This guide wires a SmeltSec-generated MCP server into Windsurf, Codeium's AI editor. It covers where Windsurf stores its MCP config, the CLI commands that scaffold and scan the server, the exact JSON block to add, and how to confirm Cascade picks up the tools.
The current CLI package accepts Node.js 22.22.2 through 22.x, 24.15.0 through 24.x, or 26 and later. You also need a Windsurf build with MCP support and an API or OpenAPI spec you want to expose as tools. Windsurf spawns MCP servers as child processes using stdio, so the setup closely mirrors Cursor. If you have done Cursor, Windsurf takes two minutes.
Windsurf stores its MCP server list in a per-user JSON file. The exact filename varies by release; recent builds use mcp_config.json. The current @smeltsec/sync writer instead targets ~/.windsurf/mcp.json, so use the manual client path below until those locations are reconciled.
You can also reach the file from inside the editor: Settings > Windsurf Settings > MCP Servers > Open Config. If the file does not exist, the UI creates it. Verify the filename against the Codeium docs before hand-editing, since the exact name has shifted between releases.
The public npm release is 0.1.0. Pin that version so the commands in this guide match your installed CLI. Review its package files and dependencies before installation.
npm install -g @smeltsec/cli@0.1.0 smeltsec --version
The version print confirms the install worked. Windsurf spawns MCP servers with the editor's own PATH. If you plan to call smeltsec from within the editor, the binary must resolve there too.
smeltsec init interactively scaffolds the project and asks for an output directory. smeltsec ci evaluates that directory against configured security and quality thresholds. Review blocking findings before moving on.
smeltsec init smeltsec ci ./my-server --output ./my-server/smeltsec-ci.json cd my-server npm run build
The built server lives at dist/server.js. Copy the absolute path.
Windsurf expects an mcpServers object. Each entry has command, args, and an optional env map. The schema lines up with Cursor and Claude Desktop.
{
"mcpServers": {
"my-server": {
"command": "node",
"args": ["/Users/you/projects/my-server/dist/server.js"],
"env": {
"API_KEY": "sk-..."
}
}
}
}Save the file. Windsurf watches this path and picks up changes on the next reload. Commit the config to version control only if every team member can resolve the args path; otherwise keep it per-user.
Run the command Developer: Reload Window from the palette, or quit and relaunch. Open Cascade. Click the hammer icon in the composer. The server name appears as a group header with every registered tool underneath.
Type a prompt that exercises one tool by name. Cascade picks it up, shows the tool call block, and renders the response inline. If no tools appear, the server failed to start; head to troubleshooting.
Open Settings > Windsurf Settings > MCP Servers. If your server is not listed, your JSON has a typo. Validate mcp_config.json with jq . and fix the syntax. Reload the window.
The process started and crashed before responding to tools/list. Check ~/.codeium/windsurf/logs/mcp.log for stderr output. Most of the time this is a missing env var that the scan run caught earlier.
The model did not think the tool was relevant. Name the tool directly in your prompt, or pin it from the hammer menu so Cascade prefers it for the rest of the chat.
dist/server.js needs execute permission via node, not via a direct shebang. If you wrote a shell wrapper, run chmod +x on it. If Windsurf still fails, check that the path in args is readable by your user account.
Free tier includes Gate 1 scanning and 5 generations per month.