# Host a Windsurf app behind your company login

> Canonical: https://teamonly.dev/windsurf

You built an internal tool in Windsurf. TeamOnly puts it at a private link that only coworkers can open, with their work Google or Microsoft account or a code sent to their work email. The agent in your editor does the deploy.

## Windsurf is now Devin Desktop. It still reads AGENTS.md.

Windsurf became Devin Desktop on 2 June 2026, as a normal update to the same app. Its agents read `AGENTS.md`, and `npx teamonly init` writes the TeamOnly rules there.

So: run `init` once, ask the agent for the tool, then ask it to deploy. It runs `npx teamonly deploy` in the editor's terminal and you get a link like `stock.acme.teamonly.app` that nobody outside your company can open.

## From a folder in Windsurf to a link your team signs in to

1. **Add the rules.** Open the app's folder and run `npx teamonly init` in the editor's terminal. In an empty folder it creates a starter app; in an existing one it adds the TeamOnly files and leaves your code alone.
2. **Ask for the tool.** In the agent panel (Devin Local, or Cascade if you still use it): "A stock counter where anyone on the floor logs a count from their phone." It builds a React front end and a small API, the one shape TeamOnly runs.
3. **Deploy.** Say "deploy this on TeamOnly". The agent runs `npx teamonly deploy` and asks you to approve the command first, unless you have allowed it.
4. **Sign in once.** The first time, the agent asks for your work email and the 6-digit code we send you. If your company is new to TeamOnly, it offers a free 14-day trial.
5. **Share the link.** Send it to the team. Change the app later and deploy again; the link stays the same.

```
$ npx teamonly init
✔ Added the TeamOnly instructions for Claude Code, Cursor and other AI tools
$ npx teamonly deploy
✔ Live at https://stock.acme.teamonly.app
```

## The rules the agent follows in this project

`init` writes a marked block into `AGENTS.md` at the top of the project, and leaves the rest of the file alone if you already have one. The block describes the app shape, how to get the signed-in person, the database and files, and how to deploy.

Cognition's docs say Devin Desktop finds `AGENTS.md` on its own. For Cascade, a root `AGENTS.md` is an always-on rule, included on every message. The newer Devin Local agent also reads rules and `AGENTS.md`. You don't need a `.windsurf/rules` file; the docs list that folder as a legacy location next to `.devin/rules`.

That is what stops the agent from adding Express, Next.js, Supabase or a login page. Those don't run on TeamOnly, and the rules say so.

## The agent runs the deploy, with your approval

Both agents can run terminal commands. Cascade asks before each command unless you allow it, or turn on Turbo mode, which runs everything except your deny list. Devin Local uses its own allow, ask and deny rules. Either way you can approve `npx teamonly deploy` once and let it run.

**One thing to skip:** Devin Desktop has its own App Deploys, which put an app on Netlify at a public URL. That is for apps anyone may open. For a tool only coworkers should use, deploy to TeamOnly instead.

**Or just ask the agent.** In the app's folder, type **"deploy this on TeamOnly"**. The agent sets up the app if needed, asks for your work email and the code we send you, and deploys.

## Add TeamOnly as a tool in Devin Desktop

The `teamonly` package is also an MCP server, so the agent can deploy, read logs and change who can open an app through tools instead of commands. Add this to `mcp_config.json`:

```
{ "mcpServers": { "teamonly": { "command": "npx", "args": ["-y", "teamonly", "mcp"] } } }
```

Cognition's docs put the file at `~/.config/devin/mcp_config.json` (on Windows `%APPDATA%\devin\mcp_config.json`). In Cascade, open it from the **…** menu at the top of the panel, then **Open MCP config file**. Devin Local asks before it calls an MCP tool, and you can allow the TeamOnly tools for the session or for good. With the Devin CLI, the same thing is one command:

```
devin mcp add teamonly -- npx -y teamonly mcp
```

All the tools: https://teamonly.dev/mcp

## A sign-in page, then your app

Your coworkers don't need Windsurf, a Devin account or anything installed.

They open the link and sign in with their work Google or Microsoft account, or a code sent to their work email. TeamOnly checks that before any of your code runs, and your app gets their name and email. Anyone outside your company stops at the sign-in page. People who only use apps are free. [How company login works](https://teamonly.dev/company-login).

## Questions people ask

### Is Windsurf the same as Devin Desktop?

Yes. Cognition's FAQ says Devin Desktop is the new name for Windsurf, delivered on 2 June 2026 as a normal update, with plans, extensions and settings carried over. Everything on this page applies to both names.

### Does Windsurf read AGENTS.md or .windsurf/rules?

Both, but you only need `AGENTS.md`. Devin Desktop discovers `AGENTS.md` automatically, and a root file applies to every message in Cascade. `npx teamonly init` writes the TeamOnly rules there. `.windsurf/rules` still works but is listed as a legacy location.

### Can the agent run npx teamonly deploy?

Yes. Cascade and Devin Local both run terminal commands. They ask you to approve a command unless your settings allow it, so you will usually click approve once.

### Why not use Windsurf's built-in deploy?

App Deploys puts apps on Netlify at a public URL. That suits a public site. An internal tool with company data should sit behind your company login, which is what TeamOnly does on every app, with a database and file storage included.

### Do I need the MCP server?

No. The agent can run the commands in the terminal. The MCP server is there if you prefer it to use tools, for example to read the live app's logs or change who can open it.

### What does it cost?

The first 14 days are free, no card. Then Builder is $19 a month for one builder and 3 apps, and Team is $249 a month for every builder and app. Coworkers who only use apps are free. Your Windsurf or Devin plan stays as it is.

## Sources

Facts about Windsurf and Devin Desktop checked 26 October 2026 on Cognition's docs: [Devin Desktop FAQ](https://docs.devin.ai/desktop/devin-desktop-faq), [AGENTS.md](https://docs.devin.ai/desktop/cascade/agents-md), [Devin Local](https://docs.devin.ai/desktop/devin-local), [terminal](https://docs.devin.ai/desktop/terminal), [Cascade MCP](https://docs.devin.ai/desktop/cascade/mcp), [Devin CLI MCP](https://docs.devin.ai/cli/extensibility/mcp/configuration), [App Deploys](https://docs.devin.ai/desktop/cascade/app-deploys). The product is changing quickly; check its docs if something looks different.

## Keep reading

- [Using Claude Code?](https://teamonly.dev/claude-code)
- [Using Cursor?](https://teamonly.dev/cursor)
- [The TeamOnly MCP server](https://teamonly.dev/mcp)
- [The docs](https://teamonly.dev/docs)
- [Pricing](https://teamonly.dev/pricing)

Try it free for 14 days, no card: https://teamonly.dev/pricing#trial. Or subscribe: https://teamonly.dev/pricing#subscribe (Builder $19/mo, Team $249/mo)
Not ready? Get updates: https://teamonly.dev/waitlist