Skip to main content
Book a demo

Connect Plaid to Windsurf

Give Windsurf governed access to Plaid’s 5 tools through Runlayer, with identity, policy, scanning, and audit on every call.

Book a demo Windsurf setup guide

Set up

Add Plaid to Windsurf in four steps

Admins approve the server once. Everyone in Windsurf then gets it through the same governed connection.

  1. 1

    Add Plaid to Runlayer

    Plaid isn’t in the Runlayer catalog yet, so an admin adds it by its MCP server URL.

    Adding a connector manually
  2. 2

    Connect Windsurf to Runlayer

    Users add the Runlayer Plugin to Windsurf by following Runlayer’s setup guide. Windsurf reaches Plaid’s 5 tools through the Runlayer Plugin’s search and execute tools instead of listing each one.

    Windsurf setup guide
  3. 3

    Sign in to Plaid

    Sign in the way Plaid requires. Runlayer holds the credentials so they stay out of the client’s configuration.

  4. 4

    Use Plaid from Windsurf

    Plaid’s approved tools appear in Windsurf. Every call is checked against policy and recorded.

Tools

5 Plaid tools in Windsurf

Runlayer policy decides which of these Windsurf users can call.

  • Debug item

    Diagnose a Plaid item by retrieving its state information.

  • Get link analytics

    Retrieves Plaid Link analytics data for analyzing user conversion and error rates.

  • Get tools introduction

    Returns a list of all available tools with a brief introduction for each.

  • Get usages

    Retrieves usage metrics for Plaid products and services.

  • List teams

    Retrieve teams associated with the user and present them as a selectable list.

Control

What Runlayer can see and stop in Windsurf

Some controls apply to every client at the gateway. Others depend on what Windsurf exposes to Runlayer.

  • Gateway policy (available)

    Every Plaid call from Windsurf passes through Runlayer, where your policies can allow, alert, mask, or block it.

  • Audit trail (available)

    Each call is recorded with the user, Windsurf as the client, the tool, and the policy and scanner decisions.

  • Client hooks (available)

    Capture supported prompts, reasoning, local and MCP tool calls, responses, and scanner decisions in real time.

  • Stop a call before it runs (available)

    Runlayer can deny a tool call before Windsurf runs it.

  • Block output after it runs (not available)

    Windsurf ignores Runlayer after a tool runs, so Runlayer cannot block its output. The gateway still applies policy to the call.

  • Redact output in place (not available)

    Windsurf has no way to receive replacement output, so Runlayer cannot mask it. The gateway still applies policy to the call.

In Windsurf

  • Enforcement needs Windsurf 1.12.31 or newer.
  • When Runlayer denies a call, Windsurf shows the reason to the user; Runlayer cannot adjust the call’s inputs.

Frequently asked questions

Connect more

Find another combination