Devin CLI talks to Agent Update over MCP. The server is https://api.tryagentupdate.com/v1/mcp, the transport is Streamable HTTP, and the credential is one header.
Where it goes: .devin/mcp_config.local.json (gitignored — put the token here) · .devin/mcp_config.json (committed) · ~/.config/devin/mcp_config.json
Setup
{
"mcpServers": {
"agent-update": {
"url": "https://api.tryagentupdate.com/v1/mcp",
"transport": "http",
"headers": { "Authorization": "Bearer ${env:AGENT_UPDATE_TOKEN}" }
}
}
}Before you file a bug
devin mcp add has no --header flag. It creates the entry and you add headers by hand. Set "transport": "http" explicitly: a remote server defaults to Streamable HTTP but falls back to SSE on any 4xx, so a bad token reads as a transport bug rather than an auth bug. Before CLI v3000.3, MCP servers lived in .devin/config.json. Devin cloud sessions are not verified for user-supplied remote MCP, so don't promise it. Do not cross-paste with Windsurf Cascade, which wants serverUrl instead of url.
Check it worked
Ask the agent to text you. A 401 means the token is wrong, or the word Bearer is in there twice. No tool at all means the transport string is wrong. Both are covered in troubleshooting.
Next
The five tools and their arguments are on the MCP page. The same tools over plain HTTP are on the REST page. Every other tool is on the docs index.