Windsurf + xCloud

Secure sites and servers with Windsurf on xCloud

Securing sites and servers with Windsurf means asking the Devin Local agent in your editor to read xCloud's vulnerability findings and server firewall state while the project that owns the affected plugin or theme is open beside it.

Skill: xcloud:servers
Toolsets: vulnerabilities, servers, sites, wordpress-actions
Free with every xCloud account

Set up Windsurf All Windsurf guides

YouWhich sites have critical or high findings? Check the plugin names against this repo.

vulnerabilities_indexread-only

AgentOnly shop.example.com: one high finding in acme-checkout, a plugin in this repo's wp-content folder. The finding says versions below 2.4.1 are affected, and your plugin header says 2.3.8. This is your code, so the fix is a release, not an xCloud update.

YouBump it to 2.4.1 and I will redeploy. Then rescan.

sites_vulnerability-scan

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up Windsurf to Secure sites and servers on xCloud?

Connect Windsurf once; every job on this account uses the same connection. Then ask in plain words.

1
Add xCloud to the Devin Local agent
New tabs in Devin Desktop use the Devin Local agent, which reads MCP servers from the Devin CLI config files. Run this in a terminal: the URL is treated as Streamable HTTP, and the second command opens the browser for the xCloud sign-in (the agent also prompts on first use). By default the entry lands in .devin/mcp_config.local.json for the current project; add -s user to the first command to share it across projects in ~/.config/devin/mcp_config.json, where the entry reads url plus transport http.
Shell
```
devin mcp add xcloud https://app.xcloud.host/mcp
devin mcp login xcloud
```
2
Or edit the legacy Cascade config
If your tab runs the legacy Cascade agent, click the three-dot menu in the Cascade panel, then the Open MCP config file icon in the MCPs section, and add this under mcpServers. Cascade allows 100 tools in total and the full xCloud server offers 188 operations plus two search tools, so point serverUrl at the compact profile, five tools that reach every operation through search and call; a single toolset such as ?toolsets=sites (60 tools) also fits, but sites and servers together are 121 tools. Windsurf's file has been at ~/.codeium/windsurf/mcp_config.json, and the current documentation lists ~/.config/devin/mcp_config.json on macOS and Linux and %APPDATA%\devin\mcp_config.json on Windows; the icon opens the one your version reads.
JSON
```
{
  "mcpServers": {
    "xcloud": {
      "serverUrl": "https://app.xcloud.host/mcp?profile=compact"
    }
  }
}
```
3
No browser sign-in? Use an API key
Create a token with the mcp:invoke scope plus the read abilities for the areas it will use (read:servers and read:sites, with read:billing and read:addons for billing and add-on tools) and the matching write: abilities if it should change things in Settings, Developers, API Tokens, export it as XCLOUD_TOKEN and add a headers field to the xcloud entry. Both agents fill in the ${env:XCLOUD_TOKEN} reference from your environment, so the token itself stays out of the file. The Devin Local entry is shown; for Cascade the same headers field sits beside serverUrl.
JSON
```
"xcloud": {
  "url": "https://app.xcloud.host/mcp",
  "transport": "http",
  "headers": {
    "Authorization": "Bearer ${env:XCLOUD_TOKEN}"
  }
}
```

Check it worked

Then ask Windsurf for the job itself, for example:

Prompt

Which sites on this team have critical or high vulnerabilities? Match any plugin names against the code open in this workspace.

In practice

How Does Security Work from Windsurf?

Windsurf puts the agent and the code in one window, and that helps with security work in a specific way. When the agent reports that shop.example.com has a high finding in a checkout plugin, the plugin folder or composer.json is already open in the editor. You can see at once whether the plugin is third-party code that xCloud can simply update or custom code your team ships from Git, where the fix is a commit. You type which of my sites have critical findings into the chat, the agent calls vulnerabilities_index for the team-wide rollup, and the list comes back worst first with the plugin or theme each finding names.

Connecting is one command, devin mcp add xcloud https://app.xcloud.host/mcp, then devin mcp login xcloud, and Devin Local has no documented tool cap, so the full URL is fine. If your tab runs the legacy Cascade agent, its 100-tool cap makes this job a good reason to scope the connection. The full xCloud server offers 188 operations plus two search tools, so point Cascade's serverUrl at https://app.xcloud.host/mcp?toolsets=vulnerabilities,servers and it gets the vulnerability tools, servers_firewallRules, servers_fail2ban_banned-ips and servers_sudoUsers_index without crowding out whatever else you have connected. Reads such as the severity counts from sites_vulnerabilities_count run straight away on the xCloud side. A rescan through sites_vulnerability-scan is a routine action with no xCloud prompt, and since it finishes asynchronously the agent reads the count again before it reports.

