Windsurf + xCloud

Manage SSL and domains with Windsurf on xCloud

Managing SSL and domains with Windsurf means asking the Devin Local agent in the editor to read a certificate, check a domain's DNS and install or renew HTTPS on xCloud without opening the dashboard.

Skill: xcloud:ssl
Toolsets: ssl-certificates, sites, integrations
Free with every xCloud account

Set up Windsurf All Windsurf guides

YouIs HTTPS working on staging.example.com? DNS was only changed an hour ago.

servers_dns_checkread-only

AgentThe A record now points at your Frankfurt server and it is not proxied. The site has no certificate yet. I can issue xCloud's free certificate. Go ahead?

YouYes, issue it.

sites_sslCertificates_createneeds approval

AgentAccepted. I will poll the certificate status and load https://staging.example.com before I confirm.

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up Windsurf to Manage SSL and domains on xCloud?

Connect Windsurf once; every job on this account uses the same connection. Then ask in plain words.

1
Add xCloud to the Devin Local agent
New tabs in Devin Desktop use the Devin Local agent, which reads MCP servers from the Devin CLI config files. Run this in a terminal: the URL is treated as Streamable HTTP, and the second command opens the browser for the xCloud sign-in (the agent also prompts on first use). By default the entry lands in .devin/mcp_config.local.json for the current project; add -s user to the first command to share it across projects in ~/.config/devin/mcp_config.json, where the entry reads url plus transport http.
Shell
```
devin mcp add xcloud https://app.xcloud.host/mcp
devin mcp login xcloud
```
2
Or edit the legacy Cascade config
If your tab runs the legacy Cascade agent, click the three-dot menu in the Cascade panel, then the Open MCP config file icon in the MCPs section, and add this under mcpServers. Cascade allows 100 tools in total and the full xCloud server offers 188 operations plus two search tools, so point serverUrl at the compact profile, five tools that reach every operation through search and call; a single toolset such as ?toolsets=sites (60 tools) also fits, but sites and servers together are 121 tools. Windsurf's file has been at ~/.codeium/windsurf/mcp_config.json, and the current documentation lists ~/.config/devin/mcp_config.json on macOS and Linux and %APPDATA%\devin\mcp_config.json on Windows; the icon opens the one your version reads.
JSON
```
{
  "mcpServers": {
    "xcloud": {
      "serverUrl": "https://app.xcloud.host/mcp?profile=compact"
    }
  }
}
```
3
No browser sign-in? Use an API key
Create a token with the mcp:invoke scope plus the read abilities for the areas it will use (read:servers and read:sites, with read:billing and read:addons for billing and add-on tools) and the matching write: abilities if it should change things in Settings, Developers, API Tokens, export it as XCLOUD_TOKEN and add a headers field to the xcloud entry. Both agents fill in the ${env:XCLOUD_TOKEN} reference from your environment, so the token itself stays out of the file. The Devin Local entry is shown; for Cascade the same headers field sits beside serverUrl.
JSON
```
"xcloud": {
  "url": "https://app.xcloud.host/mcp",
  "transport": "http",
  "headers": {
    "Authorization": "Bearer ${env:XCLOUD_TOKEN}"
  }
}
```

Check it worked

Then ask Windsurf for the job itself, for example:

Prompt

Check the SSL certificate on staging.example.com and tell me the provider and the expiry date.

In practice

How Does SSL and domains Work from Windsurf?

In Windsurf the question usually arrives while you are looking at a file. A deploy went out, the staging domain is new, and you want to know whether HTTPS is in place before you share the link. You open the agent chat and type is the certificate on staging.example.com valid and does DNS point at my server. The agent resolves the site by its domain, reads the SSL state and the certificate list, and asks xCloud to check the DNS record. The answer comes back in the chat as a few lines: the provider, the status, the expiry date and whether the record resolves. If the record is not there yet, the agent checks again a little later, because a DNS lookup is one call and records take time to propagate.

