Agentic IDE, Native OAuth

Devin Desktop WordPress MCP, formerly Windsurf. serverUrl, and the right config file.

Devin Desktop WordPress MCP setup is what Windsurf guides written before June 2026 now describe: Cognition renamed Windsurf to Devin Desktop on 2 June 2026. Existing MCP connections came across, and Cascade is now the legacy option beside Devin Local. GoBuildWP generates serverUrl for Cascade; its current documentation also accepts url. Check the agent and configuration your installed build uses.

Get GoBuildWP free Setup steps

Checked against Devin Desktop's documentation on 29 September 2026, entries from GoBuildWP Free 1.18.6

By GoBuildWPContent updated 13 October 2026How we check claims

~/.config/devin/mcp_config.jsonOAuth 2.1

{
  "mcpServers": {
    "gobuildwp-your-site-com": {
      "serverUrl": "https://your-site.com/wp-json/mcp/wppilot-oauth"
    }
  }
}

Config: ~/.config/devin/mcp_config.json
Remote key: serverUrl (url also accepted)
Tool limit: 100 across servers (Cascade)

Connect screen

What GoBuildWP writes, and where Devin Desktop looks

GoBuildWP's entries for this client use mcpServers with serverUrl: OAuth URL alone on a public site, URL and headers for a token, and the npx bridge on a local site. It lists three files: ~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows), which Devin's MCP page gives, and the Windsurf-era ~/.codeium/windsurf/mcp_config.json, which Devin's transition FAQ says the app still reads. Opening the file from the app settles which one your build uses.

OAuth 2.1	On a public site the Connect screen gives a native serverUrl entry and Devin Desktop runs the sign-in; on a local site it falls back to the mcp-remote bridge.
Access token	serverUrl plus headers. ${env:VAR} and ${file:path} interpolation keep the token out of the file.
Application Password	The npx bridge with credentials in env.

Endpoints on your site: /wp-json/mcp/wppilot-oauth for OAuth, /wp-json/mcp/wppilot for tokens and passwords. Through the optional GoBuildWP Cloud instead, every client uses https://app.gobuildwp.com/mcp with the server name gobuildwp, and a personal Cloud token is read from GOBUILDWP_TOKEN where the client supports environment variables.

~/.config/devin/mcp_config.jsonAccess token

{
  "mcpServers": {
    "gobuildwp-your-site-com": {
      "serverUrl": "https://your-site.com/wp-json/mcp/wppilot",
      "headers": {
        "Authorization": "Bearer wpp_YOUR-ACCESS-TOKEN"
      }
    }
  }
}

Inside Devin Desktop

Checking the connection after the rename

Cascade shows each server with a switch in its MCPs section; a server that is on but lists no tools has failed to connect or sign in. Devin Local shows Needs auth until the WordPress grant is in place, and its tool calls ask for approval by default.

For Devin Local, permission rules name a tool by mcp, the server and the tool joined with double underscores, so you can allow the WordPress reads and keep writes asking. Teams administrators can allowlist servers; once any server is allowlisted, every other server is blocked, which is a common reason a newly added WordPress server silently does nothing.

Enterprise workspaces have MCP turned off until an administrator enables it. Cascade supports MCP resources and prompts as well as tools, though GoBuildWP's abilities arrive as tools either way.

Signs it worked

The server appears in the MCPs section with tools
Needs auth has cleared after sign-in
Cascade's documented tool limit is checked across its servers; Devin Local requires its own versioned configuration and reachability check
The Teams allowlist includes the WordPress server

Setup

Add WordPress in Devin Desktop

Decide which agent will use the site. Cascade reads mcp_config.json; Devin Local uses the Devin CLI's configuration and commands.

Cascade: open the config from the panel
In the Cascade panel, open the Actions menu and choose Open MCP config file. That opens whichever file this build actually reads, which settles the path question.
Paste the serverUrl entry
Merge GoBuildWP's block into mcpServers. Keep serverUrl; Cascade accepts url too, but serverUrl is what GoBuildWP and the older Windsurf docs agree on.
Devin Local: add it with the CLI
Run devin mcp add with -s user or -s project, a name and the URL. It lands in ~/.config/devin/mcp_config.json or the project's .devin folder.
Authenticate
Cascade and Devin Local both support OAuth. Devin Local marks the server Needs auth with an Authenticate button; devin mcp login does the same from a terminal.
Toggle tools
Cascade limits you to 100 tools across all servers. Use disabledTools on the entry, or the switches in the MCPs section, to drop the WordPress abilities you do not need.

Verify the connection before allowing changes

Select Read Only explicitly; the default is Production Safe. Use a dedicated identity with manage_options on a single site, or superadmin on multisite. Match the named tool call, site URL and returned record ID against WordPress.

First connection checkRead Only

Use the gobuildwp-your-site-com MCP server in Devin Desktop. Do not change anything.

1. Report the active GoBuildWP safety profile.
2. List the abilities this connection can see.
3. Call wppilot/get-site-settings and report the site URL and locale.
4. Call wppilot/list-content for the five newest pages,
   then wppilot/get-content on one of them.
5. Name every ability you called and each WordPress ID you read.

