Gemini CLI MCP server: add Sume's hosted MCP

To add Sume's hosted MCP server to Gemini CLI, put a sume entry under mcpServers in ~/.gemini/settings.json with "httpUrl": "https://mcp.sume.com/mcp" and a headers value of "Authorization": "Bearer $SUME_API_KEY". Gemini CLI resolves $VAR_NAME references in settings strings when it loads the file, so the key itself stays in your environment.

Gemini CLI's behavior comes from its MCP servers guide and configuration reference; Sume's side comes from MCP quickstart, OAuth and API keys, and MCP tools and gates, all read on 2026-09-27. Sume does not publish a Gemini CLI extension; Gemini CLI connects to Sume's remote MCP server directly. Sume's basics page says hosted MCP still works but is not part of the primary path today. Claude Code, Cursor, and Codex are covered in Connect Claude Code, Cursor, or Codex to Sume.

What goes in the settings.json entry?

Gemini CLI picks the transport from the URL field: httpUrl means streamable HTTP, which Sume's quickstart asks for, and url means SSE. If both are set, httpUrl wins. headers is a map of HTTP headers sent with requests to that URL, and Sume accepts the key as Authorization: Bearer or x-api-key.

Sume's docs prefer OAuth for interactive clients and keep API-key remote MCP for existing users and automation. This post uses the key header, which both sides document. Gemini CLI's own OAuth flow opens a local browser, and its docs say it won't work in headless environments, remote SSH sessions without X11 forwarding, or containers without browser support.

Use the user file, ~/.gemini/settings.json, which applies to all your Gemini CLI sessions; a project's .gemini/settings.json applies only in that project. The $SUME_API_KEY reference keeps the key itself out of the file, which matters because an API-key session can see Sume's write and paid tools.

{
  "mcpServers": {
    "sume": {
      "httpUrl": "https://mcp.sume.com/mcp",
      "headers": { "Authorization": "Bearer $SUME_API_KEY" },
      "includeTools": [
        "mcp_health",
        "tools_list",
        "tools_schema",
        "generation_admission_preview",
        "generate_image",
        "jobs_wait",
        "jobs_result"
      ]
    }
  }
}

Can I add it with gemini mcp add instead?

Yes. gemini mcp add configures the server in settings.json for you, but its -s, --scope flag defaults to project, so pass -s user. --transport http is the streamable HTTP transport, -H, --header sets headers, and --include-tools takes a comma-separated list. Single-quote the header so your shell passes the literal $SUME_API_KEY to Gemini CLI instead of expanding the key into the command:

gemini mcp add -s user --transport http \
  --header 'Authorization: Bearer $SUME_API_KEY' \
  --include-tools mcp_health,tools_list,tools_schema,jobs_wait,jobs_result \
  sume https://mcp.sume.com/mcp

How does Gemini CLI name and confirm Sume's tools?

Every discovered tool gets a fully qualified name of the form mcp_{serverName}_{toolName}, so Sume's generate_image becomes mcp_sume_generate_image. Gemini CLI warns against underscores in server names, because its policy parser splits the name at the first underscore after mcp_.

Tool calls ask for confirmation unless the server is trusted, and the prompt offers Proceed once, Always allow this tool, Always allow this server, or Cancel. Leave trust off for Sume: an API-key session reaches paid tools, and each needs an idempotency_key.

What should the agent do before a paid call?

Sume's gates sit under Gemini CLI's confirmation prompt: each paid call needs an idempotency_key, generation_admission_preview or the paid tool with dry_run=true previews admission and cost first, and max_spend_usd caps a call only when you pass it. Gemini CLI runs on your machine, but hosted MCP cannot read files from your laptop; uploads go through an upload URL, a client PUT, and assets_complete. Estimate AI video generation cost before running a Sume job covers the preview, and Sume MCP tools list groups the tools by read, write, and paid.

How do I check the connection?

Run /mcp in a session to see each server's connection status, CONNECTED, CONNECTING, or DISCONNECTED, and its tools; gemini mcp list shows connection status from your shell. Then ask Gemini to call mcp_health, which confirms the endpoint, the auth source, and the safety posture, and tools_list, which lists every tool visible to the session.