# Windsurf MCP, now Devin Desktop: OG images and screenshots from the agent

> Windsurf is now Devin Desktop. Add the image API as a remote MCP server in mcp_config.json — OAuth or an API key header — for Devin Local or Cascade.

Published 2026-11-06 · https://shareglint.com/en/mcp/windsurf

Windsurf's agent can render Open Graph images, take website screenshots and write the code that uses them once Shareglint is in its MCP config. One thing first: **Windsurf has been renamed Devin Desktop.** Its documentation now lives at docs.devin.ai, new conversations start with the **Devin Local** agent, and "Cascade is the legacy agent in Devin Desktop" ([Devin docs](https://docs.devin.ai/desktop/cascade), read 2026-11-06). The setup below is for Devin Local, with a note for Cascade.

The tools — `render_image`, `get_image`, `list_templates`, `get_template`, `create_signed_url`, `get_usage`, `generate_template`, `take_screenshot`, `auto_og_url`, `create_batch`, `get_batch` — run on your account and quota, 100 renders a month on the Free plan. For what an MCP server is, see [what is an MCP server](https://shareglint.com/en/guides/what-is-an-mcp-server).

## Set it up in Devin Local

Devin Local reads MCP servers from `~/.config/devin/mcp_config.json` (your user), `.devin/mcp_config.json` (a project) or `.devin/mcp_config.local.json` (a project, not committed), and "supports the stdio, Streamable HTTP, and SSE transports, and OAuth for each" ([Devin docs: customizations](https://docs.devin.ai/desktop/devin-local/customizations)). The config format is shared with the Devin CLI: servers under `mcpServers`, a remote one with a `url` and optional `headers` ([Devin CLI: MCP configuration](https://docs.devin.ai/cli/extensibility/mcp/configuration)).

**With OAuth (simplest).** Add only the URL:

```json
{
  "mcpServers": {
    "shareglint": {
      "url": "https://shareglint.com/mcp"
    }
  }
}
```

Open **Customize → MCPs** in the Agents window. The server appears under *This computer*; click **Authenticate**, sign in to Shareglint in the browser and approve. No key is stored in the file or your environment, and you can disconnect the app later from your Shareglint account settings.

**With an API key.** Devin's docs say that for a server expecting a static token, "use `headers` (HTTP)":

```json
{
  "mcpServers": {
    "shareglint": {
      "url": "https://shareglint.com/mcp",
      "headers": { "Authorization": "Bearer sk_live_…" }
    }
  }
}
```

Use a key made only for this machine, and put this version in `~/.config/devin/mcp_config.json` or `.devin/mcp_config.local.json` — never in a committed project file. Devin documents `${env:VAR}` expansion for OAuth fields; we found no statement that it applies to `headers` in Devin Local, so we do not rely on it here.

**Check it.** In **Customize → MCPs**, the server's toggle should be on and its tools listed; the panel can also open the config file and refresh the list. By default Devin Local "prompts for approval before calling any MCP tool" ([permissions](https://docs.devin.ai/desktop/devin-local/permissions)), which is a sensible default for `render_image`, `take_screenshot` and `create_batch`, since they spend quota.

## User or project config?

`~/.config/devin/mcp_config.json` applies to every project on your machine. `.devin/mcp_config.json` in a repository applies to that project and is meant to be shared, so give it the OAuth-only entry (just the `url`), which contains nothing secret: each developer then signs in with their own Shareglint account. If someone prefers an API key, the header version belongs in `.devin/mcp_config.local.json`, which stays on their machine. That way nobody's key ends up in the repository, and revoking one person's access touches nobody else.

## If you still use Cascade

The legacy Cascade agent kept its servers in `~/.codeium/windsurf/mcp_config.json`, with `serverUrl` (or `url`) for a remote server and `${env:VAR}` interpolation allowed in `headers` — per the Cascade page that survives in Devin's docs, which says that config applies only to Cascade ([Cascade MCP, German version](https://docs.devin.ai/de/desktop/cascade/mcp)):

```json
{
  "mcpServers": {
    "shareglint": {
      "serverUrl": "https://shareglint.com/mcp",
      "headers": { "Authorization": "Bearer ${env:OG_API_KEY}" }
    }
  }
}
```

The same page states a limit of 100 tools across all servers for Cascade; Shareglint adds a handful.

## Teams and Enterprise

Admins can control MCP for the whole organisation: **Allow MCP** turns it on or off for members, and an **MCP allowlist** names the servers members may use — "once a single server is allowlisted, all other servers are blocked" ([Devin admin controls](https://docs.devin.ai/desktop/controls)). If the server does not show up on a company machine, ask your admin to add it, with the same name as in `mcp_config.json`.

## What the agent can do with it

- **Wire og:image into a project** with signed URLs: `create_signed_url` gives a correct example, the agent writes the signing helper and a test against it ([signed URLs guide](https://shareglint.com/en/guides/signed-image-urls)).
- **Check a design** by rendering the card for a few real titles before committing.
- **Backfill** images for existing content with `create_batch` and `get_batch`.
- **Screenshot a deployed page** for docs or a pull request with `take_screenshot`.

Keep "never put the API key in application code" in your prompts: pages should use signed URLs, which need the account id and signing secret, not the key.

## Troubleshooting

- **Authentication fails or expired.** Click **Authenticate** again in the MCPs panel; it clears stored credentials and reruns the browser sign-in.
- **`401` with an API key.** The key in `headers` is mistyped or revoked; test it with `curl -s https://shareglint.com/mcp -H "Authorization: Bearer sk_live_…" -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'`.
- **`take_screenshot` fails on localhost.** Our screenshot browser only reaches public addresses; use a preview deployment.
- **`quota_exceeded`.** `get_usage` shows what is left; calls stop at the limit and are never billed as overage ([pricing](https://shareglint.com/en/pricing)).

## Cost

One render per image and size, repeats free, `create_signed_url` free until the image is first fetched. The Free plan's 100 renders a month carry a watermark; Starter is $9 a month for 2,000 renders. Your Devin plan is separate.

## FAQ

### Where is the Windsurf MCP config now?

Windsurf has been renamed Devin Desktop. Its local agent, Devin Local, reads MCP servers from ~/.config/devin/mcp_config.json for your user, or .devin/mcp_config.json in a project. The old Cascade agent used ~/.codeium/windsurf/mcp_config.json.

### Does Devin Desktop support remote MCP servers with OAuth?

Yes. Devin's documentation says Devin Local supports the stdio, Streamable HTTP and SSE transports, and OAuth for each. Add the server's URL and click Authenticate to sign in.

### Can my admin block MCP servers?

On Teams and Enterprise plans, admins can turn MCP off for members or keep an allowlist; once one server is allowlisted, all others are blocked. If the server does not appear, ask your admin to allow it.

### Do I have to approve every tool call?

By default, yes: Devin Local asks for approval before calling any MCP tool. You can loosen that in its permission settings, for example for read-only tools like list_templates.