Mastra Connect 1.0: no MCP approval by default, Sume not listed

No, Sume is not one of the MCP providers in Mastra Connect, and Connect 1.0 no longer asks for approval before it runs a discovered MCP tool. To give a Mastra agent Sume's hosted MCP server today, use MCPClient from @mastra/mcp with the production URL https://mcp.sume.com/mcp, and write your own approval rule for the paid tools.

Both facts come from Mastra's own pages, read on 2026-10-11: the Connect providers page lists seven MCP providers, and the October 7 release notes record the approval default change in @mastra/connect 1.0.0.

What changed in Mastra Connect 1.0, and where does Sume fit?

The release notes say discovered MCP tools no longer require approval by default, which matches the default of @mastra/mcp. The old autoApproveTools escape hatch is replaced by a requireApproval option: omitted or false means no approval, true means every tool needs it, and a string array names the tools that do.

The providers page describes a fixed table of MCP providers: Attio, Canva, Clay, Neon, Render, Robinhood and Sanity. The page does not say whether a custom MCP server URL can be added to Connect, so this post does not claim that it can or cannot. What the page does document is the catalog, and Sume is not in it.

Why does the no-approval default matter for paid tools?

Sume's MCP OAuth and API keys page says an API-key session sees the full hosted tool set, and that spend is governed by wallet and admission. A paid call needs an idempotency_key, but that key is, in the words of the tools and gates page, 'for transport/dedup, not human approval'. So with an API key and an agent framework that auto-runs tools, nothing between the model and a paid generation asks a person.

Two controls sit before your own rule. First, connect with OAuth and leave Write off: the session then sees only read-only tools, and a write or paid call returns insufficient_scope. Second, pass max_spend_usd on paid calls, which Sume enforces only when you provide it.

• Research and monitoring agents: OAuth, Write off. They can list jobs, read assets and check balance, and cannot spend.
• Production pipelines: API key, a deny-by-default approval rule, and a spend cap on every paid call.
• Never rely on the tool list shown in the prompt as the safety boundary; the approval rule is the boundary.

An MCPClient setup with deny-by-default approval

The Mastra reference documents requireToolApproval as either true or a function called with the tool name and arguments. The function below approves-automatically only a short list of read tools from the Sume docs and asks for everything else, so a new paid tool added later is gated without a code change. The tool name that Mastra passes may be prefixed with the server name, so the check uses endsWith; log one call before you rely on it.

import { MCPClient } from "@mastra/mcp";

const READ_ONLY = [
  "tools_list", "tools_schema", "mcp_health", "account_me",
  "balance_get", "usage_get", "catalog_list", "jobs_list",
  "jobs_get", "jobs_status", "jobs_wait", "jobs_result",
  "jobs_events", "assets_list", "assets_get",
];

export const sume = new MCPClient({
  servers: {
    sume: {
      url: new URL("https://mcp.sume.com/mcp"),
      requestInit: {
        headers: { Authorization: `Bearer ${process.env.SUME_API_KEY}` },
      },
    },
  },
  requireToolApproval: ({ toolName }) =>
    !READ_ONLY.some((name) => toolName.endsWith(name)),
});

Will Mastra's timeout cut a Sume wait short?

The MCPClient reference gives a global timeout default of 60000 ms, which can be overridden per server. Sume's Jobs and results page says a remote jobs_wait call holds for at most 55 seconds, with 50 as the default, and that you should call it again on wait_slice_expired instead of asking for a longer wait. A 55 second slice fits inside 60 seconds, but only just, so leave the default alone and never raise timeout_seconds beyond the cap: the server clamps it anyway.

If you do lower the Mastra timeout, a slice that gets cut off is a transport failure, not a job result. The job keeps running and billing, so re-issue jobs_wait on the same ids and do not submit the paid create again. For the full client setup see Mastra MCP client with Sume, and for how approval responses are keyed see Mastra respondToToolApproval.