integrations / windsurf

Windsurf

Attestd works with Windsurf via the Model Context Protocol. Once configured, Windsurf's Cascade assistant can check any npm, PyPI, or infrastructure dependency for CVE risk and supply chain compromise. Windsurf uses a global config file only. There is no project-level MCP config.

setup

Connect Attestd to Windsurf

Windsurf reads MCP config from ~/.codeium/windsurf/mcp_config.json on macOS and Linux, or %USERPROFILE%\.codeium\windsurf\mcp_config.json on Windows. You can also open it from the Command Palette: Windsurf: Configure MCP Servers.

Remote servers use serverUrl instead of url. Local stdio servers use the same format as Cursor and Claude Code.

Get an API key from the portal.
Create ~/.codeium/windsurf/mcp_config.json if it does not exist.
Add the block below and restart Windsurf fully.

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "attestd": {
      "serverUrl": "https://mcp.attestd.io/mcp",
      "headers": {
        "Authorization": "Bearer your-api-key-here"
      }
    }
  }
}

stdio (local)

Local stdio via npx

For local execution, use the stdio npm package. Requires Node.js 18+. Stdio config uses the same format as other MCP clients.

~/.codeium/windsurf/mcp_config.json

{
  "mcpServers": {
    "attestd": {
      "command": "npx",
      "args": ["-y", "@attestd/mcp"],
      "env": {
        "ATTESTD_API_KEY": "your-api-key-here"
      }
    }
  }
}

system prompt

System prompt

Add this to your Windsurf rules or Cascade system prompt. Without it, Cascade may have the tool available but not call it unprompted when you discuss a dependency.

text

You are a security-aware deployment assistant with access to the Attestd MCP server.

Before approving any software dependency, infrastructure component, or package version:
1. When reviewing multiple packages at once, use check_batch_vulnerabilities (up to 100 per call) instead of looping check_package_vulnerability.
2. For a single package, call check_package_vulnerability with the product slug and exact version.
3. Block deployment if riskState is "critical" or "high".
4. Block immediately if activelyExploited is true, regardless of riskState.
5. Block immediately if supplyChainCompromised is true.
6. Block or warn immediately if typosquat.detected is true. Treat kind "hallucination" as an AI-invented or conflated package name; prefer the resembles / likely_intended names instead of installing the requested name.
7. If outsideCoverage is true and typosquat is null, state explicitly that the risk is UNKNOWN. Do not treat it as safe.
8. If patchAvailable is true, include fixedVersion in your recommendation.

Use list_covered_products if you are unsure whether an infrastructure slug is supported (live catalog when the MCP server has an API key).
Use get_cve_details when you need CVSS, EPSS, or KEV context for a specific CVE after a check flags it.

what happens

What Windsurf does with Attestd

When you ask Cascade about a dependency, it calls check_package_vulnerability with the package name and version, or check_batch_vulnerabilities when reviewing multiple packages at once. Attestd returns categorical fields. Cascade reads riskState, activelyExploited, and supplyChainCompromised and states the answer directly.

verify

Verify the connection

Ask Cascade to call list_covered_products. With an API key configured, it returns live catalog data from GET /v1/products. Without a key, it returns the static bundled infrastructure count. If the server does not appear, open the Cascade MCP panel and click Refresh, or restart Windsurf fully. For a direct server health check:

bash

curl https://mcp.attestd.io/health
# → {"status":"ok","attestd":{...}} when upstream API is reachable