Claude MCP connector denylist: switch off Sume's paid tools

To keep a Claude Messages API agent from spending credits, enable the Sume server's tools and disable the paid ones by name in configs. Anthropic's connector page says denylisting write or destructive tools is recommended for read-only assistants and where you want a human confirmation step before state changes. The allowlist form is safer, because a denylist misses any paid tool Sume adds later.

The toolset

The names below are the paid tools on Sume's hosted tool list. The server is added under mcp_servers with an https URL and an authorization_token, and the toolset refers to it by name.

{
  "type": "mcp_toolset",
  "mcp_server_name": "sume",
  "configs": {
    "generate_image": {"enabled": false},
    "generate_video": {"enabled": false},
    "music_create": {"enabled": false},
    "tts_create": {"enabled": false},
    "stt_create": {"enabled": false},
    "image_upscale_create": {"enabled": false},
    "rmbg_create": {"enabled": false},
    "video_upscale_create": {"enabled": false},
    "kling-motion-control_create": {"enabled": false}
  }
}

Why this is the weaker option

The avatar tools, avatars_create and avatar-videos_create, are also paid, and so are others in the registry; a list you wrote today may be stale after a release. Compare the options.

Best of both

If you can choose the credential, use an OAuth read-only session: Sume's docs say mcp:read sessions see only read-only tools, and a write call returns insufficient_scope. Layer the toolset config on top as a second lock.

Adding the human step

A denylist alone gives you a read-only agent. To let the agent propose a paid call, run a second request in your own code: the model returns the arguments it would use, your code shows them to a person, and only your code makes the call. Include dry_run=true on the first pass so the person sees usage.credits, then submit again with the same arguments and a new idempotency_key.

This keeps the model out of the spending decision without hiding what it wanted to do.

• Show the person the estimate, not just the prompt.
• Derive the key from your own order id.
• Log the dry-run and the real call together.