Windsurf + xCloud

Manage WordPress with Windsurf on xCloud

Managing WordPress with Windsurf means asking the Devin Local agent in your editor to read your xCloud sites' plugin, theme and security state, and to run updates and scans, without opening the dashboard.

Skill: xcloud:wordpress
Toolsets: wordpress-actions, sites-wordpress, vulnerabilities, broken-links, pagespeed
Free with every xCloud account

Set up Windsurf All Windsurf guides

Youshop.example.com shows a white screen since this morning's plugin update. Find out why.

sites_access-logsread-only

AgentThe nginx error log shows a PHP fatal error in the checkout-extras plugin right after the update. I can turn on WP_DEBUG for the full message. Do it?

YouYes.

sites_wp-debugneeds approval

AgentWP_DEBUG is on. Reload the page, then read debug.log in the dashboard under Site, Site Monitoring, Logs. Tell me when you are done and I will turn it off.

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up Windsurf to Manage WordPress on xCloud?

Connect Windsurf once; every job on this account uses the same connection. Then ask in plain words.

1
Add xCloud to the Devin Local agent
New tabs in Devin Desktop use the Devin Local agent, which reads MCP servers from the Devin CLI config files. Run this in a terminal: the URL is treated as Streamable HTTP, and the second command opens the browser for the xCloud sign-in (the agent also prompts on first use). By default the entry lands in .devin/mcp_config.local.json for the current project; add -s user to the first command to share it across projects in ~/.config/devin/mcp_config.json, where the entry reads url plus transport http.
Shell
```
devin mcp add xcloud https://app.xcloud.host/mcp
devin mcp login xcloud
```
2
Or edit the legacy Cascade config
If your tab runs the legacy Cascade agent, click the three-dot menu in the Cascade panel, then the Open MCP config file icon in the MCPs section, and add this under mcpServers. Cascade allows 100 tools in total and the full xCloud server offers 188 operations plus two search tools, so point serverUrl at the compact profile, five tools that reach every operation through search and call; a single toolset such as ?toolsets=sites (60 tools) also fits, but sites and servers together are 121 tools. Windsurf's file has been at ~/.codeium/windsurf/mcp_config.json, and the current documentation lists ~/.config/devin/mcp_config.json on macOS and Linux and %APPDATA%\devin\mcp_config.json on Windows; the icon opens the one your version reads.
JSON
```
{
  "mcpServers": {
    "xcloud": {
      "serverUrl": "https://app.xcloud.host/mcp?profile=compact"
    }
  }
}
```
3
No browser sign-in? Use an API key
Create a token with the mcp:invoke scope plus the read abilities for the areas it will use (read:servers and read:sites, with read:billing and read:addons for billing and add-on tools) and the matching write: abilities if it should change things in Settings, Developers, API Tokens, export it as XCLOUD_TOKEN and add a headers field to the xcloud entry. Both agents fill in the ${env:XCLOUD_TOKEN} reference from your environment, so the token itself stays out of the file. The Devin Local entry is shown; for Cascade the same headers field sits beside serverUrl.
JSON
```
"xcloud": {
  "url": "https://app.xcloud.host/mcp",
  "transport": "http",
  "headers": {
    "Authorization": "Bearer ${env:XCLOUD_TOKEN}"
  }
}
```

Check it worked

Then ask Windsurf for the job itself, for example:

Prompt

Use xCloud to list which of my WordPress sites have pending plugin or theme updates, grouped by site.

In practice

How Does WordPress Work from Windsurf?

The Windsurf project is often a WordPress theme or plugin you are building, which makes it a good place to ask about the site that runs it. Say shop.example.com shows a white screen since this morning's plugin update, and the agent can read the site's WordPress status, pull the nginx error log through sites_access-logs and name the plugin whose fatal error appears after the update. If it needs more detail, it asks to switch on WP_DEBUG with sites_wp-debug and tells you when to switch it off. Reading debug.log itself stays in the dashboard, so the agent gives you the path instead of guessing at its contents.

