MCP setup for Windsurf and Zed

Once you have set up MCP in one editor the rest are variations on a theme: a JSON document somewhere in your home directory, a key that holds servers, and an entry under it. What changes between them is where the file lives and what the key is called — and both are annoying to guess.

Here are the two that come up most after Cursor and VS Code.

Windsurf

{
  "mcpServers": {
    "spinrun": {
      "url": "https://spinrun.ai/mcp",
      "headers": {
        "x-spinrun-client": "windsurf"
      }
    }
  }
}

Note the path: .codeium/windsurf/, not .windsurf/. The key is mcpServers, following Claude Desktop's original shape rather than VS Code's.

spinrun install windsurf writes this for you if you would rather not go looking for the directory.

There is no credential in that block. Windsurf opens a browser the first time it connects to the gateway — sign in, choose a workspace, and the tools appear.

Zed

Zed is the odd one out. It does not keep MCP servers in a file of their own — they live inside your full settings.json under context_servers, alongside every other preference you have set.

{
  "context_servers": {
    "spinrun": {
      "url": "https://spinrun.ai/mcp",
      "headers": {
        "x-spinrun-client": "zed"
      }
    }
  }
}

There is no credential in that block. Zed opens a browser the first time it connects to the gateway — sign in, choose a workspace, and you are done.

The one header

x-spinrun-client carries no secret. It exists so the activity log can say which editor made a call, which is the difference between an audit trail and a list. Each of these editors then sees exactly the connections you can see, because it is authorized as you.

The part that is not about config files

Both of these are editors with agents in them, and an agent with your accounts attached can do more than edit text. Before you finish setup, set each connected app's policy: read, write and destructive, each allowed or blocked.

A bad edit in a repository is recoverable — that is what version control is. A deleted CRM record is not. Blocking destructive actions across every app takes a minute, and you can relax it for the one place you have a reason to.

Next

• Cursor MCP setup
• VS Code MCP setup — and the key that trips everyone up
• Agent permissions belong at the gateway