Windsurf (Devin Desktop)

What it does

The Devin Local agent (Devin Desktop's default agent, and Devin CLI) reads your Brands and tokens, exports them as code and proposes token changes for a person to approve. The tools are listed at /docs/mcp.

Before you start

• A Stoaken account with at least Viewer on a Brand. On the Free plan agents are read only.
• Devin Desktop (Windsurf became Devin Desktop on 2 June 2026) with the Devin Local agent, or Devin CLI.
• Optional: an API key from Settings > API keys.

Setup

npx stoaken init --client windsurf

This writes .devin/mcp_config.json, keeping any other servers. Open the project in Devin Desktop. When stoaken shows Needs auth in the Devin Local MCP list, click Authenticate and sign in in the browser, or run devin mcp login stoaken. Devin Local asks before each MCP tool call.

Configuration

.devin/mcp_config.json (project, shared through git). No secret, safe to commit:

{
  "mcpServers": {
    "stoaken": { "url": "https://www.stoaken.com/mcp" }
  }
}

Devin's docs describe no variable expansion in MCP headers, so an API key never goes in this file. Put it in the gitignored local override instead, which replaces the project entry for you only:

devin mcp add -s local stoaken https://www.stoaken.com/mcp -H "Authorization: Bearer $STOAKEN_API_KEY"

Legacy Cascade agent: it reads only the user file ~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows), with serverUrl and ${env:...} expansion: "stoaken": { "serverUrl": "https://www.stoaken.com/mcp" }, or add "headers": { "Authorization": "Bearer ${env:STOAKEN_API_KEY}" } (Cascade MCP).

Try it

• "Using Stoaken, export the Default theme as CSS into src/styles/tokens.css."
• "Which Stoaken tokens are deprecated, and where does this repo still use them?"

Troubleshooting

• Server missing: older Devin Local (before v3000.3) reads mcpServers from .devin/config.json; update, or move the entry there.
• Needs auth keeps coming back: devin mcp logout stoaken, then devin mcp login stoaken.
• Restricted Mode: agents are off in an untrusted workspace; trust it.
• Blocked on an enterprise team: an admin allowlist or enforced MCP registry blocks servers not on it; ask for stoaken.

Limits

• No tool approves or publishes a release.
• Writes count towards a per-key limit; Free plan is read only.
• Each Devin client signs in separately (Desktop, CLI and other tools don't share OAuth sessions).