Windsurf

Windsurf (by Codeium) supports MCP servers via a JSON config file. Register Perfai globally so it’s available across all workspaces, or add it per-project.

No credentials are required in the config. Calling login opens a browser to Perfai’s own sign-in page (OAuth) and completes automatically — see Login below.

Global installation

macOS / Linux
Windows

File: ~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "perfai-cloud-mcp": {
      "command": "npx",
      "args": ["-y", "perfai-cloud-mcp"]
    }
  }
}

Create the file if it doesn’t exist:

mkdir -p ~/.codeium/windsurf
touch ~/.codeium/windsurf/mcp_config.json

File: %USERPROFILE%\.codeium\windsurf\mcp_config.json

{
  "mcpServers": {
    "perfai-cloud-mcp": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "perfai-cloud-mcp"]
    }
  }
}

Create the file if it doesn’t exist (run in PowerShell):

New-Item -Path "$env:USERPROFILE\.codeium\windsurf\mcp_config.json" -Force

Windows needs the cmd /c wrapper because npx is a .cmd shim, not a real executable — without it you’ll see spawn npx ENOENT.

Project-scoped installation

Add .windsurf/mcp.json to your project root:

{
  "mcpServers": {
    "perfai-cloud-mcp": {
      "command": "npx",
      "args": ["-y", "perfai-cloud-mcp"]
    }
  }
}

Prefer not to use the browser login (headless machines, CI)? Create a Perfai API key and add "env": { "PERFAI_API_KEY": "pfk_xxxxxxxxxxxx_..." } to the perfai-cloud-mcp entry. If you do, don’t commit .windsurf/mcp.json — add it to .gitignore, or keep the key in the global config instead.

Enable the server in Windsurf

After saving the config:

Open Windsurf Settings → MCP Servers.
Confirm perfai-cloud-mcp appears and shows a connected status.
If it shows as disconnected, click Restart.

Alternatively, use the Windsurf command palette and search for “MCP: Refresh Servers”.

The prompts below run inside the Windsurf Cascade chat, not your terminal. The only terminal/file steps are creating the config file.

In the Windsurf AI panel (Cascade), type:

Login to Perfai

This opens a browser to Perfai’s sign-in page (or uses PERFAI_API_KEY if you set it). Confirm with:

What's my Perfai auth status?

Register an app and run a scan

Register https://your-app.example.com with Perfai

Check the onboarding status for that app

Run a security test on the selected app

Show me the vulnerabilities it found

Fix and verify

One at a time:

Show me how to fix vulnerability 3

All at once, prioritized by severity:

Auto-fix all critical and high vulnerabilities

Then confirm the fixes landed:

Mark vulnerability 3 as fixed

Give me the fix summary

Getting Started

Core Concepts

Hybrid Deployment

Changelog

Global installation

Project-scoped installation

Enable the server in Windsurf

Register an app and run a scan

Fix and verify

​Global installation

​Project-scoped installation

​Enable the server in Windsurf

​Login

​Register an app and run a scan

​Fix and verify

Global installation

Project-scoped installation

Enable the server in Windsurf

Login

Register an app and run a scan

Fix and verify