Hook matcher for a plugin-bundled Sume server: mcp__plugin_ names

A hand-added server called sume exposes tools such as mcp__sume__generate_video. A server bundled in a plugin gets a longer name. The Claude Code hooks reference shows the pattern mcp__plugin_my-plugin_db__.* for a plugin-bundled server, so a Sume server named sume inside a plugin named sume-media would match mcp__plugin_sume-media_sume__.*.

That distinction matters for spend. A hook written for mcp__sume__.* silently matches nothing once the same server moves into a plugin, and your paid-call guard stops guarding.

Matcher forms for the same tool

Names below follow the hooks reference. The plugin form is an inference from its documented example; confirm it by logging tool_name from a real call before you rely on it.

A logging hook to learn the real name

Before writing a deny rule, add a hook that only records the tool name. This one writes to a file and approves nothing and denies nothing, because it exits 0 with no JSON.

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "mcp__.*sume.*",
        "hooks": [
          {
            "type": "command",
            "command": "jq -r .tool_name >> /tmp/sume-tool-names.log"
          }
        ]
      }
    ]
  }
}

Steps

Enable the plugin, run one harmless Sume read such as balance_get, and read the log. Copy the exact prefix into your guard hook. Then add the real rule: Sume's docs say write and paid tools require an idempotency_key, so a guard can deny any paid tool call whose input lacks one, or lacks max_spend_usd if your policy demands a cap.

• Use .* after the prefix; the characters make the matcher a JavaScript regex.
• Test with dry_run=true, which previews admission and cost without submitting a job.
• Keep plugin and project definitions of the same server from both loading, or the guard has to cover two prefixes.

Why a guard is worth the trouble

Sume's hosted tool set is not all free. The tools docs list paid generation tools such as generate_image, generate_video, music_create, tts_create and avatars_create, next to read tools like balance_get, jobs_list and tools_list. A model that has the full set can start paid work in one call. A PreToolUse hook is the one place on your side that sees every call before it leaves, whatever the model decided.

The hooks reference says a PreToolUse hook can return a permission decision of deny, allow, ask or defer, with a reason string that Claude sees. A deny with a clear reason (for example, "paid Sume tool needs max_spend_usd") lets the model retry correctly in the same turn instead of failing silently. Prefer exit code 0 with JSON for decisions, and keep exit code 2 for hard blocking errors.

What Sume does not do

Sume does not enforce your matcher or your cap on its own. max_spend_usd is applied only when the caller sends it, and wallet admission is the remaining gate. The hook is the place to make that field mandatory.