Pocketsflow MCP Setup for Windsurf (Now Devin Desktop)

To set up Pocketsflow MCP in Windsurf, add https://www.pocketsflow.com/mcp to Windsurf's mcp_config.json under the name pocketsflow, press refresh, then sign in to Pocketsflow and click Allow access. No API key is needed, and Windsurf's agent then has 303 Pocketsflow tools for products, checkout, orders, webhooks and more.

One thing changed this year: Windsurf is now called Devin Desktop. The Pocketsflow setup still works, but the config file moved, so this guide gives both paths.

Windsurf is now Devin Desktop: what changes for Pocketsflow

Cognition renamed Windsurf to Devin Desktop on June 2, 2026, and made Devin Local the successor to the Cascade agent. Plans, pricing and extensions stayed the same, and the update arrived on its own. For the Pocketsflow connection, only the location of the MCP file matters:

• Current builds: ~/.config/devin/mcp_config.json on macOS and Linux, and %AppData%/devin/mcp_config.json on Windows.
• Older Windsurf builds: ~/.codeium/windsurf/mcp_config.json. The editor still reads this file for MCP discovery.

You don't need to guess the path. The MCP settings in both versions have a button that opens the right file for your install. Edit that one.

How to connect Pocketsflow to Windsurf

1. Create a free Pocketsflow account, or sign in to the one you sell with. Switch the dashboard to test mode if you want the agent on sandbox data while you build.
2. Open the MCP config file. In Devin Desktop, open the Customize page from the Agents window, click MCPs and open the config file. In an older Windsurf build, open Cascade's MCP menu and choose Open MCP config file.
3. Add the Pocketsflow server: { "mcpServers": { "pocketsflow": { "serverUrl": "https://www.pocketsflow.com/mcp" } } }. Windsurf accepts serverUrl or url for a remote server.
4. Save the file and press the refresh button in the MCP list.
5. Your browser opens Pocketsflow. Sign in, check which app is asking, and click Allow access.
6. In Cascade, ask: “Show my Pocketsflow account and what I sell.”

That last prompt calls get_account. If the agent answers with your store, the connection works. Pocketsflow creates an API key named “MCP: <app>” for the connection, in the mode your dashboard was in when you clicked Allow. Delete that key under Developers > API keys to disconnect Windsurf.

Pocketsflow with an API key, for headless Windsurf setups

Pocketsflow also accepts an API key in a header, for CI or a machine with no browser to sign in from. Create a key under Developers > API keys and use: { "mcpServers": { "pocketsflow": { "serverUrl": "https://www.pocketsflow.com/mcp", "headers": { "Authorization": "Bearer pk_test_..." } } } }

A pk_test_ key works on sandbox data, and a pk_live_ key works on real products and customers. With this variant the key sits in the config file, so keep that file out of shared repos. Sign in with OAuth whenever you can.

Add a Pocketsflow rule to your Windsurf workspace

Windsurf is a code editor, so most Pocketsflow users there are building a checkout into their own app. A workspace rule gives the agent the facts it needs to write that code. Create .windsurf/rules/pocketsflow.md at the workspace root with these points from the Pocketsflow docs:

• Base URL https://api.pocketsflow.com, with Authorization: Bearer <API key>. Keys and webhook secrets live in env vars, never in client code.
• POST /checkout/sessions returns { id, url }. Redirect the buyer to url, and put your own order id in metadata.
• Verify the X-Pocketsflow-Signature header, an HMAC-SHA256 over the raw body. Confirm payment from order.completed, and make handlers idempotent.

Devin Desktop still imports rules from .windsurf/rules/ by default, so the file keeps working after the rename. New projects can use .devin/rules/ instead.

The Pocketsflow tools a Windsurf integration uses

Pocketsflow exposes 303 tools in 48 groups. A developer wiring checkout into an app mostly needs 6 of those groups, 32 tools in all. The chart shows each one.

Webhooks alone are 6 tools, including test_webhook, which lets the agent fire a test event at your handler without a real sale. The other groups, such as newsletters, memberships and analytics, stay available when you ask for them.

Prompts to paste into Windsurf

Each Pocketsflow prompt below names the tools the agent calls, so you can check the tool panel.

1. “Create a $29 product called Starter Kit and give me the checkout link.” Calls create_product and create_checkout_session.
2. “Add a webhook for order.completed pointing to my staging URL, then send a test event.” Calls create_webhook and test_webhook.
3. “List my last 10 orders and show the payment details of the newest one.” Calls list_orders and get_order_payment_details.
4. “Find the license key for this customer and reset its activations.” Calls list_license_keys and reset_license_key_activations.
5. “Which plan am I on, and can I use upsells?” Calls get_entitlements.

A good loop for a new integration: plan the checkout and webhook flow with the agent, create a test product and checkout session in test mode, then send a test event and confirm your handler settles the order once.

What stays in the Pocketsflow dashboard

Pocketsflow keeps money movement out of every AI agent, Windsurf included. Payouts are read only over MCP, so withdrawing and bank details stay in the dashboard. Payment refunds are issued from the dashboard too: the create_refund tool sets a refund policy and never returns money. Plans can't be bought through MCP. If a tool needs a higher plan, it returns FEATURE_LOCKED and the agent sends you to billing.

When to use Pocketsflow MCP in Windsurf, and when not to

Pocketsflow MCP in Windsurf is best for setup and checks: creating test products, wiring webhooks, and reading orders while you code. Your production app should call the Pocketsflow API directly with a server key, not through an editor agent. For that split, read MCP vs API for selling online. If you also use Cursor, the Cursor setup guide covers the same server. Every app's steps are on the Pocketsflow MCP page.