Windsurf · MCP
Cascade built it.
Send a link, not a file.
Cascade will build a report, a dashboard or a prototype as a single HTML file and open it in the preview. One entry in its MCP config and it can also put that file where the right people can open it.
No card required · Unlimited viewers · Secure by default
The situation
What happens to Windsurf's output today
The preview is the only viewer
It looks right in the editor's preview pane and exists nowhere else. Everyone who asked for it is waiting on a file.
A file is a copy the moment it leaves
You attach index.html. It gets forwarded. When Cascade rebuilds it with the new numbers, the people holding the old one never find out.
Hosting it properly is a project
A domain, an auth layer, permissions and a way to update in place — for something that might be thrown away on Friday. So it stays on localhost.
Setup
Connect Windsurf
Publish what Cascade builds to an address, not a file.
- 1.
Add it to ~/.codeium/windsurf/mcp_config.json
{ "mcpServers": { "deliverd": { "serverUrl": "https://deliverd.dev/api/mcp" } } }Keep any servers already listed there. The key is “serverUrl” — a plain “url” is ignored.
- 2.
Refresh the servers
In Cascade's MCP panel, refresh, then approve the connection in your browser.
No token is written anywhere. Deliverd implements the MCP authorization spec, so the client registers itself and you approve it in a browser — and removing someone from your organisation cuts their connection off at once, rather than whenever a token happens to expire.
What you get
Once it is connected
Everything below is what happens to a report after Windsurf publishes it.
A URL instead of a file
The report lands on an address you can send. It stays put, so a link you shared last month still opens the report — not a stale copy of it.
Behind your own sign-in
Readers authenticate with the identity your organisation already uses, including SAML single sign-on. Nobody gets a password to remember or a file to lose.
You choose who, in plain English
“Finance team”, “Sarah Jones”, “everyone”. Ambiguous phrases come back as a list to pick from rather than a guess, so a board pack cannot land in the wrong inbox.
Every version kept
Publishing again updates the same URL and keeps what was there before. You can see what changed, and roll back if the new one is wrong.
Comments on the passage, not the page
A reader selects a sentence and comments on it. Your agent can read those threads, fix what they point at, and mark them resolved.
A record of who opened it
Views, versions, access changes and share links are all written to an audit trail you can export.
Questions
Windsurf and Deliverd.
Where does the config go?
~/.codeium/windsurf/mcp_config.json. Merge the entry into what is already there — replacing the file removes the other servers you had configured.
Why serverUrl rather than url?
Because that is the key Windsurf reads for a remote server. A plain “url” is silently ignored and the server never appears, which looks like an outage and is a typo.
Do I need a token?
No. Windsurf supports OAuth for remote servers: it registers itself and opens a browser for you to approve the connection. The config holds only an address.
What can Cascade do once it is connected?
Publish a report, update one in place, rename it, file it into a workspace, search what exists, read reader comments and resolve them, and check which recurring reports are waiting on it.
Stop sending Windsurf’s output around as files.
Publish it to an address instead, and let the people who need it open it with the sign-in they already have.