Sume remote MCP upload URL is redacted: use a public HTTPS URL
On Sume's hosted MCP the upload.url from assets_upload_url comes back redacted, so a remote agent cannot PUT. Pass a public HTTPS URL, or upload over REST.
A remote MCP agent cannot upload bytes to Sume: the assets_upload_url tool returns upload.url redacted on hosted MCP, so there is nothing to PUT to. If the media is already public, pass its HTTPS URL straight to the generator. If the bytes are local, upload them through the REST API with a key, outside MCP, then call assets_complete.
The tool behavior is from the Sume MCP tool contracts; the general flow is from MCP tools and gates. Both were read on 2026-10-03. Note that the docs page describes the flow in general terms and the tool contract adds the remote-MCP redaction.
Why remote MCP cannot PUT
Hosted MCP runs on Sume's side and the agent talks to it over HTTP. It cannot read files on your laptop, and the tool contract states that remote MCP agents cannot PUT: the short-lived upload URL is hidden in the response. The docs summary of the flow is: create an upload URL, have a client PUT the bytes, then call assets_complete. The client that does the PUT must be able to reach the URL, which the remote agent cannot.
| Where the media is | What to do | Tools involved |
|---|---|---|
| Already at a public HTTPS URL | Pass the URL to the generator | The generator tool itself |
| Local bytes you hold | Upload over REST, PUT, then complete | assets_upload_url, a PUT, assets_complete |
| A URL you only want recorded | Register it as metadata; not a mirror | assets_create |
| A ready first-party upload you want back | Mint a short-lived GET URL | assets_download_url |
What assets_create does and does not do
assets_create registers a public URL as unverified metadata. The status is registered, which is not generation-ready first-party media and not a server-side mirror. So registering a URL does not make Sume fetch and store it, and it does not give you an id to pass to generators in place of the URL.
The tool contract also warns against inventing a media_id from an upload response for generator inputs. Pass public HTTPS URLs or handles from results, per the API reference.
Required fields when you do upload
assets_upload_url is a write tool, so it needs an idempotency_key, plus content_type and size_bytes, where size is between 1 byte and 2 GB. Optional fields are filename, media_type and checksum_sha256. It writes Sume metadata only and does not call paid providers.
Treat the signed URL like a credential: do not paste it into chat or logs, and never include it in a report an agent sends to a user.
A short decision rule
Ask one question first: is the media already reachable at a public HTTPS address? If yes, hand the URL to the generator and skip assets entirely. If no, and the bytes sit on a machine you control, upload from that machine with a REST client and your API key, then confirm with assets_get that the asset is ready. The API reference prefers public HTTPS media URLs in generation requests, and the tool contract says not to invent a media_id from an upload response, so do not pass the asset id to a generator in place of a URL. If the media is a social video you only have a link to, media-imports_create is the tool that fetches and mirrors it.
Only a ready first-party upload can be retrieved later with assets_download_url. Remote URL registrations made with assets_create are not proxied, so asking for a download URL on one of those will not give you bytes.
Sources
Related posts
More in Developers
- Replace a product-page GIF with a muted MP4: autoplay loop
web.dev says a muted looping video replaces a GIF at a fraction of the size: 3.7 MB vs 551 KB in its example. The tag, the attributes and a silent Sume trim.
- Report a failed Sume video job: share the request id, not the URLs
A failed video job needs a request id and a job id for support. What Sume says is safe to share, what to redact, and how to pull both from an error body.
- Re-render a Short's ending without double billing: Idempotency-Key
A Timeline render needs an Idempotency-Key. Reuse a key to retry the same request; use a new key when you change the ending.
- Restate durable handler: submit a Sume job once, then poll safely
Restate stores completed steps and resumes after failure. Make the Sume submit one stored step, then poll the returned job id without a second charge.
Written by Sume