feat: register codedb in Windsurf + Devin via mcpsync#521
Conversation
Extends install-time MCP auto-registration beyond Claude/Codex/Gemini/Cursor
to Windsurf and Devin, delegating those two to mcpsync (the codegraff tool
that keeps MCP servers in sync across AI tools). Augment, not replace — the
four existing per-client registrations are untouched.
install/install.sh — new register_windsurf_devin(), called from main() right
after register_cursor:
- locates mcpsync (PATH, then ~/.local/bin, ~/bin, /usr/local/bin);
- auto-installs it (curl mcpsync.codegraff.com | bash) if missing, and never
fails the codedb install if that is unavailable (prints a skip line);
- writes codedb into mcpsync's source of truth ~/.mcpconfig.json directly via
python3, NOT `mcpsync add` (which auto-syncs to every detected tool) — this
keeps mcpsync's footprint to exactly Windsurf + Devin so the tools above are
not re-touched;
- runs `mcpsync sync windsurf devin` (named targets, additive; mcpsync skips
tools that aren't installed, so it is a no-op for users without them);
- python3-less fallback uses `mcpsync add`.
src/nuke.zig — deregisterInstalledIntegrations now also strips codedb from
Windsurf (~/.codeium/windsurf/mcp_config.json) and Devin
(~/.config/devin/config.json). Both store servers under a standard mcpServers
object, so the existing deregisterJsonIntegrationFile handles them; other
servers and non-mcpServers keys are preserved.
README.md — feature table + install section now list Windsurf and Devin.
Verified by sourcing the real register_windsurf_devin() into a sandboxed HOME
with Windsurf + Devin present: codedb is added to both configs additively
(pre-existing servers and Devin's peer keys preserved); uninstalled tools are
skipped. 670/670 tests pass; install.sh is `bash -n` clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 54a7dce00d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Auto-install mcpsync if missing (same trust domain as codedb). Never fail the | ||
| # codedb install if this is unavailable. | ||
| if [ -z "$mcpsync_bin" ]; then | ||
| curl -fsSL https://mcpsync.codegraff.com | bash >/dev/null 2>&1 || true |
There was a problem hiding this comment.
Stop piping unverified mcpsync installer into bash
When mcpsync is not already installed, the codedb installer now executes whatever https://mcpsync.codegraff.com returns without a checksum, signature, pinned version, or even saving it for inspection. This introduces a new remote-code-execution path during a normal install and conflicts with the repo guidance to flag installer scripts that execute untrusted code or skip verification; please download a versioned artifact and verify it, or make this an explicit opt-in step.
Useful? React with 👍 / 👎.
| // Windsurf and Devin are registered via mcpsync; both store servers under a | ||
| // standard `mcpServers` object, so the JSON deregister handles them too. | ||
| const windsurf_config = std.fmt.allocPrint(allocator, "{s}/.codeium/windsurf/mcp_config.json", .{home}) catch return removed; |
There was a problem hiding this comment.
Remove codedb from mcpsync's source config on nuke
The installer now writes the codedb entry into ~/.mcpconfig.json before syncing Windsurf/Devin, but nuke only deletes the downstream tool configs here. In any environment where mcpsync remains installed, a later mcpsync sync can recreate a codedb MCP entry that points at the binary this command just removed, so codedb nuke is no longer a complete uninstall for the new registration path.
Useful? React with 👍 / 👎.
Benchmark Regression ReportThresholds: 10.00% and 50,000 ns absolute delta
|
What & why
codedb's installer auto-registers the MCP server in Claude Code, Codex, Gemini CLI, Cursor — but not Windsurf or Devin. This PR adds those two, delegating them to mcpsync (the codegraff tool that keeps MCP servers in sync across AI tools, and already targets both).
Design: augment, not replace. The four existing per-client registrations are untouched; mcpsync's footprint is scoped to exactly Windsurf + Devin. Net diff is +74/−2 across 3 files, no Zig logic rewritten.
Changes, part by part
1.
install/install.sh— newregister_windsurf_devin()(+62)Called from
main()immediately afterregister_cursor "$dest". Flow:command -v mcpsync, then fall back to~/.local/bin,~/bin,/usr/local/bin.curl -fsSL https://mcpsync.codegraff.com | bash(same trust domain as codedb's own installer). Wrapped in|| trueand followed by a re-probe; if mcpsync still isn't found it printswindsurf/devin: skip (mcpsync unavailable)and returns — it never fails the codedb install.~/.mcpconfig.json(mcpsync's single owned config) viapython3:mcpsync add, becausemcpsync addauto-syncs to every detected tool — writing the file ourselves keeps the sync scoped to the two named tools below, so Claude/Codex/Gemini/Cursor (registered above) are not re-touched. Apython3-less fallback usesmcpsync add.mcpsync sync windsurf devin. This is additive (existing servers untouched) and mcpsync skips tools that aren't installed, so it's a no-op for users without Windsurf/Devin.2.
src/nuke.zig— deregister Windsurf + Devin (+10)deregisterInstalledIntegrationsnow also strips codedb from:~/.codeium/windsurf/mcp_config.json~/.config/devin/config.jsonBoth store servers under a standard
mcpServersobject, so the existingderegisterJsonIntegrationFilehandles them unchanged — other servers and Devin's non-mcpServerskeys are preserved.codedb nukestays a complete uninstall.3.
README.md— docs (+2/−2)Feature table and the Install section now list Windsurf + Devin and link mcpsync, noting it's auto-installed and that uninstalled tools are skipped.
Config paths (reference)
~/.codeium/windsurf/mcp_config.json{ mcpServers: {...} }~/.config/devin/config.jsonmcpServersis a peer of other keys~/.mcpconfig.jsonTesting
End-to-end, against the real
install.shfunction. Sourcedregister_windsurf_devin()into a sandboxedHOMEwith Windsurf + Devin present (each pre-seeded with an unrelated server / extra key):keep-meserver and Devin'sotherkey both preserved;mcpsync sync windsurf devinreportsnot installed, skippedand writes nothing.Other checks:
bash -n install/install.sh— clean.zig build test— 670/670 (the nuke change is covered by the existingderegisterJsonIntegrationFiletests; no new test needed).No real user configs were modified during testing (all in a throwaway
HOME).Safety properties
codedb nukeremoves codedb from Windsurf/Devin too.