Windsurf

The mcpServers entry in ~/.codeium/windsurf/mcp_config.json, reached from Cascade's MCP panel — and why a desktop-launched editor is the case where the credential store earns its keep.

Add the server

Open Cascade, click the MCP icon in the panel's top-right menu (or go to Settings → Cascade → MCP Servers), and edit the raw configuration. The file is ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "vike-trader": {
      "command": "vike-cli",
      "args": ["mcp", "--node", "127.0.0.1:7879"]
    }
  }
}

command + args is the local shape, and it is the only one that works here: vike-cli mcp is a subprocess Windsurf starts and speaks newline-delimited JSON-RPC 2.0 to, and it has no URL at all. The remote shape — a URL rather than a command — is what the data server uses.

After editing, refresh the server list from that same MCP panel — Windsurf does not pick the file up on its own.

Scoping what the tools reach

Both vike-cli mcp flags are optional and both only widen what the tools reach. --node <host:port> is the running vike-tradehub the live tools observe and control — no default. --addr <host:port> is the vike-datahub the backtest tools ship profiles to, defaulting to 127.0.0.1:7878. With neither, the offline tools — validate_strategy, discover_params, list_templates, list_indicators — still work, which makes a flag-less entry a reasonable first step:

{
  "mcpServers": {
    "vike-trader": { "command": "vike-cli", "args": ["mcp"] }
  }
}

If Windsurf reports the binary as not found, give command an absolute path: an editor launched from the desktop does not inherit the PATH your shell exports.

The node keys

A desktop-launched editor inherits none of your shell's exports

This is the case the credential store exists for. Windsurf starts vike-cli mcp as a child of the application, not of your terminal, so an export VIKE_TRADEHUB_CONTROL_KEY=... in your shell profile is invisible to it — the server starts and the offline tools work, but node_snapshot reports a missing key immediately. A write tool is quieter about it: its preview still returns, with node_verdict: null and verified_by_node: false, because the node dry-run needs the control key and silently skips itself without one. The named key error appears only once a call carries both confirm: true and a valid preview_token and the send is actually attempted. Put both keys in <project>/settings/secrets.env, the same store the vike-tradehub daemon reads, and one copy serves both halves.

Each key resolves from the process environment first and then from that store, independently — crates/vike-cli/src/cmd/nodekeys.rs's resolve is the whole rule. The entry does take an env block if you want to pin one:

{
  "mcpServers": {
    "vike-trader": {
      "command": "vike-cli",
      "args": ["mcp", "--node", "127.0.0.1:7879"],
      "env": { "VIKE_TRADEHUB_OBSERVE_KEY": "..." }
    }
  }
}

An observe key in that file grants reads. A control key grants orders, so it is the expensive one to leave in a config file — prefer the store for it.

vike-cli secrets path prints which store a directory resolves to; vike-cli secrets list shows whether a key is in it, by name — never values.

Verify

list the vike strategy templates

list_templates is offline: no key, no node, no network. If it answers, the subprocess is running and the protocol is working, and anything still failing is an address or a key rather than the setup. With a node configured, "show me the node snapshot" proves the observe key too.

Troubleshooting

The server shows as failed. Almost always the JSON: a trailing comma, or a key nested in the wrong object. command, args and env are siblings inside the server's own object.

It is green but the tool list is empty. Refresh from the MCP panel. Windsurf reads the file on refresh, not on save.

The offline tools work and the node tools do not. That is an address or a key, not the MCP wiring — and almost certainly the inherited-environment trap above. The two failures are worded differently on purpose: "no vike-tradehub node configured" means --node never arrived; "set neither in the process environment nor in the credential store" names a key, and names both places it looked.

A write tool answered and no order exists. Not a Windsurf problem. A write executes only when a call carries both confirm: true and the preview_token its own preview returned; anything less comes back as another preview, with will_execute: false and no error. Live node is the contract, and it is worth reading before an agent in an editor is pointed at a live node.

Where this shape came from

The config path and the mcpServers object with command/args/env, and the MCP panel route to it, were read from Windsurf's own Cascade MCP documentation in September 2026, not from memory — note that docs.windsurf.com now redirects into the Devin documentation, which is where that page lives. That page is the authority if the shape has moved; this one is the copy.

The data server too

Windsurf holds both Vike servers in the same mcpServers object — the hosted data server as a remote entry beside this one. Data client setup has its shape. The names must differ, or the second replaces the first.