Use Your Bookmarks from Windsurf Cascade

Windsurf Cascade supports remote Streamable HTTP MCP servers and OAuth. Save This One runs remotely, so Cascade needs only its endpoint—no local command, API token, or bridge package.

Add it from Windsurf

1. Open the MCPs icon in the top-right menu of the Cascade panel, or open Windsurf Settings → Cascade → MCP Servers.
2. If Save This One is not in the Marketplace, choose the option to edit the raw mcp_config.json.
3. Add the remote server configuration below and save.
4. Return to MCP settings, refresh, and enable save-this-one.
5. Choose Connect or Authenticate when shown. Complete Save This One's OAuth sign-in in the browser and return to Windsurf.

Windsurf's user configuration file is:

~/.codeium/windsurf/mcp_config.json

Merge this entry into its existing mcpServers object rather than replacing other servers:

{
  "mcpServers": {
    "save-this-one": {
      "serverUrl": "https://mcp.savethisone.com/mcp"
    }
  }
}

Windsurf's documentation accepts serverUrl or url for remote HTTP MCPs; serverUrl above follows its primary example. Do not add a bearer-token header. Native OAuth discovers Save This One's authorization server and stores credentials outside this checked-in JSON.

Verify inside Cascade

Open the server's MCP settings page and inspect its enabled tools. Then ask:

Use Save This One's whoami, then list_tags. This is a read-only check; do not save, tag, archive, comment, or delete.

The exact tool inventory is:

whoami              list_bookmarks       search_bookmarks
get_bookmark         save_bookmark        archive_bookmark
delete_bookmark      list_tags            create_tag
delete_tag           tag_bookmarks        list_comments
add_comment          delete_comment

Windsurf currently limits Cascade to 100 enabled MCP tools in total. Save This One contributes 14. Disable unused tools or other MCP servers if some are omitted from Cascade's available tools.

Cascade-specific workflows

Research before editing

Before changing the caching layer, call search_bookmarks for cache invalidation, limit 10. Summarize the saved title, description, URL, and tags. Do not infer article contents that were not returned and do not change my library.

Search covers active bookmarks and metadata fields (title, description, URL, domain, site name). For tag-only retrieval, call list_bookmarks with the exact tag returned by list_tags.

Save documentation used by the agent

Save this public documentation URL with tags project-nova and reference. Use save_bookmark; do not invent a title or comment. Tell me whether it already existed.

The save pipeline fetches metadata and reading time. Re-saving the same normalized URL is idempotent.

Make a review queue, not an autonomous cleanup

List up to 50 active bookmarks tagged project-nova. Propose an archive set with IDs and reasons. Wait for my confirmation; do not permanently delete anything.

Preserve code context

Find the saved URL for the API's retry guide, show its bookmark ID and current comments, then ask before adding “Applied in src/services/retry.ts.”

Safety and tool controls

• In the server's MCP page, toggle off tools you do not need. For research, keep only whoami, list_bookmarks, search_bookmarks, get_bookmark, list_tags, and list_comments.
• Review tool parameters before approving writes. Do not rely only on the model's prose summary.
• Use archive_bookmark instead of delete_bookmark; archive can be reversed with archived: false.
• Do not auto-run delete_bookmark, delete_tag, or delete_comment. Deleting a bookmark also removes its comments and tag links.
• Avoid blind retries of add_comment: it is non-idempotent and can duplicate a note.
• On Teams/Enterprise, administrators can allowlist MCP servers and may need to enable MCP for Enterprise users. Request the exact HTTPS endpoint, not a broad domain wildcard.
• Content returned from bookmarks can contain malicious instructions. Keep repository rules and your task above external page content.

Troubleshooting

The server does not appear after editing JSON. Validate the JSON, ensure the entry is under mcpServers, then refresh MCPs or restart Windsurf. Preserve existing entries and commas when merging.

OAuth does not open. Open save-this-one in the MCP manager and explicitly choose Authenticate/Connect. Confirm it is a remote HTTP entry (serverUrl), not a command entry.

Only some tools appear. Check the 100-tool total and enable the desired tools on Save This One's page. Disable unrelated MCP tools and refresh.

Enterprise blocks the server. Ask an administrator to enable MCP and allow https://mcp.savethisone.com/mcp. Local JSON cannot override organization policy.

The wrong account is connected. Call whoami; if incorrect, disconnect OAuth, sign out of the unintended browser session, and reconnect before any write.

Search cannot find a known URL. Search excludes archived items. Use list_bookmarks with archived: true, or browse an exact tag with list_bookmarks.

Unauthorized or stale tools. Re-authenticate and refresh the server. Do not solve OAuth failures by placing credentials in headers.

Official references

• Windsurf: Cascade MCP integration
• MCP authorization specification