OpenAI Responses API MCP tool: call Sume's hosted tools

To call Sume's hosted MCP tools from the OpenAI Responses API, add an mcp tool with server_label sume and server_url https://mcp.sume.com/mcp, send your Sume API key in the tool's headers as Authorization: Bearer, and set require_approval so read tools run on their own while paid tools wait for your approval.

OpenAI's side comes from its MCP servers guide and the Create a response reference; Sume's side comes from OAuth and API keys, MCP tools and gates, and Jobs and results, all read on 2026-09-27. Sume does not publish an OpenAI package or plugin: the Responses API's own mcp tool connects to Sume's remote MCP server. Sume's basics page says hosted MCP still works but is not part of the primary path today.

Where does the Sume API key go?

In headers. OpenAI's reference describes authorization as an OAuth access token that your application obtains through its own OAuth flow, and headers as optional HTTP headers sent to the MCP server for authentication or other purposes. Sume's hosted MCP accepts OAuth access tokens or Sume API keys, which are not interchangeable, and Sume's credential rules say not to forward its OAuth tokens to third-party providers, so authorization is not the route. Send the key as Authorization: Bearer $SUME_API_KEY or as x-api-key.

An API-key session sees the full hosted tool set, write and paid tools included. With this tool, OpenAI's API, not your code, makes the call to Sume, so the key leaves your server inside every request that carries the tool. Sume's Authentication page says to keep API keys on trusted servers, CI secret stores, or local developer machines, and to rotate a key that appears in logs or chat history. If you'd rather manage the connection yourself, OpenAI's Agents SDK documents MCPServerStreamableHttp for that; OpenAI Agents SDK MCP server sets it up for Sume.

What does the request look like?

The Responses API works with remote servers on Streamable HTTP or HTTP/SSE, and Sume's quickstart points streamable HTTP clients at its endpoint. This Python request imports six Sume tools and skips approval for the five that neither write nor spend. allowed_tools imports a subset of a server's tools; OpenAI notes that exposing many tools can raise cost and latency. The first time the model uses the server, the output gains an mcp_list_tools item, and while that item stays in context the API does not fetch the list again each turn.

import os
from openai import OpenAI

client = OpenAI()
reads = ["mcp_health", "tools_schema", "generation_admission_preview", "jobs_wait", "jobs_result"]

resp = client.responses.create(
    model="gpt-6-astra",
    tools=[
        {
            "type": "mcp",
            "server_label": "sume",
            "server_url": "https://mcp.sume.com/mcp",
            "headers": {"Authorization": f"Bearer {os.environ['SUME_API_KEY']}"},
            "allowed_tools": reads + ["generate_video"],
            "require_approval": {"never": {"tool_names": reads}},
        }
    ],
    input="Check admission for a 5-second 9:16 clip of a desk lamp. Do not submit it.",
)

print(resp.output_text)

How do approvals work for paid Sume tools?

By default, OpenAI asks for your approval before any data is shared with a remote MCP server. A call that needs approval returns an mcp_approval_request item with the tool's name and arguments. To answer it, create a new response with previous_response_id set to the earlier response and an input item of type mcp_approval_response carrying approve and the approval_request_id; OpenAI's example repeats the same tools entry. require_approval: "never" skips approval for every tool, while an object with never.tool_names skips it only for the tools listed.

Read the arguments before you approve. Sume requires an idempotency_key on every write and paid tool, dry_run=true previews admission and cost without submitting the job, and max_spend_usd caps a call only when it is sent.

What comes back when the model calls Sume?

Each Sume call is an mcp_call item in the output, with the arguments the model sent and the output Sume returned. A failed call fills its error field with an MCP protocol error, a tool execution error, or a connectivity error.

For a render, the model should wait with jobs_wait, which holds one call for at most 55 seconds, and after wait_slice_expired call it again on the same ids instead of resubmitting the paid create. MCP tool call timeouts on long-running video jobs covers the rest of the wait contract.

What should I check before relying on it?

Two checks for a first run:

• Have the model call mcp_health first. It confirms the endpoint, the auth source, and the safety posture.
• OpenAI's guide says remote MCP servers have not been verified by OpenAI, and recommends reviewing, and optionally logging, all data shared with them.