Windsurf MCP Config Validator
Paste your ~/.codeium/windsurf/mcp_config.json to validate the schema, url/serverUrl aliases, and interpolation patterns.
Your config never leaves your browser. No upload. No login.
Paste your
mcp_config.jsonYour config never leaves your browser
0 chars
Paste your mcp_config.json above to run deterministic checks.
Or click to see how it works.
What this validator checks
- •JSON syntax + line/column on errors
- •UTF-8 BOM, smart quotes, trailing commas
- •Top-level
mcpServersobject shape - •Recognizes
urlANDserverUrlas remote transport - •Both url + serverUrl set (alias collision)
- •Per-server
command/argsshape - •Env-var values must be strings
- •Windows backslash escapes
- •Insecure HTTP for non-local URLs
- •API key / token leak detection
- •Duplicate / case-conflict server names
- •Common command typos (npx, uvx, node, python)
Why this exists
Windsurf's MCP support follows the standard mcpServers schema with two notable extensions: serverUrl as an alias for url, and built-in$${env:VAR} / $${file:...} interpolation.
The most common silent failure: editing the config but forgetting to restart Cascade — Windsurf reads mcp_config.json at startup. Second most common: setting both url and serverUrl (often by copying from two different tutorials), which is redundant. The validator surfaces both.
Frequently asked
Where is Windsurf's mcp_config.json?▼
~/.codeium/windsurf/mcp_config.json — the path is the same on macOS, Linux, and Windows (Windsurf normalizes the location under your user home directory's .codeium folder). Windsurf is the Cascade IDE from the Codeium team.
What's the difference between "url" and "serverUrl" in Windsurf?▼
They're aliases per Windsurf's docs (docs.windsurf.com/windsurf/cascade/mcp). Both point to a remote MCP server's HTTP endpoint. Setting both is redundant; pick one. Some templates and tutorials use serverUrl, some use url — the validator accepts both and warns if both are set on the same server.
How do I use ${env:VAR} interpolation in Windsurf?▼
Windsurf supports two interpolation patterns inside string values: `${env:VARNAME}` reads from your environment variable, and `${file:/absolute/path}` reads the first line of a file. Most useful in headers or env values to keep API tokens out of the config file. Example: "Authorization": "Bearer ${env:GITHUB_TOKEN}". The validator does NOT execute interpolation — it leaves the literal placeholder strings in place.
Can I share my Cursor mcp.json with Windsurf?▼
Mostly yes — the top-level `mcpServers` key and command/args/env structure are identical. Differences: Windsurf accepts both `url` and `serverUrl` aliases for remote servers; Windsurf adds `${env:VAR}` and `${file:...}` interpolation; Cursor's `type:"stdio"` field is harmless extra data in Windsurf. Copying a Cursor config to Windsurf works; the reverse may need you to drop `serverUrl` in favor of `url`.
Does Windsurf support remote MCP servers with auth?▼
Yes. Use `url` (or `serverUrl`) with an http(s) URL plus a `headers` object. For auth, use ${env:TOKEN} interpolation in the headers (e.g., "Authorization": "Bearer ${env:API_TOKEN}") so the secret stays in your shell environment, not in the file.
What's the disabledTools field for?▼
Some MCP servers expose many tools. `disabledTools` lets you suppress specific tools by name without removing the server. Useful when an MCP server publishes a tool you don't want exposed to the agent. Per Windsurf's docs, it accepts an array of tool name strings.
Is my config sent to your server?▼
No. The validator runs entirely in your browser as JavaScript. Your config — and any API keys it contains — never leaves your machine. Open DevTools → Network during validation to confirm zero outbound requests.
Spotted a check we should add?
Open an issue on the directory, or browse the 2,000+ MCP servers.