---
title: "Windsurf MCP Setup | Gazebo Docs"
description: "Add Gazebo to Windsurf as an MCP server. Configure bearer token authentication and use get_credential in your workflows."
url: "https://gazebohq.com/docs/mcp/windsurf"
---

Add Gazebo to Windsurf as an MCP server so your agent can retrieve credentials from the vault during development sessions.

## Prerequisites

- A Gazebo account with at least one service connected
- An agent created in Gazebo with a bearer token

## Configuration

In Windsurf's MCP server setup, use endpoint `https://app.gazebohq.com/api/mcp` and the header `Authorization: Bearer <your-agent-token>`. Create the agent bearer token at [Gazebo Agents](https://app.gazebohq.com/agents).

Windsurf configuration field names and locations vary by version. Follow Windsurf's current documentation for its configuration syntax; this guide intentionally does not prescribe `url` or `serverUrl`.

## Verify the connection

Ask Cascade (Windsurf's AI) to call `get_identity`:

```
get_identity()
→ {
    status: "ok",
    name: "windsurf-agent",
    accessible_services: [
      { service: "vercel", allowed_methods: ["GET", "POST"] }
    ]
  }
```

## Retrieve a credential

```
get_credential({ service: "vercel", method: "POST" })
→ "..."
```

Cascade receives the credential value and can use it to interact with the Vercel API within the permitted methods. Do not persist the returned value.

## Troubleshooting

**Server not visible in Cascade** — Restart Windsurf after updating the MCP configuration.

**`401 Unauthorized`** — The bearer token is invalid. Verify it in the Gazebo dashboard and regenerate if needed.

**`get_credential` denied** — The requested method isn't in the access profile. Update it in the Gazebo dashboard before retrying.