Windsurf

Why scan Windsurf?

Windsurf drives multi-step edits with filesystem authority, so an MCP server it can call is reachable from an autonomous run rather than only from a prompt you type.

Usage

CallLint can auto-discover and scan Windsurf configurations:

calllint scan --agent windsurf

How to start

Install nothing globally — run CallLint straight from npm:

npx calllint scan --auto

Then scan Windsurf specifically:

calllint scan --agent windsurf

How to verify it worked

Look at what each server can write. Under an agent that edits without a per-step confirmation, write authority is the finding that matters most.

What CallLint does to Windsurf

Offline by default. Deterministic. Never executes the server it judges. SAFE means no blockers observed, not a proof of runtime safety.

A No blockers observed verdict means exactly that — no blocker under the evidence CallLint could collect. It is not a guarantee, and Insufficient evidence never becomes it on its own. See Coverage Boundary for what this scan does not look at.

Configuration Paths

CallLint looks for Windsurf configurations in:

• ~/.windsurf/mcp.json
• <project>/.windsurf/mcp.json

Authority Surfaces

Windsurf can grant tools the following authority surfaces:

• mcp
• filesystem

Distribution

CallLint is available for Windsurf through:

• mcp-stdio (via officialMcpRegistry) — Listing not yet verified
• windsurf-mcp-marketplace — Not available here
  ⚠️ No public submission path exists. Audited 2026-08-27: the MCP documentation describes installing from the marketplace, adding anything missing by hand-editing `mcp_config.json`, and deep-linking an existing listing via `windsurf://windsurf-mcp-registry?serverName=`, but it documents no form, PR target, or intake URL by which a third party gets listed. Listings carrying a blue check are described as made by the parent service company, with no path given to obtain one. Blocked on the absence of a channel, not on a queue — so this is not a to-do, and there is nothing to wait for either. Two adjacent facts worth keeping: the windsurf.com docs now 307-redirect to `docs.devin.ai/desktop/...`, so this host ships as Devin Desktop and the old `codeium.com/windsurf` source is stale; and enterprise teams may point Cascade at a custom registry that must follow the official MCP registry schema, which CallLint is already published to. That makes this host reachable per-team through a registry we already satisfy, which is a different mechanism from a public listing and is why the row stays blocked rather than pending.

Support Status

Auto-detects — CallLint finds this host’s config on its own.

The commands under Usage are the ones CallLint actually supports for Windsurf today. Anything not listed there is not claimed.

Official Sources

• https://codeium.com/windsurf