Use CyberMax Data MCP with Windsurf (Devin Desktop)

Free US data lookups: ZIP demographics, CISA KEV/EPSS CVEs, domain rank, county spending, recalls.

Remote MCP server (Streamable HTTP), nothing to install. Free: Free, no key needed

Set it up

In the Cascade panel, open the … (Actions) menu and click Open MCP config file in the MCPs section.
Add the server under "mcpServers" with "serverUrl" and save.
Check the MCPs section in Cascade for the server and its tools.
Ask Cascade a question the tools can answer.

Add to ~/.config/devin/mcp_config.json:

{
  "mcpServers": {
    "cybermax-data": {
      "serverUrl": "https://data.cybermaxtools.com/mcp?via=use-with-windsurf"
    }
  }
}

Where it goes:

~/.config/devin/mcp_config.json (macOS and Linux)
%APPDATA%\devin\mcp_config.json (Windows)

Config format checked 2026-10-09 against Windsurf (Devin Desktop)'s MCP documentation.

Tools you get

Endpoint checked 2026-10-09: https://data.cybermaxtools.com/mcp answered an MCP initialize (protocol 2025-06-18) and tools/list with 7 tools, all marked read-only. No key was used and no tool was called.

Tool	What it does	Required inputs
`zip_lookup`	Look up a US ZIP code: city, state, county, coordinates, time zone and Census ACS 2020-2024 demographics (population, median age, household and per-capita income, median home value, median gross rent, housing units, owner-occupied share).	`zip_code`
`cve_kev_lookup`	Check whether a CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalog; if so return vendor, product, date added, federal due date, known ransomware use, EPSS probability/percentile, CVSS score/severity/vector, CWE and required action.	`cve_id`
`latest_kev`	List the CVEs most recently added to CISA's Known Exploited Vulnerabilities catalog, newest first, with EPSS, CVSS and due date in the summary.	none
`domain_rank`	Link-graph rank of a popular website (top 5,000): Common Crawl harmonic-centrality and PageRank rank, hosts crawled, previous-crawl rank, Majestic Million rank and referring subnets. For any other domain use Linkheft on Apify (apify.com/cybermax/domain-authority).	`domain`
`county_federal_spending`	FY2025 federal prime contract and grant obligations in a US county (USAspending.gov, place of performance): dollars, per-resident values, population and the county's contract rank in its state.	`county_fips`
`vehicle_recall`	Look up an NHTSA vehicle/equipment recall campaign from the last 12 months: manufacturer, component, units affected, do-not-drive and park-outside flags, summary, risk, remedy and affected make/model/year list.	`campaign`
`latest_recalls`	List the newest US vehicle and equipment recalls from NHTSA, newest first, with risk and remedy.	none

Test the endpoint from a terminal

This lists the tools without a key and without calling any of them:

curl -s https://data.cybermaxtools.com/mcp \
  -H 'content-type: application/json' \
  -H 'accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

If it does not work

Windsurf's documentation (docs.windsurf.com) now redirects to Devin Desktop's at docs.devin.ai; these steps follow that page.
The documented remote field is "serverUrl" (the docs say "url" is also accepted).
The free tier has a daily limit (see the pricing line above); a paid key raises it.

CyberMax Data in other clients

Cursor VS Code (GitHub Copilot)Claude Code Claude Desktop and claude.ai Cline OpenAI Codex CLI Gemini CLI

More MCP servers for Windsurf (Devin Desktop)

All CyberMax Data setups · All Windsurf (Devin Desktop) setups · All