npx -y zephex setup --windsurf writes stdio (command/npx) to ~/.codeium/windsurf/mcp_config.json — not serverUrl. Optional serverUrl HTTP below.
Official Windsurf MCP documentation: Windsurf MCP docs
Without MCP, your agent guesses project layout and misses supply-chain risk. Zephex connects one hosted endpoint so every session gets the same ten tools — no per-machine npm installs, no version drift across the team.
HTTP and stdio setups both need a key from your Zephex dashboard. OAuth-only flows (ChatGPT, Claude.ai web) sign you in in the browser instead — skip this section for those.
Matches the published CLI (mcp-proxy/src/commands/setup.ts). One command signs you in, writes the correct transport, and verifies 10 tools.
Account teardown: logout vs disconnect · Connect MCP walkthrough
Search docs for “where is my MCP file” — the answer is always: run list first, then open the path it prints.
Documented paths: ~/.codeium/windsurf/mcp_config.json
Windsurf wizard writes npx stdio (not serverUrl) for local filesystem access.
Runs the same code as mcp-proxy/src/commands/setup.ts — OAuth in browser, creates a CLI key, writes your editor config, verifies tools.
npx -y zephex setup --windsurfSkip browser OAuth — paste a key from zephex.dev/dashboard/keys. Must start with mcp_prod_, mcp_dev_, or mcp_sk_.
npx -y zephex setup --windsurf --api-key mcp_prod_your-key-herecommand/npx — not serverUrl: Transport: stdio (see ~/.codeium/windsurf/mcp_config.json).
{ "mcpServers": { "zephex": { "command": "npx", "args": ["-y", "zephex"], "env": { "ZEPHEX_API_KEY": "mcp_sk_your_key_here" } } }}After CLI install, fully restart the app if tools do not appear. Manual JSON/TOML blocks below are equivalent — use them when CLI commands are unavailable.
Full comparison: HTTP vs stdio · npx zephex reference
Run npx zephex setup --windsurf. Global path only: ~/.codeium/windsurf/mcp_config.json.
Replace mcp_sk_your_key_here with your key from Dashboard → API Keys. Copy the full key once at creation — paste into Authorization: Bearer … for HTTP configs, or into ZEPHEX_API_KEY for stdio/npx configs.
command npx — matches writeWindsurfConfig in setup.ts.
{ "mcpServers": { "zephex": { "command": "npx", "args": ["-y", "zephex"], "env": { "ZEPHEX_API_KEY": "mcp_sk_your_key_here" } } }}Manual remote only; remove stdio block if you switch.
{ "mcpServers": { "zephex": { "serverUrl": "https://zephex.dev/mcp", "headers": { "Authorization": "Bearer mcp_sk_your_key_here" } } }}Tip
Because config is global, every Windsurf workspace shares the same Zephex key — use a team key with rotation policy if multiple people share one machine.
Run these in a terminal when the editor UI is unclear — catches stale npm, wrong transport, and project shadows.
npx -y zephex@latest listnpx -y zephex@latest doctornpx -y zephex@latest repair# Fully quit the editor (Cmd+Q / Alt+F4), reopen, start a new agent sessionAfter saving your config, confirm Zephex is connected before you rely on it in real work.
Questions people ask when Windsurf does not show Zephex tools — indexed for docs search.
How do I connect Zephex to windsurf?
Fastest: npx -y zephex setup --windsurf (browser sign-in, writes config, verifies 10 tools). Or paste manual config on this page, save, fully quit the app, reopen.
Where did setup save my windsurf MCP config?
Run npx -y zephex@latest list — it prints every config path on this machine that references Zephex.
windsurf works in terminal but not in the editor
GUI apps often lack nvm/fnm PATH. Run npx -y zephex@latest repair, ensure Node is on system PATH, fully quit the editor.
How do I disconnect Zephex from windsurf?
mcpcli disconnect --windsurf — revokes key and strips config.
You do not call tools yourself — ask your agent in plain language. Try these once Zephex is connected:
“Cascade: get_project_context on github:supabase/supabase — summarize monorepo layout.”
Remote GitHub context without cloning into Windsurf’s workspace.
“Use find_code for createCheckoutSession across this Stripe integration repo.”
Ranked hits guide Cascade to the right module before edits.
“check_package on a package name a teammate pasted in Slack — is it safe to install?”
Supply-chain check from chat, no terminal npx audit script required.
“explain_architecture how our Next.js app talks to Redis and Postgres.”
Mermaid diagram for data flow instead of guessing from folder names.
“keep_thinking while we debug why WebSocket reconnects fail in production.”
Hypothesis log survives long Cascade sessions.
“Zephex_dev_info: best-practice cookie settings for a SaaS on Cloudflare.”
Expert auth/security patterns without leaving the IDE.
You do not pick tools from a menu — ask your agent in normal sentences. Half of the tools only need a package name or URL; the other half need to know which codebase you mean (your Mac/Windows project folder or a GitHub repo).
These situations usually mean the setup cannot work until you fix the underlying issue:
zephex shows 0 tools
Fully quit Windsurf, delete duplicate zephex entries, keep only serverUrl block.
Connection failed
serverUrl must be https://zephex.dev/mcp. Bearer + full API key in headers.
JSON syntax error
Validate file at global path only. No comments in JSON.
Tools work but wrong project context
Global MCP does not auto-scope — name github: URL or absolute path per open repo.
Edited wrong user profile on shared PC
Confirm ~/.codeium is under the OS user running Windsurf.
Cascade reads ~/.codeium/windsurf/mcp_config.json — then these ten Zephex tools are callable from the flow:
get_project_context
Reads your project structure, dependencies, scripts, env vars, and framework markers in one call. Replaces manually opening package.json, tsconfig, and multiple config files at the start of every session.
read_code
AST-based code extraction: pass a symbol name and get the implementation without reading entire files. Supports symbol lookup, batched file reads, and structural outlines for large files.
find_code
Ranked search across the repo for definitions, usages, and patterns. Faster than blind grep when the agent does not know where a symbol lives.
check_package
Live registry lookup for npm, PyPI, Cargo, and Go modules. Surfaces typosquat risk, maintainer changes, and suspicious version jumps before you run install.
explain_architecture
Generates Mermaid diagrams for auth flows, service boundaries, and module dependencies so the agent reasons about structure instead of guessing.
check_test
Turns a task description into the smallest file set to read or edit, with risk ratings and caller impact notes.
audit_headers
Grades a deployed URL for CSP, HSTS, TLS, cookies, and redirects. Returns fix snippets for common hosts (Vercel, Cloudflare, Nginx).
keep_thinking
Structured multi-step debugging: tracks hypotheses and conclusions so long investigations do not loop.
Zephex_dev_info
Expert patterns for authentication, databases, frontend frameworks, deployment, and mobile stacks when the agent needs vetted guidance.
project_memory
Persists decisions, gotchas, and conventions per project in ~/.zephex/memory (SQLite FTS5). recall before unfamiliar areas; remember after discoveries. Local stdio only on npx zephex.