Changes go through two gates. Devin Local asks before an MCP tool runs by default, and xCloud previews an update and waits for your explicit confirmation. The agent proposes the plugin update, offers sites_backup first and waits for your approval before calling sites_wordpress_update. A ban, an unban or a new firewall rule comes with the server and the effect spelled out, and the SSH lockout warning comes before any rule that touches port 22. If you ask the agent to enable the AI bot blocker or the 8G firewall, it tells you that both are dashboard switches and gives you the path instead. You can still ask it to read the 7G and 8G logs through the site's nginx access log to see what they are blocking.

Windsurf specific: New Windsurf tabs use Devin Local, which reads MCP servers from the Devin CLI config files, so add the entry in the shape it documents: a url with transport set to http, where a legacy Cascade entry uses serverUrl. Devin Local looks in ~/.config/devin/mcp_config.json, a project .devin/mcp_config.json and a local .devin/mcp_config.local.json. Cascade opens its file from Open MCP config file in the Cascade panel menu, and Windsurf has also used ~/.codeium/windsurf/mcp_config.json. In a team, an admin allowlist for Cascade blocks every server not on it, and the server ID must match the key name, xcloud, exactly; Devin Local can be restricted to a team MCP registry instead.

What xCloud does for security

xCloud reads vulnerability findings for one site or across your whole team, starts rescans and ignores or restores a finding. On servers it manages firewall rules, Fail2Ban bans, the SSH restriction state and sudo users. Protections such as the AI bot blocker, the 7G and 8G firewall and per-site IP rules stay dashboard switches.

Start with the team-wide rollup. For a fleet question the agent reads the vulnerability rollup across every site on the team in one call and sorts it worst first. For one site it reads the findings and the counts by severity instead.
Rescan and triage findings. A rescan runs without a confirmation stop and finishes asynchronously, so the agent checks the count again afterwards. Findings carry a severity and a source, and severity is the triage key. A false positive can be ignored with a reason and restored later.
Fix what the finding points to. Most findings are fixed by updating a plugin, a theme or WordPress core. The agent proposes the updates, takes a backup first if you want one, and waits for your approval, because updating plugins or themes always stops for confirmation.
Review the server's perimeter. The agent reads firewall rules, the Fail2Ban banned IP list, the SSH restriction status and the sudo users. It can add or disable a rule, ban or unban an address and whitelist xCloud's own IPs after you confirm the server and the effect.
Report what is dashboard-only. AI bot blocking, the 7G and 8G firewall and a single site's IP allow and block list are dashboard switches. The agent reads what it can, such as the 7G and 8G logs, and gives you the dashboard path and the site's dashboard link for the rest.

Reference

Security Settings and Limits on xCloud

The facts Windsurf works within when it secures sites and servers. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Vulnerability findings	Per-site list and counts by severity (critical, high, medium, low), plus a team-wide rollup across every site you can reach
Rescans	Triggering a rescan is a routine action that runs without a confirmation stop. It is asynchronous, so the agent polls the count or the site events
Ignore and restore	A finding can be ignored with a reason and un-ignored later. Both are changes to the finding, not to the site
Firewall rules	List, create, enable, disable and delete server rules by name, protocol (tcp or udp), traffic (allow or deny), port and optional source IP
Fail2Ban	List banned IPs, ban one or more addresses and unban an address. Adding addresses to Fail2Ban's own ignore list is an SSH step described in the Fail2Ban guide
Whitelisting	xCloud's infrastructure IPs and the caller's IP can be whitelisted. The SSH restriction status says whether SSH is limited to trusted addresses
Sudo users	List, create or update, and delete OS-level privileged accounts. Private keys are never returned, and a temporary account is available for short jobs
7G and 8G firewall	Switched on in the dashboard. Their logs are readable through the nginx log type of the site's access log read
AI bot blocker	A dashboard toggle: Site, Tools, Nginx and Security on Nginx, Tools, Security on OpenLiteSpeed
Per-site IP rules	Dashboard-only: Site, Tools, IP Management. The API lists a site's rules but does not change them; server-wide blocks are on the API
Automated security updates	xCloud installs security updates on servers it provisions, and Automatic Reboot restarts the server only when a reboot is required. Both are configured in the dashboard
Security headers	The API lists a site's custom Nginx configuration. Adding headers is a dashboard or SSH step, described in the security headers guide

