Windsurf

Add Gazebo to Windsurf as an MCP server so your agent can retrieve credentials from the vault during development sessions.

Prerequisites

• A Gazebo account with at least one service connected
• An agent created in Gazebo with a bearer token

Configuration

In Windsurf's MCP server setup, use endpoint https://app.gazebohq.com/api/mcp and the header Authorization: Bearer <your-agent-token>. Create the agent bearer token at Gazebo Agents.

Windsurf configuration field names and locations vary by version. Follow Windsurf's current documentation for its configuration syntax; this guide intentionally does not prescribe url or serverUrl.

Verify the connection

Ask Cascade (Windsurf's AI) to call get_identity:

get_identity()
→ {
    status: "ok",
    name: "windsurf-agent",
    accessible_services: [
      { service: "vercel", allowed_methods: ["GET", "POST"] }
    ]
  }

Retrieve a credential

get_credential({ service: "vercel", method: "POST" })
→ "..."

Cascade receives the credential value and can use it to interact with the Vercel API within the permitted methods. Do not persist the returned value.

Troubleshooting

Server not visible in Cascade — Restart Windsurf after updating the MCP configuration.

401 Unauthorized — The bearer token is invalid. Verify it in the Gazebo dashboard and regenerate if needed.

get_credential denied — The requested method isn't in the access profile. Update it in the Gazebo dashboard before retrying.