# Devin Desktop

> Connect Devin Desktop, formerly Windsurf, to Golem through its hooks and MCP configuration.

There is nothing to configure by hand. Windsurf was renamed Devin Desktop in June 2026, and its default agent, Devin Local, shares its hooks and settings with the Devin CLI. When you [install Golem](/install) on a machine that has either, the Golem agent writes its hooks and MCP servers into Devin's configuration. From then on every tool call is checked against your [rules](/rules) before it runs and signed into the record after.

## What Golem adds

Golem writes its part of three places under `~/.config/devin`, which the desktop app and the CLI share:

| File | What Golem writes |
|---|---|
| `config.json` | Hooks for `SessionStart`, `UserPromptSubmit`, `PreToolUse` and `PostToolUse`, each running `golem devin-hook <Event>`. Under `permissions.allow`, Golem's read-only tools (`list_agents`, `golem_status`, the timeline and search tools), so Devin runs those without asking. A Golem tool that writes or acts, `send_message` included, still asks. |
| `mcp_config.json` | Golem's two MCP servers, `golem-witness` and `golem-context`, under `mcpServers`. |
| `skills/` | Golem's skills. |

Your own hooks, approvals and servers are left as they were. Restart Devin after the first install so it loads the new hooks and servers.

Each hook command runs only while the `golem` binary is present, so a removed binary never stops Devin's work.

The Golem agent recognizes Devin from the desktop app, the CLI, or a Windsurf install. If Devin arrives after Golem, the next check (every 15 minutes by default) wires it. To wire it straight away, run:

```bash
golem setup-client
```

## What a block and a hold look like

A blocked call does not run. Devin shows the model the reason, which names the rule and carries a decision id:

```text
blocked by Golem policy (rule "no-force-push-to-main", decision gd_3f9a1c07b2e4d815). Trying again won't change this. If it's a false positive, the user can ask the security team for an exception: golem exception gd_3f9a1c07b2e4d815 --reason "why".
```

Devin's hooks can approve or block a call, with no option to ask a person. So a rule set to Ask cannot become an approval prompt here:

| The rule asks | In Devin |
|---|---|
| The person at the keyboard | The call is refused, and the reason says this agent can't ask here. Golem never quietly allows a call it was told to hold. |
| Your team | The call is refused, and the reason tells the agent your security team decides in the console and to quote the decision id. |
| Golem's reviewer agent | The call waits while the reviewer decides, for about 35 seconds at most. If no decision has come back yet, the agent is told to wait and retry the same call. |

When a rule on the prompt-injection check blocks a tool's result, Devin is told to block it with Golem's reason.

A machine you [quarantine](/response#quarantine-a-machine) is held to its locked-down toolset on this same hook. See [Block, hold and contain](/response) for the full picture.

## What is recorded

- Every tool call before it runs and after it returns, with its arguments. The tool's output is not stored. Devin's tool names are recorded under the names Claude Code uses for the same tools (`exec` as `Bash`, `read` as `Read`, `write` as `Write`, `edit` and `apply_patch` as `Edit`), so one rule covers both agents.
- MCP calls Devin makes through its generic `mcp_call_tool`, recorded as `mcp__<server>__<tool>` when the call names its server and tool.
- Each decision Golem made, signed into the session's [record](/record).

Messages from other agents reach a Devin session at its next session start, prompt or tool result. See [Agent coordination](/coordination).

The Golem agent also reads how Devin is set up to run. A session started with `--permission-mode bypass`, or a `config.json` whose `permissions.allow` lists `exec` outright (every shell command runs without asking), shows under **Security Inventory → Agent settings**. See [Roll out to a fleet](/fleet).

## Check that it is working

1. Run `golem doctor`. It confirms the Golem agent is running and enrolled.
2. Run `golem setup-client`. On a wired machine it reports that clients already point at the Golem agent; otherwise it lists the files it changed.
3. Start a Devin session and ask it which other agents are running on this machine. It should answer from Golem's `list_agents` tool without asking you first.
4. In the console at [app.golem.team](https://app.golem.team), open **Conversations**. The session appears under the agent `devin`.

## Limits

- **Cascade, Windsurf's older agent, is not covered.** Its hooks can block an action but cannot put text in front of the model, so it could never receive a message from another agent. Devin Desktop starts new tabs on Devin Local.
- **What was said is not recorded.** Golem records what the agent did. Your prompts reach the Golem agent only so it can answer with context and messages, and Golem does not hook the model's replies.
- **Claude Code settings Devin imports are not relied on.** Devin reads Claude Code's hooks and MCP servers by default, but Golem's Claude Code hooks are a kind Devin's hooks do not support, so Golem uses the entries above instead.
- **`XDG_CONFIG_HOME` is ignored.** The Golem agent runs as a background service and cannot see your shell's environment, so it wires `~/.config/devin`.
- **The hooks are written for macOS and Linux shells.**
- **The shell jail does not apply.** It covers Claude Code on macOS. See [Shell jail and sandbox](/shield).
- **If the Golem agent is down, calls run.** The hook allows the call rather than stop your work, and nothing is recorded until it is back.

More in [Coverage](/coverage) and [Limits](/limits).

## Remove it

`golem setup-client --remove` takes Golem's hooks, approvals, servers and skills out of every AI client on the machine, Devin included, and remembers the choice so the periodic check does not put them back. To remove Golem entirely, see [Uninstall](/install#uninstall).