Rules Windsurf has to follow

Firewall, Fail2Ban and sudo-user changes name the exact server and the effect before they run, and they wait for your yes. Locking out SSH is the risk the agent explains first.
The agent never disables SSH or a database service to tidy up a ruleset, and it does not delete the default SSH rule on its own.
Updating a plugin or theme to fix a finding stops for your approval, and the agent offers a backup first.
Ignoring a finding needs a reason you give. The agent records it and tells you how to restore it.
AI bot blocking, the 7G and 8G firewall, per-site IP rules and automated update settings are dashboard steps. The agent says so, gives the path and the dashboard link, and never claims it changed them.
A temporary sudo user is for a specific job and is removed when the job ends.

Example prompts

What Can You Ask Windsurf to Do for Security?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

Which sites on this team have critical or high vulnerabilities? Match any plugin names against the code open in this workspace.

Prompt

Rescan shop.example.com and show me the findings by severity when it finishes.

Prompt

List firewall rules and banned IPs on the Frankfurt server and flag anything that looks wrong. Do not change anything.

Prompt

Show the vulnerability count for every site on this team, sorted worst first, and name the top three findings.

Prompt

Run a vulnerability scan on the shop site and tell me what it finds.

Prompt

List the findings on the blog site and ignore the false positive in the contact form plugin, with the reason.

Prompt

Update every plugin on the shop site, then run a vulnerability scan, and stop if anything is still open.

Prompt

List the firewall rules on the Frankfurt server and tell me whether SSH is restricted to trusted IPs.

Prompt

Show the IPs Fail2Ban has banned on the Frankfurt server, and unban 203.0.113.10.

Prompt

Whitelist the xCloud IPs on the Frankfurt server.

Prompt

Which sudo users exist on the Frankfurt server? Flag any that look temporary or unused.

Windsurf and Security: Frequently Asked Questions

What people ask before they let Windsurf secure sites and servers through xCloud.

Why can Windsurf not see the xCloud firewall and Fail2Ban tools?

Most often the xcloud entry is not in a form or place the agent in your tab reads. Devin Local reads the Devin CLI config files and takes a url with transport set to http, so add it with devin mcp add xcloud https://app.xcloud.host/mcp. A legacy Cascade tab opens its file from Open MCP config file in the Cascade panel menu and uses serverUrl. Also check that a team allowlist or MCP registry includes xcloud.

Does Windsurf need the toolsets URL for security work with xCloud?

Only on the legacy Cascade agent. It caps tools at 100 across all servers, and the full xCloud server is larger than that on its own, so adding ?toolsets=vulnerabilities,servers to the serverUrl keeps the vulnerability, firewall and Fail2Ban tools available within the cap. Devin Local has no documented tool cap and can take the full URL.

Can an agent show vulnerabilities across all my sites at once?

Yes. xCloud has a team-wide rollup that lists findings for every site you can reach, which the agent sorts worst first. For one site it reads the findings and the counts by severity, and it can start a rescan.

Can the agent ban an IP address on my server?

Yes. It can ban addresses in Fail2Ban, list the banned IPs and unban one, and it can create, disable and delete server firewall rules. It confirms the server and the effect first, so you do not lock yourself out.

Can the agent turn on the 8G firewall or the AI bot blocker?

No. Both are dashboard switches. The agent can read the 7G and 8G firewall logs through the site's nginx logs, and it tells you where the switches are: the site's Tools section. It does not claim to have changed them.

Can the agent block an IP for just one site?

Not from here. Per-site IP allow and block lists are managed in the dashboard under Site, Tools, IP Management, and the agent can only list what is there. Server-wide blocks, through firewall rules and Fail2Ban, are on the API.

Does the agent fix a vulnerability on its own?

No. It reports the finding and proposes the update that remediates it, usually a plugin, theme or core update. Updates always stop for your approval, and the agent can take a backup first and rescan afterwards to confirm the finding is gone.

Other agents