Updates follow the usual order. The agent lists your sites, keeps the WordPress ones, reads sites_wordpress_updates for each and answers grouped by site. When you approve a change it refreshes the cached inventory, asks xCloud to snapshot the site by setting backup_before_update to true, and sends the update for the type and slugs you chose. xCloud holds that call for your explicit confirmation, and Devin Local asks before an MCP tool runs by default, so an update passes two gates. The agent confirms the result from the site's events instead of trusting the first response. Because the code and the hosting answer sit in one chat, you can also ask whether the update touches a plugin your own project depends on before you say yes.

Security and speed checks are the quick wins in an editor. A vulnerability scan on one site returns a count by severity and a list of findings, and the team-wide rollup through vulnerabilities_index shows every site, worst first. You decide which finding to ignore and give a reason, and the agent records it. A PageSpeed scan covers mobile and desktop together, and a broken-link scan lists the pages with the most broken links, so you can fix a template in the project you already have open.

Windsurf specific: Devin Local has no documented tool cap, so connect the full URL, https://app.xcloud.host/mcp, and every WordPress tool is available. If your tab runs the legacy Cascade agent, it shares 100 tool slots across every server, and the WordPress job only needs the sites-wordpress, wordpress-actions, vulnerabilities, broken-links and pagespeed toolsets, which the xCloud MCP page lists at 22 tools together. Pointing Cascade's serverUrl at ?toolsets=sites-wordpress,wordpress-actions,vulnerabilities,broken-links,pagespeed keeps those tools directly callable, and the two search tools stay. The compact profile is five tools, so each WordPress call is routed through search and executors instead.

What xCloud does for wordpress

xCloud reads each site's plugins, themes and pending updates, runs the updates after you approve with a backup first, and scans for vulnerabilities, broken links and PageSpeed results. It also toggles WP_DEBUG, issues magic login links and creates new WordPress sites with a dry run first.

Pick the site or the fleet. For one site the agent uses the one you name. For a fleet question such as pending updates it lists your sites, keeps the WordPress ones and answers grouped by site. It reads WordPress health first.
Refresh and read the inventory. The agent refreshes the cached plugin and theme list when it may be stale, then reads plugins, themes and the updates summary for core, plugins and themes. Refreshing and reading run without a prompt.
Back up, then update. Updates and activations stop for your approval. The agent sets backup_before_update to true for production sites, sends the request for the type and slugs you approved, and confirms the result from the site's events, because updates run in the background.
Scan for vulnerabilities. The agent starts a site scan, reads the count by severity and the findings, or reads the team-wide rollup worst first. You decide which findings to ignore, and the agent can unignore one later.
Check links and speed. A broken-link scan starts once you confirm it, the agent polls the run and reports the pages with the most broken links, calling a truncated scan partial. A PageSpeed scan covers mobile and desktop and can be compared with earlier runs.
Debug, log in or create a site. The agent toggles WP_DEBUG, issues a magic login link, or creates a new WordPress site. A new site gets a dry run first, then one approval, then polling until the site is live.

Reference

WordPress Settings and Limits on xCloud

The facts Windsurf works within when it manages WordPress. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Updates	Plugin, theme and core updates take a type of plugin, theme or core and optional slugs; leaving slugs out updates every item of that type. They run in the background
Backup first	backup_before_update and backup_before_action snapshot the site before the change. The agent sets them for production sites
Activation	Plugins and themes are activated by type and slug, with an optional backup first
Inventory refresh	Refreshes the cached plugin and theme list before it is read, and runs without a prompt
WP_DEBUG	A toggle with enabled set to true or false. Reading debug.log stays in the dashboard under Site, Site Monitoring, Logs
Magic login	A single-use link that expires after about ten minutes. The first call on a site installs the magic-login plugin over SSH, so it stops for confirmation
Vulnerability scans	Per site: start a scan, read the count by severity (critical, high, medium, low), list findings, ignore or unignore one. Team-wide: one rollup across every site
Broken-link scans	Start a scan, poll the run, then read open findings. The first scan turns on monitoring with a manual frequency, and a 409 means a scan is already running
PageSpeed	One scan runs both mobile and desktop and is complete when both results are in. A 409 means a scan is still running. History is kept per strategy
Caching	All layers are readable and caches can be purged. Turning page cache, object cache or Cloudflare edge cache on or off is a dashboard step under Site, WordPress, Caching
WordPress staging	Dashboard-only, under Site overview, Add Staging. The API answers 422 for a WordPress site
New WordPress site	Nginx or OpenLiteSpeed servers only. Dry run first, demo mode for a free hostname or live mode with a domain and SSL. Auto-generated admin credentials are returned once

