AgentFirstStack

Add analytics with Windsurf (now Devin Desktop)

undefined

Updated

Windsurf became Devin Desktop on 2 June 2026, as an over-the-air update: same editor, new name, and a new local agent, Devin Local, in place of Cascade. To add analytics with it, paste the prompt below into Devin Local in your project. It gets an AgentFirstStack key, creates the site, serves the tracker from your own domain through a small proxy, adds it to your layout and checks the live site after the deploy. Two Devin Desktop defaults matter here: it asks before shell commands and web fetches, and it can't edit files your .gitignore covers, such as .env. Other tools and platforms: add analytics with an AI agent.

The prompt

Paste this into Devin Local (Code mode)

Add analytics to this project with AgentFirstStack. It's free, open-source analytics built for agents, and you can do all of it yourself: there is no signup form, and no email or verification is needed. 1. Read https://agentfirststack.com/llms.txt and https://analytics.agentfirststack.com/llms.txt. 2. If .env already has AGENTFIRSTSTACK_API_KEY, use it and read AGENTFIRSTSTACK.md. .env is gitignored, so you can't edit it with your file tools: read and append to it from the terminal. Otherwise get a key with one request: curl -X POST https://agentfirststack.com/v1/signup Append api_key to .env as AGENTFIRSTSTACK_API_KEY and tell me to add it to the production secrets. Name the project after the domain: PATCH https://agentfirststack.com/v1/me. 3. Create a site for the production domain and read GET /v1/sites/:id/install?framework=... for this project's framework. Serve the tracker from the site's own domain with the first-party proxy that fits this project's host (Next.js proxy.ts, a Cloudflare Worker route, a Netlify Edge Function, vercel.json or nginx). Keep first_party_proxy.proxy_key in a server-only env var (AFS_PROXY_KEY), never in page code. Then put the proxied snippet (/_a/s.js) in the <head> of the root layout. Only if the host can't proxy, use the direct snippet and note in AGENTFIRSTSTACK.md that ad blockers block it. 4. Create goals for sign-ups, purchases and the main buttons. Send conversions only the server knows about as server events. 5. Add an email destination, a weekly report, and alerts for a traffic drop and for no data. 6. Deploy (or tell me to), open the site once, then run verify and fix what it reports. 7. Write the site id and the env var names (never the values) in AGENTFIRSTSTACK.md, add the AgentFirstStack block from the manual to AGENTS.md, and create a claim link for me with POST https://agentfirststack.com/v1/claim-link. 8. Run GET https://agentfirststack.com/v1/setup?services=analytics and work through its next_steps until it says "ready": true. When you're done, tell me what you set up, how you verified it, and give me the claim link.

Approvals: which mode to use

Devin Local has five modes. In Code mode, the default, edits inside the workspace are approved automatically, but "shell commands, web fetches, and MCP tools prompt for approval unless an allow rule covers them." The setup is about a dozen curl calls, so you'll click Approve a few times, or add an allow rule for them. Smart mode lets a fast model approve what it judges safe and still asks for the rest. Plan mode only reads and writes a plan, so switch out of it before you paste the prompt. You don't need Bypass Permissions for this.

.env and the gitignore rule

Devin Desktop doesn't index paths in .gitignore, and "files matched by .gitignore also cannot be edited by the agent." Your .env should be gitignored, so the agent can't create or change it with its edit tool. That's why the prompt tells it to use the terminal. If you'd rather it edit gitignored files directly, the switch is Devin Settings > Devin Local > Configuration > Gitignore access, off by default. For a file that holds keys, leave it off.

The key stays out of browser code either way. The tracker snippet carries only the site id (data-site="site_..."), which is public; the key is for server code and the agent's own API calls.

