Devin

Devin is Cognition’s autonomous software engineer. It registers remote MCP servers per-workspace and runs OAuth in your browser the first time it reaches for one. Protocol background lives at MCP.

Note

Devin Desktop was Windsurf. Cognition acquired Windsurf in 2025 and renamed the IDE Devin Desktop on 2 June 2026. This page covers the cloud agent. For the desktop IDE and its Cascade panel, see Windsurf. Same vendor, different client, and it configures MCP its own way.

Prerequisites

Before you start, confirm:

• You have an Engram account at app.engram.page.
• At least one vault is synced. Open the Obsidian plugin or the web app and confirm notes have synced within the last day.
• You can sign in via browser. The MCP auth flow opens a browser window.

Endpoint

https://mcp.engram.page

Setup (settings UI)

1. Open MCP settings. In Devin, go to Settings → Connections → MCP servers, then click Add a custom MCP.

2. Name it. Set Server Name to engram. The icon and short description are optional.

3. Choose the transport. Select HTTP. Engram speaks Streamable HTTP; do not pick SSE, which is the deprecated transport and will fail to list tools.

4. Set the Server URL to the MCP endpoint above.

5. Set Authentication method to OAuth. Not Auth Header. With OAuth, Devin registers itself dynamically and you never paste a token. Leave the client ID and secret blank; Engram supports dynamic client registration, so Devin mints its own client.

6. Save, then click Test listing tools. Devin spins up an isolated environment and connects. The first attempt opens an Engram sign-in in your browser; approve the vault you want Devin to reach. Tools appear once the grant lands.

Setup (CLI)

Same result, two commands:

devin mcp add engram https://mcp.engram.page --transport http
devin mcp login engram

login opens the browser flow and stores the tokens. No --oauth-client-id or --oauth-client-secret is needed: those flags exist for providers without dynamic client registration, and Engram has it.

What Devin can do

• Search my vault for notes about the engineering interview process and summarize the top three.
• Find anything I wrote about embeddings in the last month.

Engram holds my personal notes — treat it as your long-term memory of me. Search it when a question depends on context I might have shared before. Before saving or updating a note, ask first.

Tokens are per-client

Devin authenticates independently of every other MCP client. Signing in from Claude Code, Cursor or Devin Desktop does not carry over. Each gets its own grant and shows up as its own row under Settings → Connections in Engram. Revoking one leaves the others alone.

Troubleshooting

• Test listing tools fails with 401. The OAuth flow did not complete or the grant was revoked. Re-run it: devin mcp login engram, or reopen the server in Settings and retry.
• Tools never list, no browser prompt. Authentication method is probably set to None or Auth Header. It must be OAuth.
• Connection fails immediately. Check the transport is HTTP, not SSE, and that the URL matches the endpoint above exactly.
• 402 during sign-in. You are at your plan’s MCP connection cap. Revoke an unused connection under Settings → Connections, or upgrade.

For cross-client failures, see Troubleshooting.

Revocation

To disconnect this client from Engram:

1. In the client, find the connector or MCP server entry and remove it.
2. In Engram, open your account → API Keys & Sessions and revoke the matching session.
3. The OAuth token is invalidated server-side. The client will need to re-authenticate to reconnect.

Devin appears as Devin with a verified badge, because its callback lands on a Cognition-owned host.

Next steps

MCPProtocol overview.

ScopesWhat the grant covers.

All integrationsPick a different client.