MCP human-presence attestation: Sume consent vs API key
Human-presence attestation is only a roadmap topic. Sume separates people from automation by credential: OAuth consent in a browser, or an API key.
Sume does not attest human presence at the protocol level, and neither does MCP yet. What Sume does is split by credential: OAuth runs through a browser consent step where Write is off by default, and automation uses a separate API key. The credential a call arrives with is the distinction the docs draw.
The roadmap text is from the MCP roadmap (last updated 2026-08-22), read 2026-10-01. Sume facts are from MCP OAuth and API keys.
What does the roadmap say?
The roadmap notes that MCP authorization assumes a person with a browser at consent time, and lists human-presence attestation, to distinguish interactive clients from headless agents, among topics that may come into scope as the Agent Identity group forms. It is under discussion, not specified.
How do the two Sume paths differ?
| OAuth | API key | |
|---|---|---|
| How it connects | Browser consent on the MCP host | Authorization: Bearer or x-api-key |
| Default capability | Read locked on, Write off | Full hosted tool set |
| Spend gate | Wallet/admission | Wallet/admission |
| Writes and paid calls | idempotency_key required | idempotency_key required |
Does an OAuth token prove a person is present?
No. Consent is a person at a browser at that moment, but the resulting token is a bearer token the client then holds. The docs do not claim it proves anyone is still watching. The idempotency_key is likewise described as transport and dedup, not human approval.
Which credential should my agent use?
Use OAuth for interactive clients where a person can complete consent, and an API key for unattended automation. An MCP OAuth token is not a Sume API key, and the docs warn against minting keys for OAuth clients as a workaround. For a headless setup, see the headless MCP config.
Sources
Related posts
More in Developers
- MCP OAuth .localhost redirect URI: Sume allows localhost and 127.0.0.1
MCP TypeScript SDK 2.2.0 treats .localhost hosts as loopback for token endpoints. Sume's redirect check allows http only on localhost and 127.0.0.1.
- MCP progressive discovery: Sume tools_list, then tools_schema
For a large MCP tool set, list first and fetch one contract second. Sume has tools_list for visible tools and tools_schema for a single tool by name.
- MCP standardized error handling: Sume's named outcomes
MCP has no single error standard across surfaces yet. Here is how Sume's named outcomes map to retry, re-auth, or stop in a hosted MCP client.
- MCP sub-agent with narrower authority: a read-only Sume token
Give a sub-agent a Sume token granted only mcp:read and it sees read-only tools, so it can inspect jobs and assets but never submit a paid generation.
Written by Sume