Read-only MCP session lists avatars; create gives insufficient_scope
A hosted MCP connection with read scope can list and search avatars, but paid avatar and video tools return insufficient_scope until you grant write.
What a read-only session can do
Sume's hosted MCP exposes avatar tools in two groups. Read tools: avatars_list, avatars_get, avatars_search, avatar-videos_list and avatar-videos_get. Paid tools: avatars_create, avatar-videos_create, avatar-image-to-video_create and the avatar-video-previews tools.
| Granted | Read tools | Paid tools |
|---|---|---|
| mcp:read only | Work | insufficient_scope |
| mcp:write granted | Work | Work, with optional dry_run and max_spend_usd |
The practical flow
Connect with read scope first and let the assistant look at your avatars. When it needs to spend, add write. The docs say the legacy allow_write and allow_paid arguments are not required and cannot bypass a missing mcp:write scope.
Cap what a write session can spend
Paid tools accept dry_run to preview admission and cost without submitting. They also accept max_spend_usd, which Sume enforces only when you send it. For a 10 s plus clip, a cap of 3 dollars would let it through and a cap of 2 would not.
If you hit it
- Re-authorize the connection with write scope, then retry the same call.
- Reads such as avatars_list still work in the meantime.
- Use an idempotency_key on every write so a retry does not double bill.
Sources
Related posts
More in Integrations
- HyperFrames on the Sume Integrations page: built in, not Frame.io
The HyperFrames row is Sume's own video editor and composition stack. It has no Connect button and is not Frame.io, YouTube or any external host.
- Integration OAuth in Sume: 10-minute state, one claim, admin recheck
Sume's connector OAuth state is random, user-bound and valid ten minutes. A cookie binds the browser, one callback claims it, and admin rights are rechecked.
- jobs_wait defaults to 50 seconds: how many calls for a long render
Remote MCP jobs_wait waits 50 seconds by default and 55 at most. A render that takes N minutes needs about N x 60 / 50 calls on the same ids. Never resubmit.
- kling-motion-control_create: motion_video_url, 1 to 30 s, no model
kling-motion-control_create needs a public HTTPS motion_video_url and duration_seconds of 1 to 30, and refuses a model field with provider_fields_not_accepted.
Written by Sume