MCP Enterprise-Managed Authorization is stable: Sume uses OAuth or key

Sume's hosted MCP server documents two ways to sign in: OAuth with mcp:read required and mcp:write opt-in, or an API key sent as a bearer or x-api-key header. The MCP project's August 22, 2026 roadmap lists Enterprise-Managed Authorization as stable, but Sume's docs do not describe an enterprise-managed flow, so plan on those two.

The roadmap facts are from the MCP blog, read 2026-10-01. The Sume facts are from its MCP docs.

What does the MCP roadmap say about authorization?

Among its priority areas the roadmap includes DPoP and Workload Identity Federation, and it marks Enterprise-Managed Authorization as stable. It is a statement about the protocol, not about any one server.

Which sign-in modes does Sume document?

The OAuth and API keys page lists them. Nothing else is documented, so a client that wants an enterprise-managed grant has no Sume-specific path to it today.

What should an enterprise team do today?

Pick by who is at the keyboard. For people, OAuth: the consent page shows the scopes, and Write stays off unless chosen. For unattended runs, an API key held in your secret manager, with paid calls bounded by max_spend_usd. The docs say a key that leaks into logs or chat history should be rotated.

Is there a mcp:paid scope?

No. Paid access comes through mcp:write or an API key, and every paid call needs an idempotency_key. If a policy needs a separate paid grant, enforce it in the client's tool approval rather than expecting a scope.