MCP human-presence attestation: Sume consent vs API key
Human-presence attestation is only a roadmap topic. Sume separates people from automation by credential: OAuth consent in a browser, or an API key.
Sume does not attest human presence at the protocol level, and neither does MCP yet. What Sume does is split by credential: OAuth runs through a browser consent step where Write is off by default, and automation uses a separate API key. The credential a call arrives with is the distinction the docs draw.
The roadmap text is from the MCP roadmap (last updated 2026-08-22), read 2026-10-01. Sume facts are from MCP OAuth and API keys.
What does the roadmap say?
The roadmap notes that MCP authorization assumes a person with a browser at consent time, and lists human-presence attestation, to distinguish interactive clients from headless agents, among topics that may come into scope as the Agent Identity group forms. It is under discussion, not specified.
How do the two Sume paths differ?
| OAuth | API key | |
|---|---|---|
| How it connects | Browser consent on the MCP host | Authorization: Bearer or x-api-key |
| Default capability | Read locked on, Write off | Full hosted tool set |
| Spend gate | Wallet/admission | Wallet/admission |
| Writes and paid calls | idempotency_key required | idempotency_key required |
Does an OAuth token prove a person is present?
No. Consent is a person at a browser at that moment, but the resulting token is a bearer token the client then holds. The docs do not claim it proves anyone is still watching. The idempotency_key is likewise described as transport and dedup, not human approval.
Which credential should my agent use?
Use OAuth for interactive clients where a person can complete consent, and an API key for unattended automation. An MCP OAuth token is not a Sume API key, and the docs warn against minting keys for OAuth clients as a workaround. For a headless setup, see the headless MCP config.
Sources
Related posts
More in Developers
- MCP Inspector custom headers: send one Sume API key
In MCP Inspector's custom headers, send either x-api-key or Authorization: Bearer with your Sume key, never both. Sume rejects a request carrying both.
- MCP Inspector 405 Method Not Allowed on a POST-only server
Inspector 2.8.0 can suppress the standalone GET notification stream. Sume's MCP endpoint answers GET /mcp with 405 and Allow: POST, so turn it off.
- MCP JSON-RPC batch 400: one message per request, Sume max 4
MCP 2026-07-28 requires one JSON-RPC message per POST. Sume still takes legacy batches of 1 to 4 on the 2025-03-26 shape and returns 400 -32600 otherwise.
- MCP OAuth .localhost redirect URI: Sume allows localhost and 127.0.0.1
MCP TypeScript SDK 2.2.0 treats .localhost hosts as loopback for token endpoints. Sume's redirect check allows http only on localhost and 127.0.0.1.
Written by Sume