Windsurf

Windsurf’s Cascade agent supports remote MCP servers. The config is JSON, but the key differs from every other client on this site.

Add it

Edit ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "vulnetix": {
      "serverUrl": "https://mcp.vulnetix.com/mcp",
      "headers": {
        "Authorization": "ApiKey <orgId>:<hex>"
      }
    }
  }
}

Warning serverUrl, not url. Windsurf is the odd one out. Copy a working Cursor or Claude Desktop config across unchanged and the server is parsed but never contacted. There is no error, and it never appears. This is the single most common Windsurf mistake.

You can also reach the same file through Settings → Cascade → MCP Servers → Manage → View raw config.

Restart Windsurf, then press Refresh in the MCP panel.

Confirm it works

The MCP panel lists vulnetix with a tool count. In Cascade:

Check whether express has any known vulnerabilities and recommend a safe version.

Worth knowing

Cascade only. MCP tools are not available in Windsurf’s inline completion or Command features.

Tool budget. Windsurf limits how many tools it exposes at once (historically around 100 across servers). 31 from Vulnetix leaves room, but disable servers you are not using if tools start being ignored.

Refresh after editing. The MCP panel has a refresh control, faster than restarting, though a restart is the reliable fallback.

Troubleshooting

Server does not appear at all. You almost certainly used url instead of serverUrl.

Appears but shows zero tools. Press Refresh. If it stays at zero, check the URL ends in /mcp and validate the JSON with jq ..

401 in every result. Both halves of the key: ApiKey <orgId>:<hex>.