GitHub Copilot coding agent MCP: add Sume's hosted server

To give GitHub Copilot's coding agent an MCP server, a repository admin adds JSON under the repository's Settings > Copilot > MCP servers. The agent does not currently support remote servers that use OAuth, and it runs the configured tools without asking, so for Sume's hosted MCP the entry is "type": "http", "url": "https://mcp.sume.com/mcp", a Sume API key read from a COPILOT_MCP_ secret in headers, and a tools list that names only the tools you want it to run unattended.

GitHub now calls the agent Copilot cloud agent; its changelog says it was formerly known as Copilot coding agent. GitHub's side comes from Configure MCP servers for your repository, Configure secrets and variables, and About Copilot cloud agent; Sume's side comes from MCP OAuth and API keys and MCP tools and gates, all read on 2026-09-27. Sume has no official GitHub integration, and Sume's basics page says hosted MCP still works but is not part of the primary path today. Copilot Chat in VS Code is a different client, covered in VS Code remote MCP server.

Where do I add an MCP server for Copilot's cloud agent?

In the repository on GitHub, as a repository administrator:

• Click Settings. In the sidebar, under Code, planning, and automation, click Copilot, then MCP servers.
• Paste your JSON in the MCP configuration section. It must contain an mcpServers object keyed by server name.
• Click Save MCP configuration. GitHub validates the syntax.

How does the agent authenticate to Sume?

With an API key in a header. GitHub's page says Copilot cloud agent and Copilot code review do not currently support remote MCP servers that leverage OAuth, which rules out Sume's OAuth sign-in. Sume's hosted MCP accepts an API key instead, as Authorization: Bearer or x-api-key: the path its docs keep for automation that does not speak OAuth. "type": "http" is one of the four type values the agent accepts, with local, stdio, and sse.

Store the key as an Agents secret named, for example, COPILOT_MCP_SUME_API_KEY: Settings, then Secrets and variables in the Security section, then Agents, then New repository secret on the Secrets tab. Only Agents secrets and variables whose names start with COPILOT_MCP_ reach your MCP configuration; those are available only to MCP servers, not to the agent's environment, and secret values are masked in session logs. Reference it in headers:

{
  "mcpServers": {
    "sume": {
      "type": "http",
      "url": "https://mcp.sume.com/mcp",
      "headers": { "x-api-key": "$COPILOT_MCP_SUME_API_KEY" },
      "tools": [
        "mcp_health",
        "tools_list",
        "tools_schema",
        "catalog_list",
        "jobs_status",
        "jobs_wait",
        "jobs_result"
      ]
    }
  }
}

Which Sume tools should the tools list allow?

The tools key is required. GitHub strongly recommends allowlisting specific read-only tools, because the agent uses them autonomously and does not ask for approval first; * enables every tool. An API-key session sees Sume's full hosted tool set, paid tools included, so this list decides whether the agent can start paid jobs at all.

The same configuration serves Copilot code review, which uses a tool only if it sets readOnlyHint to true. Sume's current server does that for its read tools and sets false on write and paid tools, so reviews can reach only Sume's read tools. To keep all MCP tools out of reviews, turn off Allow Copilot to use MCP tools when reviewing pull requests under Settings > Copilot > Code review.

What changes if the agent may generate media?

List the paid tools by name, never *. Each paid call needs an idempotency_key; dry_run=true previews admission and cost, and max_spend_usd caps a call only when the call includes it. The agent writes those arguments, so they are not a limit your configuration can enforce.

Waits come in slices: jobs_wait holds one call for at most 55 seconds, and for a longer job the agent waits again on the same id rather than resubmitting. Each cloud agent session has a hard maximum execution time of 59 minutes.

How do I check that Copilot can see Sume?

• Create an issue in the repository and assign it to Copilot.
• Open the pull request Copilot creates, wait for the Copilot started work event, and click View session.
• Click the ellipsis at the top right of the log viewer, then Copilot, and expand the Start MCP Servers step. When the server starts, its tools are listed at the bottom of the logs.
• Copilot cloud agent and code review use MCP tools only, not resources or prompts. Sume MCP tools list groups every hosted tool by read, write, and paid.