Sume hosted MCP OAuth scopes: mcp:read, mcp:write, and no paid scope

The hosted server is https://mcp.sume.com/mcp. OAuth grants two scopes: mcp:read, which is required and limits the session to read-only tools, and mcp:write, which the user opts into on the consent screen. There is no mcp:paid scope. Paid generation is governed by write access plus per-call fields: idempotency_key is required on writes and paid calls, and dry_run and max_spend_usd are optional.

A client that authenticates with an API key, via Authorization: Bearer or x-api-key, sees the full tool set.

Scope outcomes

Connect two clients

claude mcp add --transport http sume https://mcp.sume.com/mcp
claude mcp login sume

# Cursor: .cursor/mcp.json
# {"mcpServers":{"sume":{"url":"https://mcp.sume.com/mcp"}}}

Discovery

OAuth metadata is published at https://mcp.sume.com/.well-known/oauth-protected-resource/mcp and /.well-known/oauth-authorization-server. The flow is PKCE through /oauth/authorize, then /oauth/consent on the MCP host.