Add Gazebo to Windsurf as an MCP server so your agent can retrieve credentials from the vault during development sessions.

Prerequisites

• A Gazebo account with at least one service connected
• An agent created in Gazebo with a bearer token

Configuration

Open Windsurf settings and navigate to MCP Servers. Add a new server with the following configuration:

{
  "mcpServers": {
    "gazebo": {
      "url": "https://app.gazebohq.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <your-agent-token>"
      }
    }
  }
}

Replace <your-agent-token> with the token from your agent's page in the Gazebo dashboard.

Alternatively, if Windsurf reads from a config file, add the gazebo entry to your existing mcpServers object.

Verify the connection

Ask Cascade (Windsurf's AI) to call get_identity:

get_identity()
→ {
    status: "ok",
    name: "windsurf-agent",
    accessible_services: [
      { service: "vercel", allowed_methods: ["GET", "POST"] }
    ]
  }

Retrieve a credential

get_credential({ service: "vercel", method: "POST" })
→ "..."

Cascade can now use this token to interact with the Vercel API — deploying projects, setting environment variables, and so on — within the permitted methods.

Troubleshooting

Server not visible in Cascade — Restart Windsurf after updating the MCP configuration.

401 Unauthorized — The bearer token is invalid. Verify it in the Gazebo dashboard and regenerate if needed.

get_credential denied — The requested method isn't in the access profile. Update it in the Gazebo dashboard before retrying.