VS Code remote MCP server: add Sume's hosted MCP in mcp.json

To use Sume's hosted MCP server in VS Code, add a sume entry with "type": "http" and "url": "https://mcp.sume.com/mcp" under servers in .vscode/mcp.json or your user mcp.json, then start it. Sume's docs prefer OAuth for interactive clients, and Sume's consent page grants Read and leaves Write off unless you turn it on.

The VS Code facts come from Add and manage MCP servers, the MCP configuration reference, and the MCP developer guide; the Sume facts come from MCP quickstart, OAuth and API keys, and MCP tools and gates, all read on 2026-09-27. Sume has no official VS Code integration: VS Code connects to Sume's hosted MCP server like any remote server. Sume's basics page says hosted MCP still works but is not part of the primary path today.

Where does the server entry go?

VS Code's docs list three places to configure MCP servers by hand. .vscode/mcp.json in a workspace defines them in a top-level servers object. .mcp.json at the project root uses a top-level mcpServers object and works across compatible tools. The user-profile mcp.json, opened with MCP: Open User Configuration, makes a server available in all your workspaces. MCP: Add Server in the Command Palette walks through the same choice.

For a "type": "http" server, VS Code first tries the HTTP Stream transport and falls back to SSE if HTTP is not supported; Sume's quickstart asks for a streamable HTTP client. This entry holds no secret, so it can go into source control, which VS Code suggests for sharing servers with a team:

{
  "servers": {
    "sume": {
      "type": "http",
      "url": "https://mcp.sume.com/mcp"
    }
  }
}

How does sign-in work?

VS Code supports MCP servers that require authentication, using OAuth 2.1 and 2.0 standards, and shows your authentication status in the Accounts menu. Sume's docs describe the hosted flow for remote HTTP MCP clients in general, not VS Code by name: the client discovers Sume's protected-resource metadata from the MCP endpoint and sends you to https://mcp.sume.com/oauth/authorize, which continues to the consent page on mcp.sume.com. Consent shows Read locked on and a Write toggle that is off by default. Sume's MCP OAuth flow covers each step. If the server shows an error, MCP: List Servers, then Show Output, opens its log.

With Write off, the session is mcp:read: read tools such as jobs_list and catalog_list work, while write and paid tools such as jobs_cancel and generate_image return insufficient_scope. Turning Write on also grants mcp:write. There is no mcp:paid scope.

Can I use a Sume API key instead of OAuth?

Sume accepts an API key on hosted MCP, but its docs steer interactive clients to OAuth: the quickstart says to prefer the OAuth connector flow, and the OAuth page says not to mint API keys for hosted OAuth clients as a workaround. API-key remote MCP remains available for existing users and automation, and an API-key session can see write and paid tools. If you do connect with an existing key, keep it out of the file: VS Code's docs say to avoid hardcoding API keys and to use input variables. VS Code prompts for an ${input:…} value when the server first starts and stores it securely, and password: true hides what you type.

One trade-off: VS Code does not forward servers that require interactive input, such as ${input:…} variables, to Agent Host sessions. Rotate the key if it ever appears in logs or chat history.

{
  "inputs": [
    {
      "type": "promptString",
      "id": "sume-api-key",
      "description": "Sume API key",
      "password": true
    }
  ],
  "servers": {
    "sume": {
      "type": "http",
      "url": "https://mcp.sume.com/mcp",
      "headers": { "Authorization": "Bearer ${input:sume-api-key}" }
    }
  }
}

How do I control what chat can call?

VS Code decides which tools chat sees and when it asks you; Sume decides what a call may do. Every Sume write and paid tool needs an idempotency_key, dry_run=true previews admission and cost without submitting the job, and max_spend_usd caps a call only when you pass it.

What should I ask chat to call first?

Start with mcp_health, which confirms the endpoint, the auth source, and the safety posture. Then call tools_list for every tool visible to the session, and tools_schema for one tool's contract before you pay for it.

Hosted MCP cannot read files from your laptop, wherever you connect from. For stills and clips, the paid tools are generate_image and generate_video; omit payload.model to route to sume/auto.