Amazon Q MCP server: add Sume's hosted MCP in the IDE

To add an MCP server to Amazon Q Developer in the IDE, choose the tools icon in the Q Developer chat panel, then the plus (+) symbol, and pick a transport: stdio with a command for a local server, or http with a URL for a remote one. For Sume's hosted server, select http and enter https://mcp.sume.com/mcp, then add an x-api-key header with a Sume API key, or leave the headers empty and Amazon Q opens a browser page for you to authorize it.

Amazon Q's side comes from Amazon's MCP configuration for Q Developer in the IDE; Sume's from MCP quickstart, OAuth and API keys, MCP tools and gates, and Jobs and results, all read on 2026-09-27, plus current server code where noted. This covers the IDE, not the Q Developer CLI. Sume has no official connector for Amazon Q: this is a plain remote MCP connection, and Sume's basics page says hosted MCP still works but is not the primary integration path today.

How do I add Sume in Amazon Q's MCP configuration?

• In your IDE (VS Code, JetBrains, and others), open the Q Developer panel, open the Chat panel, and choose the tools icon.
• Choose the plus (+) symbol and select the scope: global or local.
• Enter a Name, such as sume, select http as the transport protocol, and enter https://mcp.sume.com/mcp in the URL field.
• Under Headers - optional, add a key-value pair for an API-key session, or leave it empty to authorize in the browser.
• Enter a Timeout value and choose Save. The tool permissions panel replaces the form.
• If Amazon Q can't connect, an alert appears in the panel; Fix Configuration takes you back to the form.

Where does Amazon Q save the server?

Global scope writes to ~/.aws/amazonq/default.json, available across all your projects. Local scope writes to .amazonq/default.json inside the current project, and workspace-level configuration takes precedence. By default, Amazon Q also reads legacy mcp.json files in the same two folders. Put an API-key header in global scope: the local file lives in your project, and Sume's docs say never to commit a key.

Should I use OAuth or an API key?

With no header, Amazon Q opens a browser page when the endpoint requires authorization, and Sume's does: it answers an unauthenticated client with an OAuth challenge, and the sign-in continues to a consent page on mcp.sume.com. There, Read is locked on and Write is off by default, so paid tools such as generate_image stay hidden, and return insufficient_scope if called, until you turn Write on. In current code a Sume OAuth token lasts one hour, and Sume issues no refresh token. Amazon's page doesn't describe the sign-in beyond the browser page, so if it doesn't complete, use the API-key header.

For an API key, add the header x-api-key with your key as the value, or Authorization with Bearer <SUME_API_KEY>. An API-key session sees the full hosted tool set, write and paid tools included, so the tool permissions below matter more.

How do I make Amazon Q ask before a paid Sume tool runs?

Open the MCP Servers panel, choose the Sume server, and set a level for each tool: Ask prompts every time the tool is used, Always allow runs it without prompting, and Deny keeps it from being used. Sume adds its own gates: every paid call needs an idempotency_key, dry_run=true previews admission and cost without submitting, and max_spend_usd caps a call only when it is sent.

What timeout should I enter?

Amazon's HTTP steps give no default, and its STDIO example keeps the recommended value of 60 seconds. Enter a value longer than one Sume jobs_wait call, which stays open for at most 55 seconds, 50 by default. After wait_slice_expired, the agent should call jobs_wait again with the same ids and never resubmit the paid create; MCP tool call timeouts on long-running video jobs covers the pattern.

To check the setup, ask Amazon Q to call mcp_health, which confirms the endpoint, auth source, and safety posture, then tools_list for every tool the session can see.