Skip to main content

Windsurf with Keeptrusts

Windsurf Cascade supports remote streamable HTTP MCP servers. This makes Keeptrusts tools available to Cascade; it does not reroute Windsurf's hosted model traffic.

Configure the remote MCP server​

In Windsurf, open Settings → Tools → Windsurf Settings → Add Server, then use View Raw Config. This avoids relying on a configuration-file path that has changed between Windsurf releases.

{
  "mcpServers": {
    "keeptrusts": {
      "serverUrl": "https://<published-hostname>/mcp",
      "headers": {
        "Authorization": "Bearer ${env:KEEPTRUSTS_MCP_TOKEN}"
      }
    }
  }
}

Set the variable before launching Windsurf:

export KEEPTRUSTS_MCP_TOKEN="<client-api-token>"

Refresh the MCP list after saving, then enable only the Keeptrusts tools your workflow needs. Team and Enterprise administrators may also need to allow this server in Windsurf's MCP controls.

See Windsurf's Cascade MCP documentation for the current UI, allowlist, and interpolation rules.

Model-traffic boundary​

MCP configuration governs MCP tool calls only. Do not infer that Cascade chat or completion prompts traverse Keeptrusts. Verify any separately supported custom model endpoint by watching kt events tail --follow.

Next steps​