Bolt custom MCP server: connect Sume, tools are on by default

To connect Sume in Bolt, open the Connectors (MCP) page, click Custom MCP server, enter a name, set the URL to https://mcp.sume.com/mcp, pick HTTP as the transport, choose MCP OAuth or API key, and click Connect. Bolt's help page says all connector tools are turned on by default, so connect with OAuth and leave Write off at first: Sume then exposes only read-only tools to the project.

What does Bolt ask for?

Bolt's custom MCP form has four fields: a recognizable name, the server URL, the transport type, and the authentication. It describes HTTP as the standard transport for most servers, with SSE available when a server's docs call for it. Sume's hosted endpoint is plain HTTP POST, so choose HTTP.

Why does tools-on-by-default matter for a paid service?

Generation tools spend money, so a connector that enables every tool automatically deserves care. On Sume you can control this at the grant instead of at the client. A hosted MCP OAuth session starts with mcp:read, and the tools that change data or spend wallet balance are hidden until the person turns on Write on the consent page. If the model calls one anyway, it gets insufficient_scope.

With an API key, the full hosted tool set is visible, so every paid call is possible. Paid and write calls require an idempotency_key, and you can set an optional max_spend_usd that Sume enforces when you provide it.

How do you go from read-only to generating?

Connect with OAuth, ask Bolt to call mcp_health, then tools_list. When you want the project's AI to create assets, reconnect and turn Write on at consent. Ask it to run dry_run=true first. A job that outlasts one call is resumed with jobs_wait, which holds at most 55 seconds per call, using the same job id.

What does the documentation not tell you?

The Bolt page does not list headers as a form field, and it does not mention plan requirements or usage limits. So the header-based key path may not be available in the form. If you need an API key, use the API key authentication option as Bolt describes it, and prefer OAuth when Sume's consent page fits your team.