Devin CLI · Continuity · Jun 15–21, 2026
3 releases · updated
Devin CLI improves MCP parsing and adds plugins
This week, Devin CLI shipped three releases with improvements to MCP registry parsing and the introduction of plugins. The main change helps users working with old and inconsistent schemas. These updates are useful for developers and administrators working with Devin CLI.
v2026.7.23 · June 18, 2026
This release fixed an issue with MCP registry parsing, making it more tolerant of old and inconsistent schemas.
Official release notes
Fixed
- Made MCP registry parsing more tolerant of old and inconsistent schemas.
v2026.7.19 · June 17, 2026
This release fixed a bug with loading skill files that use alternative fields.
Official release notes
Fixed
- Fixed a bug with loading skill files that use alternative fields.
v2026.7.16 · June 16, 2026
This release introduced plugins, which allow users to install bundles of skills from various sources, and expanded enterprise controls for governing Devin Local. It also added several new commands for managing plugins and improved authentication in third-party ACP clients.
Official release notes
Plugins
Install bundles of skills from a GitHub repo, a git URL, or a local folder, and share them across projects. A plugin is any source containing a .devin-plugin/plugin.json manifest and a skills/ directory; its skills become available as /<plugin>:<skill>. A plugin can require other plugins (installed automatically), endorse optional ones, and forbid others — so a plugin can act as a curated, governed collection. Plugins are in beta and opt-in for enterprises, so behavior and configuration may change in future releases. See the plugins overview for details.
Enterprise controls
Expanded controls for admins to govern what Devin Local can do and which tools it can reach.
- Teams can define terminal command allow/deny lists, enforced through CLI permission scopes with exact-command matching and
*wildcards. - Org-level control to disable Devin CLI plugins: when set, the CLI refuses to install or update plugins and skips the skills from any installed plugins.
- The “Disable CLI access” team setting is now enforced for Devin Local (the CLI hosted in Windsurf), including the bundled agent registry and the allowed-MCP-server allowlist.
Added
devin plugins install <source>installs a plugin (and its required plugins) from a GitHubowner/repo, a git URL, or a local path.devin plugins listshows installed plugins with their version and whether they are currently blocked by policy.devin plugins info <plugin>shows the skills a plugin provides and its required, optional, and forbidden lists.devin plugins update [plugin]re-fetches a plugin (or all plugins) at the latest version; local plugins are linked to their source folder so edits are live without re-installing.devin plugins remove <plugin>uninstalls a plugin, leaving any auto-installed required plugins in place.forbiddenPluginsentries accept glob patterns (e.g.acme/*,*/secrets,https://gitlab.com/acme/*) in addition to exact identities and the lone*lockdown.
Changed
- Improved authentication in third-party ACP clients, including JetBrains and Zed: both browser and manual sign-in now use the Devin auth flow, so the manual
/loginfallback works where it previously failed.
Fan coverage from Devin Central — not an official Cognition announcement. Devin is a trademark of Cognition.
Follow Devin CLI changes
Get Devin CLI changes in the Monday email, with the rest of the week's Devin news.
Prefer a feed reader? Devin CLI RSS feed