Windsurf (Devin Desktop)

Add Thirdfy to Windsurf so its agent can read markets and act for your agent, within the limits you set. Windsurf is now called Devin Desktop, and its default agent is Devin Local. The steps below work for Devin Local and for the older Cascade agent. See Devin's MCP configuration docs.

Sign in with Thirdfy

Add Thirdfy to ~/.config/devin/mcp_config.json (all projects; %APPDATA%\devin\mcp_config.json on Windows), with no headers. For one project, use .devin/mcp_config.json instead.

{
  "mcpServers": {
    "thirdfy": {
      "url": "https://mcp.thirdfy.com/mcp"
    }
  }
}

Save the file. In the Devin Local MCP list, thirdfy shows Needs auth. Click Authenticate to open the Thirdfy sign-in page. With the Devin CLI, run devin mcp login thirdfy instead. Then:

1. Sign in with the same method you use on thirdfy.com (email, Google or wallet).
2. Pick the agent Devin acts for, or click + Create a new agent.
3. Choose access: Read (always), Trade within your agent's limits, and Stay connected (up to 30 days). Click Approve.

Manage or revoke the connection at auth.thirdfy.com/connections. For what a signed-in app can do, see Connect.

To look around first with no account, use https://mcp.thirdfy.com/mcp/public instead. It covers the catalog, public signal reads and help.

Agent key header

Get an agent key

Open thirdfy.com/connect, go to Agent key, pick the agent and click Create a key. The key (agent-...) is shown once, so store it right away.

Add the key as a header

Keep the key in an environment variable and reference it from mcp_config.json:

{
  "mcpServers": {
    "thirdfy": {
      "url": "https://mcp.thirdfy.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:AGENT_API_KEY}"
      }
    }
  }
}

Set AGENT_API_KEY in the environment Devin Desktop starts from, then restart it. An unset variable becomes an empty string, so Thirdfy answers 401. Don't paste the key into chat, and don't commit it: for a team repo, put the header in .devin/mcp_config.local.json, which is gitignored.

Try it

Using Thirdfy:
1. List the OpenMarket actions.
2. Run get_openmarket_btc_funding and summarize it.
3. Check if my Hyperliquid venue is ready to trade.

Devin Local asks before it calls any MCP tool. You can allow one tool or the whole server, for the session or for good. Allow read tools freely, and keep trades on ask. Before a write:

1. getVenueReadiness lists anything that blocks the venue.
2. Preview the action with previewOrder.
3. Run it with walletExecute.

Thirdfy refuses any write that fails its checks (allowlist, daily limit, venue readiness, credits). The older Cascade agent runs MCP tools without asking, so rely on your agent's policy in Thirdfy there.

Troubleshooting

Related

• MCP client guides
• Cursor
• Tools reference