goose MCP server: add Sume's hosted MCP as an extension

To add an MCP server to goose, install it as an extension: a Command-line Extension runs a local command, and a Remote Extension (Streamable HTTP) connects to a URL. For Sume's hosted MCP, add a Remote Extension with the URL https://mcp.sume.com/mcp, from the Extensions sidebar, goose configure, a deeplink, or ~/.config/goose/config.yaml. goose normally obtains an OAuth client ID on its own, and you approve access on Sume's consent page.

goose's side comes from its Using Extensions, goose Permission Modes, and Managing Tool Permissions pages; Sume's from MCP quickstart, OAuth and API keys, MCP tools and gates, and Jobs and results, all read on 2026-09-27, plus current server code where noted. Sume has no official connector for goose: this is a plain remote MCP connection, and Sume's basics page says hosted MCP still works but is not the primary integration path today.

How do I add Sume as a goose extension?

• goose Desktop: open the sidebar, click Extensions, then Add custom extension, and fill in the modal. Its Timeout field sets how long goose waits for a tool call from this extension to complete.
• goose CLI: run goose configure, choose Add Extension, then Remote Extension (Streamable HTTP), and follow the prompts.
• Deeplink: goose://extension?url=https%3A%2F%2Fmcp.sume.com%2Fmcp&type=streamable_http&timeout=300&id=sume&name=Sume&description=Sume%20tools, with every parameter URL-encoded.
• One session only: goose session --with-streamable-http-extension "https://mcp.sume.com/mcp" enables it without installing it.

extensions:
  sume:
    name: Sume
    type: streamable_http
    uri: https://mcp.sume.com/mcp
    enabled: true
    timeout: 300

How does goose sign in to Sume?

With OAuth. goose's docs say remote extensions that require OAuth normally get a client ID automatically, through Client ID Metadata Documents or Dynamic Client Registration, and in current code Sume's server advertises a registration endpoint, so leave client_id out of the entry: goose documents it for servers that support neither. goose serves the OAuth callback on 127.0.0.1 with an ephemeral port, and current Sume code accepts http redirects to localhost and 127.0.0.1. goose's page documents OAuth for remote extensions, not custom headers, so this setup uses OAuth rather than an API key.

On Sume's consent page, Read is locked on and Write is off by default. Without scopes, goose asks for the scopes Sume advertises, but Sume grants mcp:write only if you turn Write on. With Write off, paid tools such as generate_image are hidden, and a call to one returns insufficient_scope. In current code a Sume token lasts one hour, and Sume issues no refresh token, so expect to sign in again after that.

How do I stop goose from running paid Sume tools on its own?

Change the mode. goose applies Autonomous mode by default, which uses extensions without approval, so with Write on it could start paid Sume jobs unasked. In the CLI, /mode approve switches to Manual Approval and /mode smart_approve to Smart Approval; in goose Desktop, use the mode button in the bottom menu, or Settings > Chat > Mode. Before a paid call, you can also ask goose to run it with dry_run=true, which previews admission and cost without submitting.

In Manual or Smart mode you can also set each tool to Always Allow, Ask Before, or Never Allow. goose's page adds that in these modes it asks only for tools it deems write tools, a best-effort classification interpreted by your LLM provider, so set Sume's paid tools to Ask Before explicitly. Its tool-permissions page also says goose performs best with fewer than 25 tools enabled across all extensions, and suggests disabling tools a task doesn't need.

What timeout should the Sume extension have?

More than 55 seconds. goose's timeout is the maximum time, in seconds, to wait for extension responses, and its examples use 300. Sume's jobs_wait holds one call open for at most 55 seconds, 50 by default; after wait_slice_expired, goose should call it again with the same ids and never resubmit the paid create.

To check the connection, ask goose to call mcp_health, which confirms the endpoint, auth source, and safety posture, then tools_list for every tool the session can see.