To give Windsurf’s Cascade an Android phone, open Cascade’s MCP menu, choose Open MCP config file and add the Mobilebox server with serverUrl set to https://mobilebox.dev/mcp and your API key in an Authorization header, read from the environment with ${env:…}. Press refresh, and Cascade has 14 phone tools: it starts a cloud Android phone, installs your APK, reads the screen, taps, types, takes screenshots and stops the phone.
The shortest way: let the agent do it
Paste this into Cascade:
Set up Mobilebox for me: read https://mobilebox.dev/setup.md and follow it.It asks for your email, gets a key at once, stores it without printing it and adds the server; the 6-digit code from your inbox keeps the workspace.
Add the server by hand
Put your key in your shell profile as MOBILESANDBOX_API_KEY (sign up and create one in the dashboard, or let the agent get one through setup.md), then restart Windsurf from a terminal that has it, so the editor inherits the variable. Open MCP config file opens mcp_config.json, by default ~/.config/devin/mcp_config.json on macOS and Linux (Windsurf is now Devin Desktop, hence the folder) and %AppData%/devin/mcp_config.json on Windows. Add:
{
"mcpServers": {
"mobilebox": {
"serverUrl": "https://mobilebox.dev/mcp",
"headers": { "Authorization": "Bearer ${env:MOBILESANDBOX_API_KEY}" }
}
}
}Cascade fills in ${env:MOBILESANDBOX_API_KEY} in serverUrl, url and headers, so the key never sits in the file. A URL ending in /mcp tells it this is a Streamable HTTP server.
The editor’s own MCP discovery reads a different file, ~/.codeium/windsurf/mcp_config.json. If you keep servers there, the same entry works; the docs explain how to turn that discovery on.
Or sign in without a key
Cascade supports OAuth for remote Streamable HTTP servers. Add the entry with serverUrl alone, no headers, and press refresh. Mobilebox answers that it needs a sign-in; when Cascade sends you to it, sign in to Mobilebox and choose Allow. The consent page names the address the code goes back to. You can revoke the connection under API keys in the Mobilebox dashboard.
Check it
Press the refresh button in the MCP panel after you save the file. Mobilebox should list its tools. To keep one away from Cascade, name it in a disabledTools array on the server entry. In Devin Local, the newer agent in the same app, the server shows under Customize, MCPs, and the agent asks before each tool call unless you allow the tool or the whole server.
Windsurf became Devin Desktop on June 2, 2026, and its docs moved to docs.devin.ai; Cascade and its MCP config work as before. The format here is from the Cascade MCP docs, reviewed on November 10, 2026. We didn’t run Cascade itself; the endpoint and header are the ones every client on this site uses.
A first task
Start a Mobilebox phone, install the APK at <your APK URL>, walk the sign-up flow, take a screenshot of each step, then stop the phone.Cascade calls create_phone, which returns the first screen, then install_app with your URL. For each step it calls act to tap or type and reads the new screen it gets back, and screenshot for the pictures. Stopping is park_phone: the phone stops billing and keeps the app and its login for the next run. Say "delete the phone" when you want nothing kept. watch_phone gives you a link to watch it work. The mental model: a phone per agent per PR, started, checked, screenshotted, stopped.
What it costs
A phone costs $0.01 a minute while it is ready, billed per second with a one-minute minimum. Boot time and parked phones are free. On our November 8 benchmark one tap plus a fresh screenshot took 1.45 s at the median, so most of a run is your model thinking between steps. A sign-up walk that keeps the phone ready for 3 minutes costs 3 cents; our framework examples finished their short task in 31 to 38 seconds, about a cent. The agent guide covers the observe, act, verify loop in full.