What differs by agent is the connection. Run devin mcp add xcloud https://app.xcloud.host/mcp and devin mcp login xcloud, and Devin Local, which has no documented tool cap, takes the full URL. If your tab runs the legacy Cascade agent, it shares 100 tool slots across every MCP server you have enabled, and the full xCloud server offers 188 operations, so for a job like this the compact profile or a narrow toolsets filter is the practical choice. The certificate reads, the install and renew calls and the DNS check are all in reach of a scoped connection, and the rest of your slots stay free for other servers. Windsurf now ships as Devin Desktop, so the file you edit depends on the agent your tab uses: Devin Local reads the Devin CLI config files, and Cascade opens its file from Open MCP config file in the Cascade panel menu.

For changes, the agent works as the other xCloud clients do. It names the site and the provider before it installs, renews or switches a certificate, and it waits for your approval. xCloud previews a certificate install and waits for your explicit confirmation, and Devin Local asks before the MCP tool runs, so a change passes two gates. The agent polls until the certificate settles and loads the HTTPS URL before it reports success. For a WordPress site turning on HTTPS for the first time, it asks whether to run the database search-and-replace, which is worth a backup first. Adding a domain to an existing site is not something it can do; it gives you the dashboard path instead.

Windsurf specific: If your tab runs the Devin Local agent, MCP servers come from the Devin CLI config files: ~/.config/devin/mcp_config.json for your user, .devin/mcp_config.json for a project and .devin/mcp_config.local.json for a local entry. The entry is a url with transport set to http, and an API key goes in a headers field if you prefer one to the OAuth sign-in. A legacy Cascade tab opens its file from Open MCP config file in the Cascade panel menu, where remote entries use serverUrl or url. On a team plan where an admin allowlists MCP servers for Cascade, the server ID must be xcloud exactly, or it will not see the certificate tools at all; Devin Local can be restricted to a team MCP registry instead.

What xCloud does for ssl and domains

xCloud lets the agent read a site's certificate status, domains and DNS, then install or renew a certificate from xCloud (Let's Encrypt), your own files or a connected Cloudflare account. Adding or changing a domain on an existing site stays in the dashboard, and the agent gives you the path.

Find the site and read its SSL. The agent resolves the site by name or domain, then reads its current SSL state and the list of certificates before it changes anything. That shows the provider, the status and the expiry date.
Check the domain and DNS. It reads the site's primary and additional domains and asks xCloud whether the domain's DNS record points at the server. Each check is one lookup, so the agent repeats it while a record propagates. A record behind Cloudflare's proxy is reported separately.
Choose the certificate source. You pick xCloud's free Let's Encrypt certificate, your own certificate, or the team's Cloudflare integration. If the site already uses a different provider, the agent tells you that switching needs an explicit override and asks first.
Install or renew, once you approve. The agent restates the site and the provider, then installs or renews the certificate. A renewal only runs when the certificate is within seven days of expiry unless you ask for a forced renewal. For a WordPress site turning on HTTPS for the first time, it asks whether to run the database search-and-replace.
Poll to issuance and verify. Install and renew report success before issuance completes. The agent polls the certificate status until it settles, then checks the site over HTTPS before it calls the job done.
Hand off domain changes. If you want to add, change or remove a domain on an existing site, the agent gives you the dashboard path (Site > Domain) and the site's dashboard link, because the API only reads domains after creation.

Reference

SSL and domains Settings and Limits on xCloud

The facts Windsurf works within when it manages SSL and domains. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Certificate status	A site's SSL state, its certificate list and one certificate's detail and status are all readable
xCloud certificate	Free Let's Encrypt certificate issued and renewed by xCloud. The domain's DNS should already point at the server before you ask
Custom certificate	You supply the PEM certificate and its private key. The key is a secret and is never returned by a read
Cloudflare certificate	Uses the team's connected Cloudflare account. When the zone is connected, xCloud writes the DNS record and the certificate itself at site creation
Switching provider	Needs an explicit force when another provider is already configured, so the agent asks before it replaces a working certificate
Renewal rule	A renewal does nothing unless the certificate is within seven days of expiry; a forced renewal skips that guard. Renewing needs the site SSL permission on your team role
WordPress first HTTPS	An optional database search-and-replace moves existing http:// URLs to https:// when a WordPress site adopts HTTPS for the first time
DNS check	One lookup per call. A proxied Cloudflare record is flagged, and on a Cloudflare-managed site the proxied record is the finished state, not a fault
Domains (read)	The primary domain, additional domains and the domain update status are readable through the API
Domains (write)	Adding, changing or removing a domain on an existing site is dashboard-only: Site > Domain. A staging site goes live under Site > Domain > Go Live
Deleting a certificate	Available through the API, but it can take a site off HTTPS, so the agent restates the target and waits for your approval
Cloudflare 526 errors	A 526 or a certificate warning is an SSL problem, so the agent reads the certificate first. A 522 is different: it usually means ports 80 and 443 are blocked at the origin

