Skip to main content
Windsurf’s Cascade can browse the Nevermined Catalog and pay for services as it works. You add one remote MCP server, paste your Nevermined API key, and Cascade does the rest. This is the per-host walkthrough; for the full tool surface and the safety model, see Using the Catalog from a harness.
Windsurf connects with a plain Nevermined API key, not the OAuth “approve a spending cap” flow that some assistants (Claude, ChatGPT) use. The key is your credential — it spends whatever its Nevermined account funds, so you set the budget on your account, not in Windsurf.

​
Before you connect

1

A Nevermined account

Free, at nevermined.app.
2

A Nevermined API key

Create a plain API key in the app — Settings → Global NVM API Keys — for the environment you want, and send the whole string, prefix included (sandbox:… or live:…). A key minted by an OAuth flow can’t pay through the Router’s delegation routes, so use a plain one. See Get a Nevermined API key.
3

A way to pay

The key spends from one of two budgets you set up once: a Nevermined Subscription whose monthly credits a plain key can spend, or a spending delegation — a capped, revocable budget funded from your own wallet (Using the Catalog from a harness walks through it). Discovery is free and needs neither.
Start on sandbox, where you use testnet funds and nothing costs real money, before you point Windsurf at live.

​
Add the Catalog to Windsurf

1

Open the MCP config file

In Cascade’s Settings, open the MCP config file (mcp_config.json) — on macOS/Linux that’s ~/.config/devin/mcp_config.json.
2

Add the server with a header

Add a remote server entry with the URL for your environment and a header carrying your Nevermined API key — headers is a free key/value map, so add Authorization: Bearer <your key>:
3

Refresh

Press Refresh in the MCP panel — Cascade does not reload the config on its own.

​
Your Nevermined API key

That key is your credential — there is no separate consent screen to approve. Paste it in place of <your Nevermined API key> and keep the prefix: a live: key for mcp.live, a sandbox: key for mcp.sandbox. The key spends whatever its account funds — your Subscription credits, or a spending delegation funded from your wallet — so the budget and the audit trail live on your Nevermined account, not in Windsurf. Treat it like a password: never commit it or paste it into a shared chat. Every way to mint one: Get a Nevermined API key.

​
Make your first paid call

Ask for something only live data can answer, and name the server so Cascade reaches for it rather than answering from memory.
1

Browse for free

In Cascade, ask “list the Nevermined catalog categories” — a free tool call, no payment.
2

Ask it to buy

“Buy the service with slug <slug> through the Nevermined server and show me the response.” The paid call draws on your subscription credits or delegation and returns the merchant’s response.
If Cascade answers without paying, it answered from its own knowledge — name the server and ask for live data. More on phrasing: Catalog MCP tips.

​
Disconnect or rotate the key

  • Stop the credential (Nevermined side). The key is the credential, so to cut Windsurf off, rotate or delete the key in the app (Settings → Global NVM API Keys) — every call with the old key then fails. To cap spending without revoking the key, revoke the delegation it spends from in Payment methods; discovery still works.
  • Remove the server (Windsurf side). Delete the Nevermined entry from mcp_config.json and press Refresh.
To spend again, paste a fresh key; if you revoked the delegation, create a new one — see Using the Catalog from a harness.

​
Next

Using the Catalog from a harness

The full plain-key playbook — discovery, delegations, and the safety rules.

Catalog MCP — full reference

Every tool, the API-key header, and every refusal code.