MCP server for Kiro: add Sume's hosted MCP in mcp.json

To add an MCP server to Kiro, put it under mcpServers in .kiro/settings/mcp.json for one workspace or ~/.kiro/settings/mcp.json for all of them; a remote server needs only a url, here https://mcp.sume.com/mcp. Leave out headers and Kiro opens Sume's sign-in page itself, through the dynamic client registration Sume's server currently offers; set "oauthScopes": ["mcp:read"], because Sume accepts only mcp:read and mcp:write and Kiro's default scopes are neither. Or send a Sume API key in an Authorization header.

Kiro's side comes from its MCP configuration docs; Sume's from MCP quickstart, OAuth and API keys, and MCP tools and gates, all read on 2026-09-27, plus current server code where noted. Sume has no official Kiro integration: this is a plain remote MCP connection. Sume's basics page says hosted MCP still works but is not the primary integration path today.

How do I add Sume to Kiro?

Open the file from the command palette with "Kiro: Open workspace MCP config (JSON)" or "Kiro: Open user MCP config (JSON)", or with the Open MCP Config icon in the Kiro panel. If both files exist, Kiro merges them and the workspace wins. Check that the MCP support setting is on, then add the entry and save; Kiro applies the change and reconnects.

{
  "mcpServers": {
    "sume": {
      "url": "https://mcp.sume.com/mcp",
      "oauthScopes": ["mcp:read"]
    }
  }
}

How does Kiro sign in to Sume?

Kiro runs the browser OAuth flow itself. For servers with dynamic client registration it needs no client ID and opens the authorization page; in current code, Sume's server advertises registration and PKCE S256 without a client secret, which fits Kiro's IDE, since it supports public OAuth clients only.

The scope line matters. Kiro's docs say that when no scopes are set, it requests openid, email, profile, and offline_access. Sume's OAuth supports mcp:read and mcp:write only, and current code refuses any other scope with invalid_scope. Kiro's own advice for scope errors is an empty oauthScopes array.

On Sume's consent page, Read is locked on and Write is off by default; turn Write on if Kiro's agent should run paid tools. In current code a Sume token lasts one hour with no refresh token. Kiro's docs say that when a token expires and no refresh token is available, it starts a new browser sign-in without a restart, and the IDE shows a Re-authenticate button in the MCP panel.

How do I use an API key instead?

Put it in headers. An API-key session sees the full hosted tool set, write and paid tools included. Kiro expands ${VARIABLE_NAME} references only for variables you approve: it warns about unapproved ones, and you add them under the Mcp Approved Env Vars setting. Kiro's security guidance is to reference variables instead of hardcoding secrets, and never to commit config files with credentials.

{
  "mcpServers": {
    "sume": {
      "url": "https://mcp.sume.com/mcp",
      "headers": { "Authorization": "Bearer ${SUME_API_KEY}" }
    }
  }
}

How do I keep paid Sume tools behind an approval?

autoApprove lists the tools Kiro runs without prompting, so leave Sume's paid tools out of it. Sume's own gates still apply: paid calls need an idempotency_key, dry_run=true previews admission and cost without submitting, and max_spend_usd caps a call only when you pass it.

Will Kiro time out on long video jobs?

Kiro's configuration page documents no tool-call timeout, and Sume doesn't hold one call for a whole render: jobs_wait returns after at most 55 seconds per call, and the agent calls it again with the same ids, never resubmitting the paid create. MCP tool call timeouts on long-running video jobs has the pattern. To check the connection, ask the agent to call mcp_health, then tools_list.