These setup instructions are not a recorded live-client test. Keep credentials out of repositories, logs and shared files.

Troubleshooting

Devin Desktop errors and their causes

Symptom	Cause and fix
Edits to one mcp_config.json do nothing	This build reads the other path, ~/.config/devin or the old Windsurf folder. Use Open MCP config file from the Cascade panel and move the entry there.
The server is added but blocked	A Teams allowlist exists. Ask an administrator to add the WordPress server, since allowlisting one server blocks all others.
Too many tools	Cascade caps tools at 100 across servers. Add the WordPress abilities you do not use to disabledTools, or turn them off in GoBuildWP.
MCP is missing entirely	On Enterprise plans an administrator must turn MCP on first.
A remote entry copied from another client fails	GoBuildWP generates serverUrl, and current Cascade documentation also accepts url. Check the loaded file, mcpServers wrapper, endpoint and actual error. Devin Local uses its own CLI configuration; the URL key alone does not identify the failure.

First task

A first Cascade task

Cascade works through multi-step edits, so the first run should show it planning without acting. This one audits media and stops.

Devin Desktop promptReads only

Use the WordPress MCP server. Read only.

1. wppilot/audit-media-alt: images missing alt text.
2. For the first five, wppilot/get-media-image so
   you can see them.
3. Write alt text for each, but do not save it.
4. Say which ability would save it, and what the
   safety profile would need to allow.

Devin Desktop on a staging site

From drafted alt text to a saved, reversible change

The first Cascade task stops at a plan: alt text written but not saved. The second run, on a staging copy switched to Production Safe, is where the agent writes. wppilot/update-image-alt accepts up to a hundred images per call as pairs of attachment ID and alt text, so ask for one batch of five, the same five it looked at with wppilot/get-media-image, and nothing more. Then have it run wppilot/audit-media-alt again and show that those images moved from missing to ok.

Because the change is recorded, you can rehearse recovery before you trust the workflow on the live site. wppilot/list-sessions shows the session Devin Desktop's connection opened and how many of its changes can be undone; wppilot/undo-session puts the old alt text back and verifies each image against its before-image, provided nothing else has changed those images since; if something has, it refuses and lists the conflicts.

"Save the five alt texts you drafted with wppilot/update-image-alt. Only those attachment IDs."
"Run wppilot/audit-media-alt again and confirm the five are now ok."
"List this session with wppilot/list-sessions and tell me what an undo would restore."

Staying under Cascade's tool limit from the WordPress side

disabledTools trims what Cascade loads, but it lives on one machine. Two site-side controls do the same job for every client. GoBuildWP's per-ability switches remove abilities from discovery altogether, which suits a site where nobody will ever use, say, theme management through an agent. An access token limited to chosen abilities or categories hides everything else from that token's tool list, so a Devin Desktop connection made with such a token arrives already small. The safety profile shrinks the list as well, because abilities the active profile blocks are taken out of the registry: a Read Only site offers the fewest tools. Clients cache the list they were given, so restart the Cascade session after changing any of these.

Devin Desktop through GoBuildWP Cloud

Windsurf is on the list of apps that sign in to the optional GoBuildWP Cloud with OAuth. The entry keeps the same serverUrl key, pointed at the Cloud link instead of a site, and after signing in you choose which connected sites the editor may reach. That is one entry and one tool list for several sites, which helps with the tool limit too. A single site you work on alone is simpler as a direct entry, with no account and no relay.

FAQ

Windsurf and Devin Desktop questions

Is Windsurf the same as Devin Desktop?

Yes. Cognition renamed Windsurf to Devin Desktop on 2 June 2026 through an update, and existing MCP connections carried over. GoBuildWP still recognizes the old windsurf and codeium client names.

Which agent in Devin Desktop should use the WordPress server?

Either. Cascade, now the legacy agent, reads mcp_config.json; Devin Local, the default, uses devin mcp add and its own files. Both support OAuth.

Does Devin Desktop have an MCP marketplace entry for WordPress?

Devin Desktop's marketplace belongs to Devin Local; Cascade has none. GoBuildWP is added as a custom server with the URL from your own site either way.

Can VS Code reuse my Windsurf WordPress server?

VS Code's MCP discovery can import from the Windsurf path when you switch that source on, which is one reason the old file still matters.

Cursor: url instead of serverUrl, with a one-click link
Antigravity IDE: the other editor that insists on serverUrl
Claude Code: permission rules that name tools the same way

Every client guide (26)

Devin Desktop documentation read on 29 September 2026

Carry your Windsurf WordPress server into Devin Desktop.

Open the config from the app, keep serverUrl, sign in, and stay under the tool limit.

Get GoBuildWP free See Pro pricing

Devin Desktop WordPress MCP, formerly Windsurf. serverUrl, and the right config file.

What GoBuildWP writes, and where Devin Desktop looks

Checking the connection after the rename

Signs it worked

Add WordPress in Devin Desktop

Cascade: open the config from the panel

Paste the serverUrl entry

Devin Local: add it with the CLI

Authenticate

Toggle tools