Windsurf now redirects to Devin Desktop: where Sume MCP setup lives
Windsurf redirects to Devin Desktop, and Cascade was removed in v3.9.19. Re-add Sume's hosted MCP URL there and verify it with mcp_health and tools_list.

Windsurf now redirects to Devin Desktop, so a Sume MCP setup that lived in Windsurf should be added again in Devin Desktop with the same URL, https://mcp.sume.com/mcp, and then verified with mcp_health and tools_list.
The Devin Desktop changelog is the source for what changed.
What the changelog says
The changelog entries listed above are the full extent of what this post relies on. For the exact settings screen, use the in-app documentation.
| Entry | What it says |
|---|---|
| Redirect | Windsurf now redirects to Devin Desktop. |
| v3.10.48 (Sep 29) | Adds ChatGPT sign-in. |
| v3.9.19 | Removed Cascade, making Devin Local the only agent. |
| MCP | MCP from plugins and projects is supported. |
Add Sume again
Sume exposes a hosted remote MCP endpoint, and the quickstart's guidance for generic HTTP clients applies. Point a streamable HTTP MCP server at the production URL, then run that client's OAuth login for the configured server name.
The client should discover Sume's protected-resource metadata from the endpoint and send you to https://mcp.sume.com/oauth/authorize, which continues to the consent page on the MCP host.
https://mcp.sume.com/mcpVerify before you trust it
With Cascade gone and Devin Local as the only agent, check that the agent you will actually use can see Sume's tools.
- Ask it to call
mcp_healthand check the auth source. - Ask it to call
tools_listand summarize the tools it sees. - If only read tools appear, Write was off at consent; grant
mcp:writefor paid tools. - Run one paid tool with
dry_run=truebefore any real generation.
Credentials still follow the same rules
Changing editors does not change how Sume treats credentials. OAuth tokens and API keys are different things, and sume login does not broker hosted MCP tokens. An API key works for automation and sees the full tool set, but it should not be pasted into chat.
Paid and write calls need an idempotency_key whichever agent makes them. Keep the key stable across a retry of the same request.
Jobs you started earlier
A move between tools does not affect jobs already submitted. They are durable on Sume's side. Read jobs_list and jobs_status with the ids you saved, and do not resubmit a paid request because the editor changed.
Sources
Related posts
More in Developers
- Workers post-quantum Web Crypto: Sume webhooks stay HMAC-SHA-256
Cloudflare Workers Web Crypto now supports ML-KEM and ML-DSA. Sume webhook signatures are still HMAC SHA-256, and verifyWebhook runs on Workers with WebCrypto.
- Workflow DevKit 5 fail-fast refusals: which Sume errors to retry
Workflow DevKit 5.0.1 now fails fast on dynamic start() refusals. Apply the same rule to Sume: do not retry a 400 or 402, retry 429 and 503 with the same key.
- Workflow DevKit 5: 12 MiB frames, pass Sume URLs not video
Workflow DevKit 5.0.1 splits WebSocket frames over 12 MiB by default (16 MiB at most). Pass Sume artifact URLs between steps instead of video bytes.
- Workflow DevKit replays: a stable Idempotency-Key for Sume submits
Workflow DevKit 4.8.12 fixed replay clock tracking. A replayed step must send the same Sume Idempotency-Key, so derive it from the run id, not Date.now.
Written by Sume