Claude Code MCP whitespace warning: a pasted Sume key with a newline

If claude mcp list or /mcp shows "Leading or trailing whitespace in: headers.Authorization" for your Sume entry, the pasted API key carries a hidden space or newline, and Claude Code sends it exactly as written. The fix is to re-add the entry with a clean value. Claude Code's MCP page says it warns about this and does not trim the value.

Source: Connect Claude Code to tools via MCP, read 2026-10-02; the Sume side is from MCP OAuth and API keys.

What exactly does Claude Code check?

The page says Claude Code warns when an MCP config value carries hidden leading or trailing whitespace, which often comes from pasting a token with a trailing newline. It checks command, url, each args entry, and the values and key names under env and headers. The warning names the affected fields without echoing their values, and appears in claude mcp list output and in /mcp.

Why does a stray newline matter for Sume?

Sume reads the key from either Authorization: Bearer <key> or x-api-key: <key>. A key with a trailing space or newline is a different string from the one in your dashboard. Claude Code uses the value exactly as written, so what you pasted is what is sent. If the connection then fails, check whitespace before you suspect the key. The page does not say how any particular server reacts to the extra character.

How do I fix it?

Remove the entry and add it again from a file instead of a paste. In a shell, command substitution drops trailing newlines, so reading the key from a file works where copy and paste may not.

claude mcp remove sume
claude mcp add --transport http sume https://mcp.sume.com/mcp \
  --header "Authorization: Bearer $(cat ~/.config/sume/key)"
claude mcp list

What else should I do after a bad paste?

Check the details, then decide whether the key needs replacing.

• Run claude mcp get sume; for a failed connection the page says it shows an Issue: line with the HTTP status or error code, with credential-like text redacted.
• If the key was echoed into chat or a log, create a new one in the dashboard and revoke the old one.
• For interactive use, claude mcp login sume runs OAuth from the shell, so you paste no secret; the default grant is mcp:read.