Copilot Studio MCP server: connect Sume's hosted MCP

To connect a Copilot Studio agent to an MCP server, open the agent's Tools page, select Add a tool, New tool, then Model Context Protocol, and enter a server name, a description, and the server URL, such as https://mcp.sume.com/mcp for Sume's hosted server. Copilot Studio supports the Streamable transport, not SSE, and Streamable HTTP is what Sume serves. For authentication, choose API key with a header named x-api-key; the agent's user provides a Sume key.

Copilot Studio's side comes from Microsoft's Connect your agent to an existing MCP server, Add tools and resources from an MCP server, and Extend your agent with Model Context Protocol; Sume's from MCP quickstart, OAuth and API keys, MCP tools and gates, and Jobs and results, all read on 2026-09-27, plus current server code where noted. Sume has no official connector for Copilot Studio: this is a plain remote MCP connection, and Sume's basics page says hosted MCP still works but is not the primary integration path today. To call Sume's REST API from a flow instead, see Power Automate HTTP request API: start and poll a Sume run.

How do I add Sume in the MCP onboarding wizard?

Microsoft recommends the wizard over its other route, a custom connector built in Power Apps from an OpenAPI schema file. MCP also requires generative orchestration to be turned on for the agent.

• Go to the agent's Tools page and select Add a tool, then New tool, then Model Context Protocol.
• Fill in Server name, Server description, and Server URL (https://mcp.sume.com/mcp). The orchestrator reads the description to decide whether to call the server at runtime, so state what it does, for example “Generates images, video, speech, and music with Sume, and checks those jobs' status.”
• Choose the authentication type (next section) and select Create.
• In the Add tool dialog, create a new connection or pick an existing one, then select Add to agent.

Which authentication should I choose?

API key, with Type set to Header and the header name x-api-key. Microsoft's page says the user of the agent provides the key, and the agent includes it in its requests to the server. Sume accepts x-api-key on its hosted MCP, and API keys and spend resolve to a workspace, so the agent's calls bill the workspace behind the key that was entered. An API-key session sees the full hosted tool set, write and paid tools included.

OAuth 2.0 with Dynamic discovery is for servers that support dynamic client registration with discovery. In current code, Sume's server advertises a registration endpoint but registers public clients only: PKCE with S256 and no client secret. Microsoft's page doesn't say which kind of client Copilot Studio registers, so the API key is the path both sides' docs confirm. A Sume OAuth session is read-only until the user turns Write on at consent, and in current code its token lasts one hour, with no refresh token to renew it.

How do I keep the agent from spending on its own?

Limit the tools it can use. Every tool a connected MCP server publishes is available in Copilot Studio, and all of them are turned on when you add the server. On the Sume server's settings page (the agent's Tools tab, then the server), turn off the Allow all toggle and turn on only the tools the agent needs; tools Sume adds later then stay off by default, as Add tools and resources from an MCP server describes.

Copilot Studio's tool details also include Ask the end user before running, set to No by default, which has the agent ask for confirmation before it runs the tool. Microsoft says an MCP server's Details section is similar to other tools', so turn that option on if the Sume server's page shows it; otherwise, a paid tool left on can run whenever the orchestrator picks it.

Sume's own gates don't ask a person. Paid calls need an idempotency_key, but it is a deduplication key, not human approval; dry_run=true previews admission and cost without submitting; max_spend_usd caps a call only when it is sent. Sume's guidance for agents is to start with read-only calls and require explicit confirmation before paid generation. Safe automation for AI agents that call paid APIs covers these gates.

What happens with long video jobs?

A video render can outlast one tool call. Sume's jobs_wait holds a call open for at most 55 seconds, 50 by default; after wait_slice_expired, the agent should call it again with the same ids and never resubmit the paid create. To test the tool, ask the agent to call mcp_health, which confirms the endpoint, auth source, and safety posture, then tools_list for every tool its session can see.