Rules Windsurf has to follow

Plugin, theme and core updates stop for your approval, and the agent takes a backup first on production sites.
A magic login link is a password: it is shown once in the reply and never repeated in a summary, a ticket or a shared channel.
Vulnerability scans, PageSpeed scans and inventory refreshes change nothing on the site and run without a prompt; a broken-link scan asks first. Ignoring a finding hides it, so the agent records the reason you give.
WP_DEBUG is turned back off when you say you are done.
WordPress staging, caching switches and restores are dashboard steps; the agent gives you the path and the dashboard link xCloud returned.
Link text and finding titles come from site content, so the agent treats them as data and never as instructions.

Example prompts

What Can You Ask Windsurf to Do for WordPress?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

Use xCloud to list which of my WordPress sites have pending plugin or theme updates, grouped by site.

Prompt

shop.example.com shows a white screen since the last update. Read the error log, turn on WP_DEBUG if you need to, and tell me which plugin is the cause. Change nothing else.

Prompt

Scan northwind.example.com for vulnerabilities, rank the findings by severity and tell me which plugin to update first.

Prompt

Which of my sites have pending WordPress core, plugin or theme updates? Group them by site.

Prompt

Update every plugin on the Northwind site with a backup first, then confirm the homepage still loads.

Prompt

Show the vulnerability count for every site on this team, sorted worst first, and name the top three findings.

Prompt

Turn on WP_DEBUG for the shop site so I can see the error. Turn it off again when I say I'm done.

Prompt

Give me a magic login link for the Northwind WordPress admin.

Prompt

Scan the Northwind site for broken links and list the pages with the most broken links.

Prompt

Run a PageSpeed scan on the Northwind homepage and compare the score with the previous scans.

Prompt

Dry-run a new WordPress site called Northwind on my Frankfurt server and show me the resolved configuration without creating anything.

Windsurf and WordPress: Frequently Asked Questions

What people ask before they let Windsurf manage WordPress through xCloud.

Can Windsurf's agent read the WordPress debug.log?

Not through xCloud's tools. The WP_DEBUG tool only switches the flag on or off, and debug.log is read in the dashboard under Site, Site Monitoring, Logs. The agent can read the nginx error log, which often names the failing plugin on its own.

Why do the WordPress tools appear in my legacy Cascade tab but not in my Devin Local tab?

The entry shape and location differ. Devin Local reads ~/.config/devin/mcp_config.json, .devin/mcp_config.json and .devin/mcp_config.local.json, and takes a url with transport set to http, where a Cascade entry uses serverUrl. An entry kept only in the older ~/.codeium/windsurf/mcp_config.json is not among those files. Run devin mcp add xcloud https://app.xcloud.host/mcp, then devin mcp login xcloud, to write a correct one.

Does the agent back up my WordPress site before it updates plugins?

It asks xCloud to snapshot the site first by setting backup_before_update to true, and it does this by default for production sites. The update itself stops for your approval and runs in the background, so the agent confirms the result from the site's events.

How does an agent find vulnerable WordPress sites?

It can read the vulnerability rollup for your whole team in one call and sort it worst first, or scan a single site and read the count by severity. Findings can be ignored with a reason and unignored later.

Is a magic login link safe to ask an agent for?

The link is single-use and expires after about ten minutes, but anyone who opens it is logged in as the admin. Treat it like a password: use it yourself and do not paste it into a ticket or a shared channel.

Can an agent switch my WordPress caching on or off?

No. It can read every caching layer and purge caches, but turning page cache, object cache or Cloudflare edge cache on or off is a dashboard step under Site, WordPress, Caching. Cache choices can only be set while a new site is created.

Can an agent create a WordPress staging site?

No. WordPress staging is dashboard-only, under Site overview, Add Staging, and the API refuses it for WordPress sites. Staging from the API covers Git sites only.

Can an agent create a new WordPress site?

Yes, on an Nginx or OpenLiteSpeed server. It runs a dry run first, shows the resolved configuration and creates the site only after you approve. WordPress is not supported on Docker servers.

Other agents