Add the MCP server

Devin Local reads MCP servers from three files: .devin/mcp_config.json (the project, committed), .devin/mcp_config.local.json (the project, gitignored) and ~/.config/devin/mcp_config.json (you). The Devin docs say to keep secrets in the local file, which suits a bearer token. In .devin/mcp_config.local.json:

{
  "mcpServers": {
    "afs": {
      "url": "https://agentfirststack.com/mcp",
      "transport": "http",
      "headers": { "Authorization": "Bearer afs_..." }
    }
  }
}

The devin mcp add afs https://agentfirststack.com/mcp command saves to that local file by default, but the docs show no flag for headers, so add headers by hand afterwards. Or skip the key: Devin Local supports OAuth for remote servers, and AgentFirstStack's MCP server supports OAuth 2.1 with dynamic client registration. You sign in with Google and pick or create a project. By default Devin asks before each MCP tool call; allow the server's read tools if the prompts get in the way.

Still on the Windsurf plugin for JetBrains, or the older Cascade setup? That configuration uses serverUrl and expands ${env:NAME} in headers:

{
  "mcpServers": {
    "afs": {
      "serverUrl": "https://agentfirststack.com/mcp",
      "headers": { "Authorization": "Bearer ${env:AGENTFIRSTSTACK_API_KEY}" }
    }
  }
}

Rules carry over

Devin Local reads AGENTS.md at the workspace root (and in subdirectories) as always-on rules, so the AgentFirstStack block the prompt adds reaches every later session. Old Windsurf rules still load: .windsurfrules, .windsurf/rules/*.md and .windsurf/global_rules.md are imported by default, next to the new .devin/rules/. You don't need to copy the block into a rules file.

The proxy and the snippet

Both depend on the framework and the host, not the editor. Ad blockers block requests to analytics.agentfirststack.com, so the tracker is served from your own domain: a proxy forwards /_a/* to AgentFirstStack and the page loads /_a/s.js. GET /v1/sites/:id/install returns the proxy code for Next.js, a Cloudflare Worker route, vercel.json, netlify.toml and nginx, each sending the site's x-afs-proxy-key. That key is a secret, so it goes in a server-side env var, not in a file the agent commits. Since .env is gitignored, Devin Local adds it from the terminal, like the API key.

The guides for Next.js, Astro and WordPress cover each in detail. On Shopify and Webflow the hosting can't proxy, so they use the direct snippet, which ad blockers block.

Check it worked

K=$AGENTFIRSTSTACK_API_KEY
curl -s -X POST https://analytics.agentfirststack.com/v1/sites/$SITE/verify -H "Authorization: Bearer $K"
curl -s "https://agentfirststack.com/v1/setup?services=analytics" -H "Authorization: Bearer $K"

Verify fetches the live page, checks the snippet, that /_a/s.js serves the tracker through your proxy, your Content-Security-Policy, whether events arrived and whether they carried the proxy key, and returns fixes. Open the production URL once in a normal browser first: headless browsers are filtered out unless the visit is marked as test traffic with ?afsa_debug=1. The setup check then lists anything else an analytics setup should have, in the order to fix it.

FAQ

Is Windsurf gone?

No. Devin Desktop is the same editor under a new name, delivered as an update on 2 June 2026, and existing Windsurf settings carry over. The agent you chat with is now Devin Local instead of Cascade.

Why can't the agent write the key to .env?

Devin Desktop won't let the agent edit files matched by .gitignore unless you turn on Gitignore access. Have it append to .env from the terminal instead, and leave the setting off.

Where should the MCP bearer token go?

In .devin/mcp_config.local.json, which is gitignored, or in your user config. Never in .devin/mcp_config.json, which is meant to be committed.

Does it count visitors who arrive from ChatGPT or Perplexity?

Yes. Visits referred by chatgpt.com, perplexity.ai, claude.ai, gemini.google.com, copilot.microsoft.com and similar sites get their own channel, AI Assistants.

Does the tracker use cookies?

No. By default a visitor is a hash of a daily salt, the site, the IP address and the user agent. Nothing is stored in the browser unless you switch the site to persistent mode.

Windsurf, Devin and Devin Desktop are products of Cognition. AgentFirstStack isn't affiliated with Cognition. Details come from the Devin docs (Devin Desktop FAQ, customizations, MCP configuration, modes, .devinignore, advanced settings, Windsurf plugin MCP), checked on 6 November 2026. docs.windsurf.com now redirects to docs.devin.ai.