CodeBuddy MCP: add Sume with mcp add-json and a Bearer header

To use Sume from CodeBuddy, register the hosted endpoint https://mcp.sume.com/mcp as an http server with codebuddy mcp add-json, and send your Sume API key as an Authorization: Bearer header. CodeBuddy's own MCP page documents both the command and the JSON shape; Sume's docs document the URL and the key header. Nothing runs locally; the hosted URL is the route.

The steps below come from two pages read on 2026-10-11: CodeBuddy's MCP usage documentation and Sume's MCP docs.

What is the exact command?

CodeBuddy's page shows codebuddy mcp add-json --scope user <name> '<json>', where the JSON carries type, url and headers. For Sume that becomes the command below. Your shell expands $SUME_API_KEY before CodeBuddy sees it, so the key is stored in the file; keep that file private.

CodeBuddy also documents a shorter form, codebuddy mcp add --scope user --transport http server-name https://example.com/mcp. It adds the server without a header, which suits OAuth, but CodeBuddy's page does not describe an OAuth login for HTTP servers, so the header route is the one this post relies on.

export SUME_API_KEY="paste-your-key-here"

codebuddy mcp add-json --scope user sume \
  "{\"type\":\"http\",\"url\":\"https://mcp.sume.com/mcp\",\"headers\":{\"Authorization\":\"Bearer $SUME_API_KEY\"}}"

Where does CodeBuddy store it, and who sees it?

CodeBuddy distinguishes user scope from project scope. Per its page, the recommended user file is ~/.codebuddy/.mcp.json and the recommended project file is .mcp.json in the project root. It reads the first existing file in priority order and writes to it if present.

Two consequences for a paid service. First, a key in a project .mcp.json is one commit away from your repository, so keep Sume's entry at user scope. Second, CodeBuddy says project-scope servers need approval on first connection, and for non-interactive runs you pre-approve with --settings '{"enabledMcpjsonServers": ["server-name"]}'.

CodeBuddy's page also says headers expand ${VAR} references from the environment, with ${VAR:-default} as a fallback. If you want the file to hold no secret, write "Authorization": "Bearer ${SUME_API_KEY}" as the header value instead of the expanded key.

What does an API key unlock compared with OAuth?

Sume accepts either OAuth tokens or API keys, never one in place of the other. A Bearer key, or the x-api-key header, gives the full hosted tool set. OAuth sessions are read-only by default (mcp:read) and need the Write toggle at consent for mcp:write.

Whichever credential you use, write and paid tools require an idempotency_key. Spend is controlled by your wallet and admission checks, and max_spend_usd is enforced only when you pass it.

How do I check it works?

Start CodeBuddy and ask it to call mcp_health, then tools_list. Both are read-only discovery tools in Sume's quickstart. tools_schema returns one tool contract by name, which is the right call before the first paid generation.

If the server does not appear, check that the JSON is valid after shell expansion and that the key is non-empty. If a paid call is rejected, read the error before retrying: Sume treats the idempotency_key as transport deduplication, so reuse the same key when you retry the same request and use a new one for a new request.