claude plugin validate --strict in CI: what it checks in a Sume entry

Add claude plugin validate ./your-plugin --strict to CI and a Sume hosted MCP entry gets checked on every change. The plugin manifest reference says validate reports passed, passed with warnings, or failed, and that --strict turns warnings into failures. Its MCP checks need Claude Code v2.1.281 or later.

For a Sume plugin, the useful catches are a header that holds a literal key, a ${user_config.KEY} that points at an option you never declared, and a URL that is not an absolute one.

What it flags in an MCP entry

From the reference, applied to a Sume entry for https://mcp.sume.com/mcp.

A CI step

The command runs in a shell, so any CI system can call it. Use the plugin directory as the argument and let the exit code decide the job.

claude plugin validate ./sume-media --strict

Steps

Fix the warnings once on your machine first. Add version, description and author. Move the key into a sensitive userConfig option and reference it from headers. Keep the URL exactly https://mcp.sume.com/mcp. Then add the CI line. When a teammate pastes a real key into a header by mistake, the build fails before the plugin ships.

• Install Claude Code 2.1.281 or later in the CI image so the MCP checks run.
• Do not rely on validate to find every secret; run your own secret scanner too.
• Re-run after changing the server name, because hook matchers depend on it.

Warnings worth treating as failures

Under --strict, every warning breaks the build, which sounds harsh until you read the list. A plain http:// URL to a non-loopback host is a warning, and for a paid service it is simply a mistake: always use the https URL. A header that looks like a literal credential is a warning, and in a shared repository it is a leak. Treat both as errors in your head even when the tool calls them warnings.

The check cannot see secrets stored somewhere else in the repository, so keep a secret scanner in the same pipeline.

What Sume does not do

The validator checks the file, not the connection. It cannot tell you the key works. After install, call mcp_health to see whether Sume accepted the credential, and use tools_list to see which tools the session can call.