Connect SEOReport to Windsurf (Devin Desktop): MCP setup

What you need

You need an active SEOReport plan and an API key. Create the key at https://seoreport.dev/dashboard/api-keys. API keys require an active plan. [3][4][1]

SEOReport shows the key once. Store it in a secret store or an environment variable, not in a prompt, a project file or your shell history. [4]

The server speaks streamable HTTP at https://seoreport.dev/mcp. It expects the key on every request as an Authorization: Bearer <api-key> header, the same key you use for the REST API. [3][4][1]

Add the server

For Devin Local, add the server to ~/.config/devin/mcp_config.json (%APPDATA%\devin\mcp_config.json on Windows) for all projects, or to .devin/mcp_config.local.json for one project. [7]

A remote server needs a url. transport defaults to Streamable HTTP for URL-based servers, and headers holds custom HTTP headers. [7]

{
  "mcpServers": {
    "seoreport": {
      "url": "https://seoreport.dev/mcp",
      "transport": "http",
      "headers": {
        "Authorization": "Bearer sr__live_your_api_key"
      }
    }
  }
}

{
  "mcpServers": {
    "seoreport": {
      "serverUrl": "https://seoreport.dev/mcp",
      "headers": {
        "Authorization": "Bearer ${env:SEOREPORT_API_KEY}"
      }
    }
  }
}

Versions before v3000.3 keep MCP servers under mcpServers in the main config files, such as ~/.config/devin/config.json. Newer versions move those entries into the dedicated mcp_config files on startup. [7]

If you still use Cascade, its config takes serverUrl or url plus headers, and supports ${env:VAR_NAME} in headers. Devin's CLI page documents ${env:VAR} only for OAuth fields, so the Devin Local example uses the key itself in a file kept out of git. [8][7]

Confirm it works

Devin Local lists everything a session has loaded, including MCP servers. By default it asks for approval before it calls any MCP tool; you can allow one tool or every tool on the server, for the session or permanently. [6]

With Devin CLI, devin mcp list lists the configured servers. Devin's docs also suggest asking the agent to list MCP servers and tools, and note the server may need a moment to initialize. [7]

You should see 9 tools whose names start with seoreport_: seoreport_create_report, seoreport_get_report_status, seoreport_get_report, seoreport_list_reports, seoreport_get_report_download, seoreport_get_account, seoreport_list_plans, seoreport_start_checkout and seoreport_submit_feedback. [3]

Then try a first prompt: "Audit https://example.com and list the three highest-severity findings." The agent can start the audit with seoreport_create_report and read the findings with seoreport_get_report. A report takes up to about 30 seconds. [4][3]

A new site uses one credit from your plan. Running a site you already have a report for again does not use a credit. [1][2]

Keep the key out of version control

Devin's docs say never to commit API keys or secrets to version control, and to use .devin/mcp_config.local.json for sensitive values. That file is gitignored; .devin/mcp_config.json is shared through version control. [7]

The user file ~/.config/devin/mcp_config.json sits in your home folder, outside your repositories. [7]

Troubleshooting

Authentication error or HTTP 401: SEOReport lists and calls tools only for a valid key. Check that the header value is Bearer, one space, then the key. If the key may be wrong or exposed, revoke it and create a new one in the dashboard. [3][4]

Plan or credit error: if seoreport_create_report says an active plan is required or the month's credits are used, the key works but the account cannot start a report. Ask the agent to call seoreport_get_account to see the plan and the credits left. [4]

To subscribe from the agent, it can call seoreport_list_plans and then seoreport_start_checkout. Checkout returns a browser link: an agent can start it, and only a person can pay. Credits reset on the first day of each month (UTC). [4][1]

Tools not listed: open the Devin Local customizations surface and check that the session loaded the server. Devin's Cascade MCP page adds that once a team admin allowlists any MCP server, all servers not on the list are blocked, and the Server ID must match the key name in your config (here, seoreport). [6][8]

In the legacy Cascade agent, the MCPs section of the Cascade panel's Actions menu lists your servers. Cascade can use at most 100 tools at a time. [8]