# Windsurf on Android: a cloud phone for Cascade over MCP

The mcp_config.json entry with serverUrl and an env-read key, OAuth for Cascade, where the file lives now that Windsurf is Devin Desktop, a first prompt and its cost.

Guides4 min read

In this article

To give Windsurf’s Cascade an Android phone, open Cascade’s MCP menu, choose Open MCP config file and add the Mobilebox server with `serverUrl` set to https://mobilebox.dev/mcp and your API key in an `Authorization` header, read from the environment with `${env:…}`. Press refresh, and Cascade has 14 phone tools: it starts a cloud Android phone, installs your APK, reads the screen, taps, types, takes screenshots and stops the phone.

## The shortest way: let the agent do it

Paste this into Cascade:

```
Set up Mobilebox for me: read https://mobilebox.dev/setup.md and follow it.
```

It asks for your email, gets a key at once, stores it without printing it and adds the server; the 6-digit code from your inbox keeps the workspace.

## Add the server by hand

Put your key in your shell profile as `MOBILESANDBOX_API_KEY` ([sign up](https://mobilebox.dev/signup) and create one in the dashboard, or let the agent get one through setup.md), then restart Windsurf from a terminal that has it, so the editor inherits the variable. Open MCP config file opens `mcp_config.json`, by default `~/.config/devin/mcp_config.json` on macOS and Linux (Windsurf is now Devin Desktop, hence the folder) and `%AppData%/devin/mcp_config.json` on Windows. Add:

```
{
  "mcpServers": {
    "mobilebox": {
      "serverUrl": "https://mobilebox.dev/mcp",
      "headers": { "Authorization": "Bearer ${env:MOBILESANDBOX_API_KEY}" }
    }
  }
}
```

Cascade fills in `${env:MOBILESANDBOX_API_KEY}` in `serverUrl`, `url` and `headers`, so the key never sits in the file. A URL ending in `/mcp` tells it this is a Streamable HTTP server.

The editor’s own MCP discovery reads a different file, `~/.codeium/windsurf/mcp_config.json`. If you keep servers there, the same entry works; the docs explain how to turn that discovery on.

## Or sign in without a key

Cascade supports OAuth for remote Streamable HTTP servers. Add the entry with `serverUrl` alone, no headers, and press refresh. Mobilebox answers that it needs a sign-in; when Cascade sends you to it, sign in to Mobilebox and choose Allow. The consent page names the address the code goes back to. You can revoke the connection under API keys in the Mobilebox dashboard.

## Check it

Press the refresh button in the MCP panel after you save the file. Mobilebox should list its tools. To keep one away from Cascade, name it in a `disabledTools` array on the server entry. In Devin Local, the newer agent in the same app, the server shows under Customize, MCPs, and the agent asks before each tool call unless you allow the tool or the whole server.

Windsurf became Devin Desktop on June 2, 2026, and its docs moved to docs.devin.ai; Cascade and its MCP config work as before. The format here is from the [Cascade MCP docs](https://docs.devin.ai/windsurf/plugins/cascade/mcp), reviewed on November 10, 2026. We didn’t run Cascade itself; the endpoint and header are the ones every client on this site uses.

## A first task

```
Start a Mobilebox phone, install the APK at <your APK URL>, walk the sign-up flow, take a screenshot of each step, then stop the phone.
```

Cascade calls `create_phone`, which returns the first screen, then `install_app` with your URL. For each step it calls `act` to tap or type and reads the new screen it gets back, and `screenshot` for the pictures. Stopping is `park_phone`: the phone stops billing and keeps the app and its login for the next run. Say "delete the phone" when you want nothing kept. `watch_phone` gives you a link to watch it work. The mental model: a phone per agent per PR, started, checked, screenshotted, stopped.

## What it costs

A phone costs $0.01 a minute while it is ready, billed per second with a one-minute minimum. Boot time and parked phones are free. On our [November 8 benchmark](https://mobilebox.dev/benchmarks) one tap plus a fresh screenshot took 1.45 s at the median, so most of a run is your model thinking between steps. A sign-up walk that keeps the phone ready for 3 minutes costs 3 cents; our [framework examples](https://mobilebox.dev/integrations) finished their short task in 31 to 38 seconds, about a cent. The [agent guide](https://mobilebox.dev/docs/agents) covers the observe, act, verify loop in full.

## Try it in your agent in 60 seconds

Paste this into Claude Code, Cursor, Codex or any agent that can read a web page. It asks for your email, gets its own key at once and adds the phone tools; the 6-digit code from your inbox keeps the workspace.

```
Set up Mobilebox for me: read https://mobilebox.dev/setup.md?via=windsurf-android-mcp and follow it.
```

[What your agent reads](https://mobilebox.dev/setup.md?via=windsurf-android-mcp)

In this article

[All articles](https://mobilebox.dev/blog)

## Next questions

- [Does my agent stay logged in between runs?](https://mobilebox.dev/blog/park-resume-android?via=next-logins)

- [Can I watch my agent work live?](https://mobilebox.dev/live-view?via=next-live)

- [What does it cost for a team?](https://mobilebox.dev/blog/mobilebox-pricing-for-teams?via=next-team)

- [How fast do cloud phones start, measured?](https://mobilebox.dev/benchmarks?via=next-benchmarks)

- [Is there a Python package?](https://mobilebox.dev/blog/android-phone-for-python-ai-agent?via=next-python)

- [Mobilebox or Firebase Test Lab?](https://mobilebox.dev/blog/mobilebox-vs-firebase-test-lab?via=next-firebase)

- [Mobilebox or BrowserStack?](https://mobilebox.dev/blog/mobilebox-vs-browserstack?via=next-browserstack)

- [Cloud phone or a local emulator?](https://mobilebox.dev/blog/mobilebox-vs-local-emulator?via=next-emulator)