How do I query my agents’ traces from inside Windsurf?

Rius lets you query your agents’ traces from Windsurf by adding the Rius MCP server to Windsurf’s MCP config and signing in with your Rius account. Once connected, you ask Windsurf in plain language about traces, cost, tokens and alerts, and it answers from your real telemetry. The setup is one config entry, a refresh and a browser sign-in. The MCP page covers every client in full.

How it works

The Rius MCP server is an endpoint your AI client connects to so it can read your telemetry. Windsurf talks to it over streamable HTTP at https://mcp.eu.console.rius-glassflow.com/mcp.

Two things differ from the generic setup:

• Windsurf reads its servers from ~/.codeium/windsurf/mcp_config.json.
• Windsurf uses the field serverUrl where most clients use url.

Sign-in is your Rius account over OAuth, and Windsurf handles the browser flow. After that, Windsurf picks the right Rius tools for each question. For example, it uses list_agent_traces and get_agent_trace for trace lists and span waterfalls, and agent_traces_summary and workspace_metrics_overview for cost, tokens and error rate. For alerts it uses list_alerts, get_alert and list_alert_rules.

Windsurf is not one of the coding agents the Rius plugin traces. The plugin covers Claude Code, Codex (beta) and Cursor (beta), and you can read about them under Coding agents. Because the plugin is not involved here, you add the server yourself under the name rius.

Set it up

1. Open ~/.codeium/windsurf/mcp_config.json and add the Rius server. Note serverUrl, not url:

{
  "mcpServers": {
    "rius": {
      "serverUrl": "https://mcp.eu.console.rius-glassflow.com/mcp"
    }
  }
}

2. Press Refresh in Windsurf’s MCP panel so it picks up the new server.
3. Sign in with your Rius account when the browser flow opens. Windsurf handles the rest of the OAuth flow. If you can sign in to the Rius console, the MCP sign-in works too.
4. Verify the connection by asking Windsurf: “Who am I in Rius, and which workspaces can I access?” Windsurf should call the get_me tool and answer with your email and a workspace table.
5. Ask your first real question, such as “Summarize my agent traffic over the last 24 hours.”

If the server shows as connected but lists no tools, finish the browser sign-in, because many clients show a server as connected before OAuth completes. If the sign-in loops or reports an auth error, remove the server and add it again. A stale cached token is the usual cause after a long idle period.

Connect without a browser

For a Windsurf setup that cannot complete the OAuth flow, use a read-scoped API key instead. Mint one from the Connect an agent button on the console’s MCP page, or from Settings → API keys with the Query data (read) capability. Then add a headers block next to serverUrl:

{
  "mcpServers": {
    "rius": {
      "serverUrl": "https://mcp.eu.console.rius-glassflow.com/mcp",
      "headers": { "Authorization": "Bearer ri_..." }
    }
  }
}

The key is shown once, so store it as a secret. Ingest keys, which is what the SDK uses, cannot query through the MCP server. A key reaches only the single workspace it was created in.

What you get

Windsurf answers questions about your agents without you leaving the editor. Typical questions include:

• Traces: “List the failed runs from this week and show me what went wrong in the worst one.” Windsurf filters the trace list by status, then opens the span waterfall of the run you pick.
• Cost and tokens: “Which service is spending the most right now?” or “Summarize my agent traffic over the last 24 hours.” You get traces, LLM calls, error rate, cost, tokens and latency percentiles. Costs are list-price estimates in US dollars, not billed amounts.
• Agents and users: which agents have errors, how versions compare, and what each end user’s activity looks like.
• Alerts: which alerts are firing, the details of one alert, and which rules exist.

With an OAuth sign-in, the tools see the workspaces your user can access and act with your role. Every member can read and acknowledge a firing. Creating API keys and managing alert rules are admin actions. A read-only key cannot manage alerts, and no key can acknowledge a firing or mint other keys. Nothing the server offers can create, rename or delete workspaces, or change members. Those stay in the console.

Rius also records each MCP call, with the tool, client, outcome and latency, and keeps those rows for 30 days. Tool results are never stored.

When something else fits

• If you want Windsurf’s own sessions traced as a Rius trace, Windsurf is not a supported source today. Use the plugin for Claude Code, Codex (beta) or Cursor (beta) instead.
• If a task needs a browser-free agent with alert management, mint a key with the alert scopes in the Connect an agent dialog. An admin has to do this.
• For a client that only speaks stdio, bridge to the remote URL with npx mcp-remote https://mcp.eu.console.rius-glassflow.com/mcp.

Related