Hooklistener

MCP setup · Windsurf

Hooklistener MCP server for Windsurf (Devin Desktop)

Open Cascade's … menu, click Open MCP config file in the MCPs section, and add Hooklistener under mcpServers with a serverUrl pointing at https://app.hooklistener.com/api/mcp. Windsurf became Devin Desktop on June 2, 2026; Cascade and its MCP config work the same way. Once connected, Cascade can create webhook URLs, wait for events and replay them while it edits your code.

Setup checked against Devin Desktop (Windsurf) docs, September 2026

mcp_config.json
{
  "mcpServers": {
    "hooklistener": {
      "serverUrl": "https://app.hooklistener.com/api/mcp"
    }
  }
}
Open config
Cascade … menu → MCPs → Open MCP config file
URL field
serverUrl
Sign-in
OAuth, or an API key in headers
Env vars
${env:NAME}
Tool limit
100 tools across all servers

Setup

Connect Windsurf step by step

  1. 01

    Open the MCP config

    Click the … (Actions) menu at the top right of the Cascade panel, then the Open MCP config file icon in the MCPs section. Opening it this way lands you in the file your install actually reads. Cascade has no one-click MCP install.

  2. 02

    Add Hooklistener

    Add an entry with serverUrl. Remote servers need no command or type.

    mcp_config.json
    {
  "mcpServers": {
    "hooklistener": {
      "serverUrl": "https://app.hooklistener.com/api/mcp"
    }
  }
}
  3. 03

    Sign in

    The docs say Cascade supports OAuth on every transport, so this entry should prompt a browser sign-in to Hooklistener. If your build doesn't start one, use the API key variant under Troubleshooting.

  4. 04

    Check the tools

    In the MCPs section of the … menu, hooklistener should be switched on with its tools listed. You can switch individual servers off there.

Read-only access

Cascade has no OAuth scope setting, so the grant is full access. What you can control is which tools Cascade sees: list tools like delete_endpoint and replay_request in the server's disabledTools array.

mcp_config.json
{
  "mcpServers": {
    "hooklistener": {
      "serverUrl": "https://app.hooklistener.com/api/mcp",
      "disabledTools": ["delete_endpoint", "delete_request", "replay_request"]
    }
  }
}

Try it

What to ask Windsurf

Plain-language requests work; Windsurf picks from Hooklistener's 67 tools. These are the ones each prompt usually calls.

Create an endpoint for PayPal webhooks, wait for the next PAYMENT.CAPTURE.COMPLETED and write a TypeScript type for the payload.

Cascade types the handler from a real payload instead of the docs.

  • create_endpoint
  • wait_for_request
  • get_request

Alert #payments in Slack whenever a PAYMENT.CAPTURE.DENIED webhook hits this endpoint.

Matching requests go to Slack or a signed webhook. Slack alert channels are on paid plans.

  • set_endpoint_alerts

Turn today's captured webhooks into replay cases and run them against localhost after this refactor.

A regression check built from real traffic.

  • save_request_case
  • run_endpoint_cases
  • wait_for_case_run

Store our Stripe signing secret and verify the last three deliveries.

Secrets are stored in Hooklistener and referenced by id, never pasted into prompts. Paid plans.

  • create_secret
  • verify_request_signature

Troubleshooting

When Windsurf doesn't connect

Cascade drops tools or refuses to add the server
Cascade can use 100 tools in total. A new Hooklistener workspace lists 26 and more toolsets appear as you use them, so with other servers you can hit the cap. Put tools you don't need in disabledTools, or switch other servers off.
No OAuth sign-in appears
Use an API key instead. Create one under Organization Settings → API Keys, export it, and reference it with ${env:NAME}. API keys always have full access.
mcp_config.json
{
  "mcpServers": {
    "hooklistener": {
      "serverUrl": "https://app.hooklistener.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${env:HOOKLISTENER_API_KEY}"
      }
    }
  }
}
Your team plan blocks the server
When an admin allowlists any MCP server, every server not on the allowlist is blocked. Ask them to add Hooklistener's URL.
Old guides mention ~/.codeium/windsurf/mcp_config.json
Paths have shifted with the Devin Desktop rename, and the docs list more than one location. Open the file from the Cascade menu instead of guessing a path.

FAQ

Windsurf and Hooklistener: common questions

Is Windsurf now Devin Desktop?

Yes. Cognition renamed Windsurf to Devin Desktop on June 2, 2026. It's the same editor and Cascade agent, delivered as an update, and remote MCP servers are configured the same way.

Does Windsurf use serverUrl or url for remote MCP servers?

The Cascade docs' remote example uses serverUrl, so use that.

Does Windsurf support OAuth for MCP?

The Devin Desktop docs say Cascade supports OAuth for each transport type. If sign-in doesn't start for you, an hklst_ API key in headers works as a fallback.

How many tools can Cascade use?

100 across all enabled servers. Hooklistener lists 26 tools for a new workspace and up to 67 as you use more products, so use disabledTools if you run several servers.

Keep going

More on the MCP server

Server URL: https://app.hooklistener.com/api/mcp

Other clients

Set up Hooklistener in another tool

Give Windsurf a webhook URL it can watch

The free plan includes the MCP server, 1 debug endpoint, 1 email inbox and 1 uptime monitor. No credit card.

Start freeSee all MCP tools