MCP human-presence attestation: Sume consent vs API key
Human-presence attestation is only a roadmap topic. Sume separates people from automation by credential: OAuth consent in a browser, or an API key.
Sume does not attest human presence at the protocol level, and neither does MCP yet. What Sume does is split by credential: OAuth runs through a browser consent step where Write is off by default, and automation uses a separate API key. The credential a call arrives with is the distinction the docs draw.
The roadmap text is from the MCP roadmap (last updated 2026-08-22), read 2026-10-01. Sume facts are from MCP OAuth and API keys.
What does the roadmap say?
The roadmap notes that MCP authorization assumes a person with a browser at consent time, and lists human-presence attestation, to distinguish interactive clients from headless agents, among topics that may come into scope as the Agent Identity group forms. It is under discussion, not specified.
How do the two Sume paths differ?
| OAuth | API key | |
|---|---|---|
| How it connects | Browser consent on the MCP host | Authorization: Bearer or x-api-key |
| Default capability | Read locked on, Write off | Full hosted tool set |
| Spend gate | Wallet/admission | Wallet/admission |
| Writes and paid calls | idempotency_key required | idempotency_key required |
Does an OAuth token prove a person is present?
No. Consent is a person at a browser at that moment, but the resulting token is a bearer token the client then holds. The docs do not claim it proves anyone is still watching. The idempotency_key is likewise described as transport and dedup, not human approval.
Which credential should my agent use?
Use OAuth for interactive clients where a person can complete consent, and an API key for unattended automation. An MCP OAuth token is not a Sume API key, and the docs warn against minting keys for OAuth clients as a workaround. For a headless setup, see the headless MCP config.
Sources
Related posts
More in Developers
- MCP JSON-RPC batch 400: one message per request, Sume max 4
MCP 2026-07-28 requires one JSON-RPC message per POST. Sume still takes legacy batches of 1 to 4 on the 2025-03-26 shape and returns 400 -32600 otherwise.
- MCP OAuth .localhost redirect URI: Sume allows localhost and 127.0.0.1
MCP TypeScript SDK 2.2.0 treats .localhost hosts as loopback for token endpoints. Sume's redirect check allows http only on localhost and 127.0.0.1.
- MCP 403 forbidden_origin: why a browser client is refused
Sume remote MCP answers a disallowed Origin header with 403 forbidden_origin. A request with no Origin, like curl or a server SDK, is not checked this way.
- MCP progressive discovery: Sume tools_list, then tools_schema
For a large MCP tool set, list first and fetch one contract second. Sume has tools_list for visible tools and tools_schema for a single tool by name.
Written by Sume