Rules Windsurf has to follow

Installing, renewing, switching or deleting a certificate stops for your approval, and the agent names the site and the provider before it asks.
A success response means xCloud accepted the work, not that the certificate was issued: the agent polls the status and checks the live HTTPS URL.
The agent never replaces a working certificate with a different provider without telling you, and it never turns off the Cloudflare proxy on a site xCloud manages through Cloudflare.
Changing a domain on an existing site is a dashboard step; the agent gives you the path and the dashboard link xCloud returned, not a made-up workaround.
A custom certificate's private key is a secret: it is never returned by a read and should not be pasted into a shared channel.

Example prompts

What Can You Ask Windsurf to Do for SSL and domains?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

Check the SSL certificate on staging.example.com and tell me the provider and the expiry date.

Prompt

Does DNS for example.com point at my Frankfurt server yet? Is the Cloudflare proxy on?

Prompt

Renew the certificate on shop.example.com, then load the HTTPS URL and confirm it answers 200.

Prompt

Check the SSL certificate on shop.example.com and tell me when it expires.

Prompt

Is the DNS A record for example.com pointing at my Frankfurt server yet? Tell me if the Cloudflare proxy is on.

Prompt

Issue a free SSL certificate for example.com once DNS resolves, then confirm the site loads over HTTPS.

Prompt

Renew the certificate on the shop site and tell me the new expiry date.

Prompt

List every domain and additional domain on the shop site and say which is primary.

Prompt

Which of my sites have a certificate that expires in the next 30 days?

Prompt

Use my connected Cloudflare account for the certificate on shop.example.com, and show me what will change first.

Prompt

Visitors get a Cloudflare 526 error on shop.example.com. Check the certificate and tell me what is wrong.

Windsurf and SSL and domains: Frequently Asked Questions

What people ask before they let Windsurf manage SSL and domains through xCloud.

Will the xCloud SSL tools fit inside Windsurf's tool limit?

On the legacy Cascade agent, yes, if you connect the compact profile or scope the toolsets instead of the full server with its 188 operations. Cascade counts every enabled tool from every server toward its 100, so a smaller xCloud connection leaves room for your other servers. Devin Local has no documented tool cap and can take the full URL.

Can Windsurf's agent add a domain to my xCloud site?

No. The API reads a site's domains but does not add or change them after creation. The agent can list the primary and additional domains and give you the dashboard path, Site then Domain, to make the change yourself.

Can an AI agent add a domain to an existing site?

No. The API reads a site's domains, additional domains and domain update status, but adding, changing or removing a domain on an existing site is a dashboard step under Site > Domain. A domain is chosen when the site is created. The agent can tell you what is currently set and give you the path.

Which certificate options can the agent install?

Three: xCloud's free Let's Encrypt certificate, a custom certificate you supply, and a certificate through your connected Cloudflare account. The agent checks the current state first and asks before it changes anything. Switching a site from one provider to another needs an explicit override.

Why did the agent say a renewal did nothing?

A normal renewal only fires when the certificate is within seven days of expiry. If you need it earlier, ask for a forced renewal and the agent will confirm before it runs. Renewing also needs the site SSL permission on your team role.

Does the agent set up my DNS records?

It reads and checks them rather than writing them. It can tell you whether a domain's record points at your server and whether the Cloudflare proxy is on. DNS and the certificate are written for you only at site creation, when the domain's zone is on a Cloudflare account you connected to xCloud.

What does the agent do about a Cloudflare 526 error?

It treats it as an SSL problem. It reads the site's certificate status and expiry, and fixes it with an installation or renewal after your approval. A 522 is a different fault, usually closed ports 80 and 443 on the origin, so it is checked against the firewall instead.

Other agents