Claude MCP connector needs an https URL and a token: Sume's endpoint

Sume qualifies on the URL: the hosted endpoint is https://mcp.sume.com/mcp, and Anthropic's connector page says the url field is required and must start with https. The token is the other half. The connector's authorization_token is described as the OAuth token if the server needs one, and Sume's docs say OAuth sessions are mcp:read by default with mcp:write opt-in, while an API key sees everything.

Fields

The server entry has type, url, name and optionally authorization_token; the toolset then refers to the same name.

Pick the credential on purpose

For an agent that must not spend, use an OAuth token granted without Write. For one that must create media, grant mcp:write and still pass idempotency_key on every paid call. API-key sessions skip scopes and see all tools, so reserve them for code you control. The full matrix is on the OAuth page.

Anthropic also marks the connector feature as beta (header mcp-client-2025-11-20), so check the page again before you ship.

Checks before the first request

Test the credential outside the model first. Connect with the same token in an MCP client and call mcp_health: it reports how the session authenticated, and tools_list shows which tools the token can see. If tools_list shows only read-only tools, the token has no Write; a paid call would return insufficient_scope.

Keep tokens out of prompts and logs. The connector takes the token as a field of the server entry, so it never needs to appear in the conversation. Rotate an API key if it was ever pasted into a chat or a shared notebook.

• Never echo the token in error reports.
• Use separate credentials for read-only and write agents.
• Re-read Anthropic's page before relying on beta fields.