MCP Gateway for Windsurf: Setup & Config

What you can do with MCP Gateway in Windsurf

Pick it to apply shared security plugins and visibility across otherwise separate MCP servers.

• Apply PII filtering to connected server responses
• Scan server reputation and tool descriptions before loading

Before you start: MCP Gateway in Windsurf

• Python and pip
• The mcp-gateway package
• Xetrack installed for this example
• An MCP configuration containing nested server definitions

Install with pip install mcp-gateway and pip install xetrack. Replace the configuration path if needed. This example enables basic masking and tracing; Lasso API credentials and Presidio extras are needed only for those plugins.

MCP Gateway Windsurf configuration

1. Choose Windsurf configuration scope

   For MCP Gateway, open macOS/Linux: ~/.codeium/windsurf/mcp_config.json Windows: %USERPROFILE%\.codeium\windsurf\mcp_config.json. Merge into mcpServers; remote endpoints use serverUrl.

2. Add MCP Gateway to Windsurf

   Use the mcp-gateway-lasso-security entry below in mcpServers. Keep MCP Gateway's documented stdio connection fields and your other Windsurf entries.

3. Check MCP Gateway in Windsurf

   MCP Gateway: Refresh MCP in Windsurf settings and inspect Cascade’s tools.

{
  "mcpServers": {
    "mcp-gateway-lasso-security": {
      "command": "mcp-gateway",
      "args": [
        "--mcp-json-path",
        "~/.cursor/mcp.json",
        "-p",
        "basic",
        "-p",
        "xetrack"
      ],
      "env": {}
    }
  }
}

MCP Gateway tools available to Windsurf

MCP Gateway's stored tool list documents 2 tools; compare it with Windsurf's connected tool list, because the stored list is not a live check.

get_metadata

After refreshing MCP Gateway in Windsurf settings, check Cascade's tool list for get_metadata.

run_tool

After refreshing MCP Gateway in Windsurf settings, check Cascade's tool list for run_tool.

Invoke a downstream capability with configured request and response filtering.

MCP Gateway: full stored tool descriptions

Troubleshooting MCP Gateway in Windsurf

• Check mcp-gateway on the machine running Windsurf's MCP integration for MCP Gateway; refresh MCP and inspect Cascade's tools.
• MCP Gateway uses stdio here: Windsurf must keep the configured process running; protocol output belongs on stdout and diagnostics on stderr.
• Known limitation: Presidio and Xetrack require additional dependencies
• Known limitation: Advanced Lasso guardrails need an API key and external API checks
• Known limitation: Scanner results can be manually overridden
• General Windsurf troubleshooting lives in the /clients/windsurf guide.

Frequently asked questions