Connect Windsurf

Add the Sentrasec MCP server to Windsurf so Cascade can scan and explain findings.

Install the CLI

The MCP server ships inside the sentrasec binary. Skip this if sentrasec --version already works.

macOS / Linux (Terminal)

$ curl -fsSL https://cli.sentrasec.ai/install.sh | bash

Windows (PowerShell)

$ irm https://cli.sentrasec.ai/install.ps1 | iex

On Windows, open a new terminal afterwards. More options are in the CLI installation guide.

Add the server

Open ~/.codeium/windsurf/mcp_config.json (%USERPROFILE%\.codeium\windsurf\mcp_config.json on Windows) — Settings, then Cascade, then Manage MCP servers gets you there — and add the sentrasec server:

~/.codeium/windsurf/mcp_config.json

{  "mcpServers": {    "sentrasec": {      "command": "sentrasec",      "args": ["mcp", "serve"],      "env": {        "SENTRASEC_APP_ID": "app_...",        "SENTRASEC_APP_KEY": "sk_prod_..."      }    }  }}

Replace sk_prod_... with your API key. See Authentication for how to create one.

If Windsurf reports that it cannot start sentrasec, it is not seeing your shell's PATH. Run sentrasec mcp config and use the full path it prints as command, for example /Users/you/.local/bin/sentrasec on macOS or C:\\Users\\you\\AppData\\Local\\Sentrasec\\bin\\sentrasec.exe on Windows (backslashes doubled inside JSON).

Use it

Press Refresh in the MCP panel so Cascade reconnects. Then ask it something like:

Scan this repository and walk me through anything high severity before I open a PR.

See the tools reference for everything the agent can call.