Windsurf MCP for WhatsApp: Connect WaBot in Devin Desktop

What happened to Windsurf, in one paragraph

The Devin Desktop FAQ says Windsurf became Devin Desktop on 2 June 2026, that your Windsurf settings are carried over, and that the classic editor, extensions and keybindings are still there. The agent changed: Devin Local is the local agent in Devin Desktop and runs the same architecture as the Devin CLI. Per the Cascade (legacy) page, Devin Desktop no longer starts new Cascade conversations. Cascade lives on in the Windsurf plugin for JetBrains IDEs, covered at the end. If you’re after Devin the cloud agent instead, read WhatsApp MCP with Devin.

Before you start

• A WaBot account with a connected WhatsApp number. In the WaBot app go to Developer → Developer Credentials and copy the Client ID and Client Secret. The Copy MCP config button there gives you the JSON below with your values filled in. WaBot’s MCP guide has the full tool list.
• Devin Desktop, with your folder open in a trusted workspace (Devin Local isn’t available in Restricted Mode).
• Your own WhatsApp number for testing.

Set up WaBot in Devin Desktop (Devin Local)

Devin Local reads MCP servers from three files, according to the customizations page and the configuration docs:

1. Open the Customize page from the Agents window and click MCPs. Under This computer you can open the config file for a scope.
2. Pick the user file or the gitignored local file. Your Client Secret goes in it, so not the shared project file.
3. Add the WaBot server under mcpServers, replacing the placeholders:

{
  "mcpServers": {
    "wabot": {
      "url": "https://api.wabot.shop/mcp",
      "headers": {
        "clientid": "<Client ID>",
        "clientsecret": "<Client Secret>"
      }
    }
  }
}

1. Save and refresh the list on the MCPs tab. wabot should appear with its tools. The same list has a toggle to switch it off.

A URL entry defaults to Streamable HTTP, which is what WaBot uses, so you don’t need a transport field. The docs list headers as “custom HTTP headers to include in requests” and say a server that expects a static key should use headers, not the OAuth fields. They document ${env:VAR} expansion only for OAuth fields, so we don’t rely on it for headers here. Their advice for secrets is the gitignored .devin/mcp_config.local.json.

Check it, and decide what runs without asking

Use the wabot MCP tools to list my WhatsApp numbers and approved templates. Don't send anything.

Per the Devin Local permissions page, the agent asks for approval before calling any MCP tool, and you can allow one tool or a whole server for the session or permanently. Rules use names like mcp__wabot__list_recent_chats. A sensible split: allow read-only tools such as list_recent_chats, get_messages and list_templates, and keep send_template_message and send_session_message on ask, so every outgoing WhatsApp message needs your click. You never need to give the agent an account ID; WaBot works it out from the Client ID.

Use case 1: a 3-step follow-up sequence, checked as a diagram

Spice Route Café runs a weekday lunch offer. When someone sends “lunch”, they want three steps: the offer, the menu when the customer taps See menu, then a booking link when they tap Book a table. The three templates (lunch_offer, lunch_menu, table_booking) are already approved, with those buttons.

Build a WaBot chained auto-reply called Lunch offer: when a message includes "lunch", send lunch_offer. When they tap the See menu button, send lunch_menu. When they tap Book a table, send table_booking. Keep it switched off and show me the schematic.

• Tools: list_templates, create_chained_autoflow (2 to 10 steps in one call; later steps match the button the customer tapped), then preview_workflow_schematic for a Mermaid diagram and step list.
• What you see: the diagram in chat to check before anything is live. The automation is created inactive; say “turn on Lunch offer” and the agent calls set_workflow_status. Then test it from your own phone.

Use case 2: send a booking reminder and react to the reply

You’re testing a reminder before rolling it out, and you want the agent to handle the answer.

Send the approved template booking_reminder to +91 98xxx xxxxx for Asha, table for 4 at 7 pm. Show me the message first. Wait for the reply: if she says yes, reply "Great, see you at 7!"; if she wants to change the time, ask what time suits her.

• Tools: get_account (for whatsappPhoneId), send_template_message, wait_for_reply (up to 30 seconds per call), then send_session_message for the follow-up.
• Why it works: the reminder is the first message, so it has to be a template. Once Asha replies, the 24-hour window is open and the agent can answer in plain text.
• WaBot can also push replies as notifications on the MCP stream (subscribe_replies), but only to clients that keep the stream open, and Devin’s docs don’t mention notification support. Stick with wait_for_reply.

Use case 3: who needs a reply this morning?

Look at my last 20 WhatsApp chats in WaBot. List anyone whose last message is from the customer and hasn't been answered, with a one-line summary and how long ago they wrote. Don't reply to anyone.

• Tools: list_recent_chats, then get_messages for each conversation (it includes the time of the customer’s last message, which tells you if the 24-hour window is still open).
• What you see: a short to-do list, for example “Asha, 2 h ago, asked about Sunday brunch; window open”. Then answer them yourself from the WaBot inbox, or ask the agent to draft replies for you to approve one by one.

Still on Cascade? The Windsurf plugin for JetBrains

Cascade still runs in the Windsurf plugin for JetBrains IDEs. Its MCP page says to use Open MCP config file in Cascade’s MCP menu, which opens the same ~/.config/devin/mcp_config.json (%AppData%/devin/mcp_config.json on Windows). Remote servers take serverUrl or url plus headers, and that file resolves ${env:...} inside headers, so you can keep the secret in environment variables:

{
  "mcpServers": {
    "wabot": {
      "serverUrl": "https://api.wabot.shop/mcp",
      "headers": {
        "clientid": "${env:WABOT_CLIENT_ID}",
        "clientsecret": "${env:WABOT_CLIENT_SECRET}"
      }
    }
  }
}

Press the refresh button after adding the server. On Enterprise plans MCP has to be turned on in settings, and once a team admin allowlists any MCP server, servers that aren’t on the list are blocked. Ask your admin to add WaBot if that applies to you.

Stay safe, and know the limits

• The agent sends real WhatsApp messages to real people. Ask it to show the message and recipient before each send, and test on your own number first.
• Message only customers who opted in; see WhatsApp opt-in rules.
• WaBot allows 60 MCP requests a minute per Client ID and logs every tool call.
• Not available through MCP: campaigns and broadcast scheduling, campaign analytics, segmentation, deleting workflows, and advanced workflow steps (branching, webhooks, agent handoff, code). Use the WaBot app for those.

Comparing editors? See WhatsApp MCP in Cursor or the full list in the WhatsApp MCP server guide.

Frequently asked questions

Is Windsurf now Devin Desktop?

Yes. Devin’s docs say Windsurf became Devin Desktop on 2 June 2026. Settings carry over, and new conversations use the Devin Local agent; Cascade is legacy in Devin Desktop.

Where is mcp_config.json in Devin Desktop?

For your user it’s ~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows). Per project there’s .devin/mcp_config.json (shared) and .devin/mcp_config.local.json (gitignored). Open them from Customize → MCPs.

How do I add WaBot’s WhatsApp MCP server?

Add an mcpServers entry named wabot with url https://api.wabot.shop/mcp and a headers object with clientid and clientsecret from WaBot’s Developer Credentials page. Put it in your user file or the gitignored local file.

Will the agent send WhatsApp messages without asking?

Not by default: Devin Local asks for approval before any MCP tool call. Allow read-only WaBot tools if you like, but keep the sending tools on ask.

Can I run WhatsApp campaigns from Devin Desktop?

No. Campaigns, scheduling, analytics and segmentation stay in the WaBot app. MCP covers templates, single messages, chats, simple automations and WhatsApp Flows.