Priya Nair
priya@acme.com
For Windsurf and Devin Desktop
Host a Windsurf app behind your company login
You built an internal tool in Windsurf. TeamOnly puts it at a private link that only coworkers can open, with their work Google or Microsoft account or a code sent to their work email. The agent in your editor does the deploy.
deploy this on TeamOnlyRun npx teamonly deploy? Waiting for your approval.Live at https://stock.acme.teamonly.appOnly @acme.com accounts can sign in.01Short answer
Windsurf is now Devin Desktop. It still reads AGENTS.md.
Windsurf became Devin Desktop on 2 June 2026, as a normal update to the same app. Its agents read AGENTS.md, and npx teamonly init writes the TeamOnly rules there.
So: run init once, ask the agent for the tool, then ask it to deploy. It runs npx teamonly deploy in the editor’s terminal and you get a link like stock.acme.teamonly.app that nobody outside your company can open.
02Steps
From a folder in Windsurf to a link your team signs in to
Add the rules
Open the app’s folder and run
npx teamonly initin the editor’s terminal. In an empty folder it creates a starter app; in an existing one it adds the TeamOnly files and leaves your code alone.Ask for the tool
In the agent panel (Devin Local, or Cascade if you still use it): “A stock counter where anyone on the floor logs a count from their phone.” It builds a React front end and a small API, the one shape TeamOnly runs.
Deploy
Say “deploy this on TeamOnly”. The agent runs
npx teamonly deployand asks you to approve the command first, unless you have allowed it.Sign in once
The first time, the agent asks for your work email and the 6-digit code we send you. If your company is new to TeamOnly, it offers a free 14-day trial.
Share the link
Send it to the team. Change the app later and deploy again; the link stays the same.
npx teamonly initAdded the TeamOnly instructions for Claude Code, Cursor and other AI tools npx teamonly deployLive at https://stock.acme.teamonly.app03What the agent reads
The rules the agent follows in this project
init writes a marked block into AGENTS.md at the top of the project, and leaves the rest of the file alone if you already have one. The block describes the app shape, how to get the signed-in person, the database and files, and how to deploy.
Cognition’s docs say Devin Desktop finds AGENTS.md on its own. For Cascade, a root AGENTS.md is an always-on rule, included on every message. The newer Devin Local agent also reads rules and AGENTS.md. You don’t need a .windsurf/rules file; the docs list that folder as a legacy location next to .devin/rules.
That is what stops the agent from adding Express, Next.js, Supabase or a login page. Those don’t run on TeamOnly, and the rules say so.
04Running commands
The agent runs the deploy, with your approval
Both agents can run terminal commands. Cascade asks before each command unless you allow it, or turn on Turbo mode, which runs everything except your deny list. Devin Local uses its own allow, ask and deny rules. Either way you can approve npx teamonly deploy once and let it run.
One thing to skip: Devin Desktop has its own App Deploys, which put an app on Netlify at a public URL. That is for apps anyone may open. For a tool only coworkers should use, deploy to TeamOnly instead.
05MCP option
Add TeamOnly as a tool in Devin Desktop
The teamonly package is also an MCP server, so the agent can deploy, read logs and change who can open an app through tools instead of commands. Add this to mcp_config.json:
{ "mcpServers": { "teamonly": { "command": "npx", "args": ["-y", "teamonly", "mcp"] } } }Cognition’s docs put the file at ~/.config/devin/mcp_config.json (on Windows %APPDATA%\devin\mcp_config.json). In Cascade, open it from the … menu at the top of the panel, then Open MCP config file. Devin Local asks before it calls an MCP tool, and you can allow the TeamOnly tools for the session or for good. With the Devin CLI, the same thing is one command:
devin mcp add teamonly -- npx -y teamonly mcp06What coworkers see
A sign-in page, then your app
Your coworkers don’t need Windsurf, a Devin account or anything installed.
They open the link and sign in with their work Google or Microsoft account, or a code sent to their work email. TeamOnly checks that before any of your code runs, and your app gets their name and email. Anyone outside your company stops at the sign-in page. People who only use apps are free. How company login works.
A door marked Staff only stands in front of the expenses app. Sam, signed in as sam@acme.com, is checked at the door and walks in. Next, randomperson@gmail.com and a bot are checked at the same door and turned away. They never reach the app, because the check happens at the door, before the app.
Is Windsurf the same as Devin Desktop?
Yes. Cognition’s FAQ says Devin Desktop is the new name for Windsurf, delivered on 2 June 2026 as a normal update, with plans, extensions and settings carried over. Everything on this page applies to both names.
Does Windsurf read AGENTS.md or .windsurf/rules?
Both, but you only need AGENTS.md. Devin Desktop discovers AGENTS.md automatically, and a root file applies to every message in Cascade. npx teamonly init writes the TeamOnly rules there. .windsurf/rules still works but is listed as a legacy location.
Can the agent run npx teamonly deploy?
Yes. Cascade and Devin Local both run terminal commands. They ask you to approve a command unless your settings allow it, so you will usually click approve once.
Why not use Windsurf’s built-in deploy?
App Deploys puts apps on Netlify at a public URL. That suits a public site. An internal tool with company data should sit behind your company login, which is what TeamOnly does on every app, with a database and file storage included.
Do I need the MCP server?
No. The agent can run the commands in the terminal. The MCP server is there if you prefer it to use tools, for example to read the live app’s logs or change who can open it.
What does it cost?
The first 14 days are free, no card. Then Builder is $19 a month for one builder and 3 apps, and Team is $249 a month for every builder and app. Coworkers who only use apps are free. Your Windsurf or Devin plan stays as it is.
Sources
Facts about Windsurf and Devin Desktop checked 26 October 2026 on Cognition’s docs: Devin Desktop FAQ, AGENTS.md, Devin Local, terminal, Cascade MCP, Devin CLI MCP, App Deploys. The product is changing quickly; check its docs if something looks different.
Keep reading
Early access
Put your first tool online this week.
TeamOnly is in early access, and every plan is open now. Try it free for 14 days with no card, or subscribe. Either way, your company is ready right away, and three commands put your first app online.
Not ready? Get updates
Questions go to hello@teamonly.dev, and a person answers.