Skip to main content
mcp client

Connect Windsurf

transport
Streamable HTTP
default access
read-only

How do I connect Windsurf?

Windsurf connects to the ZopNight MCP server through Settings → Cascade → MCP Registry, editing the raw JSON. Windsurf uses `serverUrl` rather than `url`. The key name differs from Cursor's own, and using the wrong one leaves the server silently unregistered.

Windsurf connection settings.
Setting Value
Config locationWindsurf MCP Registry raw config (Cascade settings)
AuthPersonal Access Token (Bearer)

Open MCP Registry from Cascade settings

In Windsurf, open Settings, scroll to the Cascade section and click Open MCP Registry. Under Installed, open the settings icon, paste the JSON below and save.

The Windsurf JSON block, with a Bearer header

Terminal window
{
"mcpServers": {
"zopnight": {
"serverUrl": "MCP_SERVER_URL",
"headers": {
"Authorization": "Bearer MCP_PAT"
}
}
}
}

Replace MCP_SERVER_URL with the Server URL from Organisation Settings and MCP_PAT with your zn_pat_… token.

serverUrl, not url

Windsurf’s schema names the field serverUrl. Cursor and Claude Code use url. Copying a working Cursor config across is the usual cause of a server that saves without error and never appears. The unknown key is ignored rather than rejected.

Cascade is the agent that consumes the tools once registered.

What Cascade can query at read-only

At the default org setting, read-only, 85 of the 119 tools work immediately. That covers cost totals by team or tag, spend trends, budget health, detected anomalies, the full resource inventory, recommendations with their savings, Kubernetes logs and events, and deploy history.

Ask for a cost overview first; it is the entry point the tool set is designed around.

Turning on mutating tools for Windsurf

Mutating tools sit behind an org-level dial with four positions, each cumulative:

TierWhat it unlocks
Read-onlynothing mutating (the default)
Metadatabudgets, recommendation status, smart-tag decisions
Reversibleschedules, overrides, tagging policies, deploys and rollbacks
Irreversiblestart/stop, provisioning, Kubernetes writes, deletes

Your own RBAC still applies on top: the tier is a ceiling, not a bypass. Roles, user management, credentials and cloud-account deletion are never reachable at any tier.

Cascade sees no tools after saving

Two causes account for almost every case. Either MCP is not enabled for the organisation, or the transport is wrong. MCP is off by default, and an admin turns it on in Organisation Settings. Every mutating call is audit-logged with its source, so MCP activity stays distinguishable from UI and API activity afterwards.

faq · mcp

Windsurf: troubleshooting

Where do I add an MCP server in Windsurf?

Open Settings, scroll to the Cascade section and click Open MCP Registry. Under Installed, open the settings icon and paste the raw JSON there.

The config saved but Cascade sees no tools. Why?

Check the key name. Windsurf's schema is serverUrl, while Cursor and Claude Code use url. An unknown key is ignored rather than rejected, so a config copied from Cursor saves without error and never appears.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·