settings → Developer → Consent clients → Active Grants. Revocation stops new retrieval, not use of a provider key already returned. Invalidate that key at its provider if necessary.

Legacy Windsurf / Cascade

The remaining instructions concern manual agent-token configuration in older clients, not the tested Devin OAuth path.

Prerequisites

• A Gazebo account with at least one service connected
• An agent created in Gazebo with a bearer token

Configuration

In Windsurf's MCP server setup, use endpoint https://app.gazebohq.com/api/mcp and the header Authorization: Bearer <your-agent-token>. Create the agent bearer token at Gazebo Agents.

Windsurf configuration field names and locations vary by version. Follow Windsurf's current documentation for its configuration syntax; this guide intentionally does not prescribe url or serverUrl.

The vendor's MCP documentation currently redirects to Devin Desktop/Cascade documentation. Check the product and version shown in your app and use its remote HTTP/custom-header setup instructions.

Verify the connection

Ask Cascade (Windsurf's AI) to call get_identity:

get_identity()
→ {
    status: "ok",
    name: "windsurf-agent",
    accessible_services: [
      { service: "vercel", allowed_methods: ["GET", "POST"] }
    ]
  }

Retrieve a credential

get_credential({ service: "vercel", method: "POST" })
→ "..."

Cascade receives the actual provider credential. The declared method controls retrieval; the provider key's permissions control subsequent Vercel API calls. Do not persist the returned value. Revoking Gazebo access stops new retrieval, not use of a key already received.

Troubleshooting

Server not visible in Cascade — Restart Windsurf after updating the MCP configuration.

401 Unauthorized — The bearer token is invalid. Verify it in the Gazebo dashboard and regenerate if needed.

get_credential denied — The requested method isn't in the access profile. Update it in the Gazebo dashboard before retrying.