Windsurf

Windsurf’s Cascade agent supports MCP servers. OpaqueVault works identically to the Claude Code integration.

---

Setup

In Windsurf, open Cascade’s MCP/plugins settings and add a custom server, or edit ~/.codeium/windsurf/mcp_config.json directly:

{
  "mcpServers": {
    "opaquevault": {
      "command": "ov",
      "args": ["mcp", "serve"]
    }
  }
}

Restart Windsurf (or refresh the MCP servers from the Cascade panel). OpaqueVault’s 8 tools will be available to Cascade.

Make sure your vault is unlocked first — run ov agent start in a terminal (foreground; keep it open) before Windsurf starts the bridge. Otherwise tool calls fail with an ov agent is not running error, and expired sessions return SESSION_LOCKED — fixes for both in troubleshooting.

---

Usage

Identical to Claude Code. Ask Cascade to run commands that need credentials — it will call vault_run automatically, and the secret values never enter the model’s context.

The interceptor runs regardless of which MCP client you use — it’s in ov mcp serve, not in the client.

Windows users

Native Windows MCP support is in development (OV-59). Until it lands, use WSL2 for Windsurf MCP integration: install OpaqueVault inside WSL2 with curl -fsSL https://get.opaquevault.com | sh, and point Windsurf’s MCP config at the WSL2-hosted ov binary.

The Windows-native CLI works today — see the installation guide.