Devin Desktop ${file:} interpolation for the Sume API key

Use ${file:} when you want the Sume API key to live in a file with its own permissions rather than in mcp_config.json. The Devin Desktop page says the config supports ${env:VAR_NAME} and ${file:/path/to/file} so that secrets are not hardcoded. A Sume entry then needs only the URL and one header, and the key is read from the path you name each time the config loads.

The entry

{
  "mcpServers": {
    "sume": {
      "serverUrl": "https://mcp.sume.com/mcp",
      "headers": {
        "Authorization": "Bearer ${file:/Users/me/.secrets/sume-key}"
      }
    }
  }
}

Details that bite

The key file should hold only the key. A trailing newline is a common cause of a 401 with a valid key, so write it with printf rather than echo, and check whether Devin Desktop trims whitespace before you assume it does; the page does not say.

Restrict the file to your user (mode 600 on macOS and Linux). Devin Desktop reads it as you, so tight permissions cost nothing, and they stop other local users and most backup tools from picking it up by accident.

Choose ${env:} instead when the key already comes from a secret manager that exports an environment variable. Choose ${file:} when the manager writes a file, as many container secret mounts do.

Tool count and credential

Cascade stops at 100 total tools across all your servers. Sume does not publish a fixed tool count, and the list depends on the credential: an API key sees the full set, while an OAuth session with only mcp:read hides write tools. If you hit the cap, switching Sume to a read-only OAuth session removes write tools from the list, which also lowers the number Cascade has to hold. Then call mcp_health to confirm which credential is live.

Write and paid calls need an idempotency_key whichever way the key is stored. Storing it in a file changes who can read it, not what it can spend.

Rotating the key

The practical benefit shows up at rotation. Create a new key in the dashboard, write it to the same file, and restart the MCP connection. The mcp_config.json file does not change, so it can be shared, backed up or committed as a template without a diff that contains a secret. Delete the old key in the dashboard once the new one works.

If more than one machine uses Sume, give each its own key. A single leaked laptop then costs one revocation instead of a team-wide rotation,.