Windsurf MCP, now Devin Desktop: OG images and screenshots from the agent

Windsurf's agent can render Open Graph images, take website screenshots and write the code that uses them once Shareglint is in its MCP config. One thing first: Windsurf has been renamed Devin Desktop. Its documentation now lives at docs.devin.ai, new conversations start with the Devin Local agent, and "Cascade is the legacy agent in Devin Desktop" (Devin docs, read 2026-11-06). The setup below is for Devin Local, with a note for Cascade.

The tools — render_image, get_image, list_templates, get_template, create_signed_url, get_usage, generate_template, take_screenshot, auto_og_url, create_batch, get_batch — run on your account and quota, 100 renders a month on the Free plan. For what an MCP server is, see what is an MCP server.

Set it up in Devin Local

Devin Local reads MCP servers from ~/.config/devin/mcp_config.json (your user), .devin/mcp_config.json (a project) or .devin/mcp_config.local.json (a project, not committed), and "supports the stdio, Streamable HTTP, and SSE transports, and OAuth for each" (Devin docs: customizations). The config format is shared with the Devin CLI: servers under mcpServers, a remote one with a url and optional headers (Devin CLI: MCP configuration).

With OAuth (simplest). Add only the URL:

{
  "mcpServers": {
    "shareglint": {
      "url": "https://shareglint.com/mcp"
    }
  }
}

Open Customize → MCPs in the Agents window. The server appears under This computer; click Authenticate, sign in to Shareglint in the browser and approve. No key is stored in the file or your environment, and you can disconnect the app later from your Shareglint account settings.

With an API key. Devin's docs say that for a server expecting a static token, "use headers (HTTP)":

{
  "mcpServers": {
    "shareglint": {
      "url": "https://shareglint.com/mcp",
      "headers": { "Authorization": "Bearer sk_live_…" }
    }
  }
}

Use a key made only for this machine, and put this version in ~/.config/devin/mcp_config.json or .devin/mcp_config.local.json — never in a committed project file. Devin documents ${env:VAR} expansion for OAuth fields; we found no statement that it applies to headers in Devin Local, so we do not rely on it here.

Check it. In Customize → MCPs, the server's toggle should be on and its tools listed; the panel can also open the config file and refresh the list. By default Devin Local "prompts for approval before calling any MCP tool" (permissions), which is a sensible default for render_image, take_screenshot and create_batch, since they spend quota.

User or project config?

~/.config/devin/mcp_config.json applies to every project on your machine. .devin/mcp_config.json in a repository applies to that project and is meant to be shared, so give it the OAuth-only entry (just the url), which contains nothing secret: each developer then signs in with their own Shareglint account. If someone prefers an API key, the header version belongs in .devin/mcp_config.local.json, which stays on their machine. That way nobody's key ends up in the repository, and revoking one person's access touches nobody else.

If you still use Cascade

The legacy Cascade agent kept its servers in ~/.codeium/windsurf/mcp_config.json, with serverUrl (or url) for a remote server and ${env:VAR} interpolation allowed in headers — per the Cascade page that survives in Devin's docs, which says that config applies only to Cascade (Cascade MCP, German version):

{
  "mcpServers": {
    "shareglint": {
      "serverUrl": "https://shareglint.com/mcp",
      "headers": { "Authorization": "Bearer ${env:OG_API_KEY}" }
    }
  }
}

The same page states a limit of 100 tools across all servers for Cascade; Shareglint adds a handful.

Teams and Enterprise

Admins can control MCP for the whole organisation: Allow MCP turns it on or off for members, and an MCP allowlist names the servers members may use — "once a single server is allowlisted, all other servers are blocked" (Devin admin controls). If the server does not show up on a company machine, ask your admin to add it, with the same name as in mcp_config.json.

What the agent can do with it

• Wire og:image into a project with signed URLs: create_signed_url gives a correct example, the agent writes the signing helper and a test against it (signed URLs guide).
• Check a design by rendering the card for a few real titles before committing.
• Backfill images for existing content with create_batch and get_batch.
• Screenshot a deployed page for docs or a pull request with take_screenshot.

Keep "never put the API key in application code" in your prompts: pages should use signed URLs, which need the account id and signing secret, not the key.

Troubleshooting

• Authentication fails or expired. Click Authenticate again in the MCPs panel; it clears stored credentials and reruns the browser sign-in.
• 401 with an API key. The key in headers is mistyped or revoked; test it with curl -s https://shareglint.com/mcp -H "Authorization: Bearer sk_live_…" -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'.
• take_screenshot fails on localhost. Our screenshot browser only reaches public addresses; use a preview deployment.
• quota_exceeded. get_usage shows what is left; calls stop at the limit and are never billed as overage (pricing).

Cost

One render per image and size, repeats free, create_signed_url free until the image is first fetched. The Free plan's 100 renders a month carry a watermark; Starter is $9 a month for 2,000 renders. Your Devin plan is separate.