MCP server for OpenClaw: add Sume's image and video tools

OpenClaw connects to MCP servers you save under mcp.servers in its config and makes their tools available to your agents: add one with openclaw mcp add <name> --url <server-url> --transport streamable-http, or in the Control UI under Settings → MCP. For image, video, and audio tools, add Sume's hosted MCP server that way with openclaw mcp add sume --url https://mcp.sume.com/mcp --transport streamable-http --auth oauth, then run openclaw mcp login sume, or send a Sume API key in a header instead of OAuth. Filter the tools, and set requestTimeoutMs above 55,000, because one Sume jobs_wait call can hold for 55 seconds.

OpenClaw's side comes from Connect MCP servers, Manage saved MCP servers, Transports and OAuth, and its environment and secrets page; Sume's side comes from MCP OAuth and API keys, MCP tools and gates, and Jobs and results, all read on 2026-09-27. Commands and flags are as OpenClaw's docs showed them on that date. Sume has no official OpenClaw integration, and Sume's basics page says hosted MCP still works but is not part of the primary path today.

How do I add Sume to OpenClaw?

OpenClaw connects to Streamable HTTP, SSE, or stdio servers. Set transport: "streamable-http" for Sume; when it is omitted, OpenClaw uses SSE. The same server written straight into OpenClaw's config, with OAuth, a longer request timeout, and a tool filter that admits one paid tool, generate_image:

{
  mcp: {
    servers: {
      sume: {
        url: "https://mcp.sume.com/mcp",
        transport: "streamable-http",
        auth: "oauth",
        requestTimeoutMs: 70000,
        toolFilter: {
          include: [
            "mcp_health",
            "tools_list",
            "jobs_wait",
            "jobs_result",
            "generate_image",
          ],
        },
      },
    },
  },
}

Should OpenClaw use OAuth or an API key for Sume?

OAuth, when a person is around to sign in. OpenClaw's OAuth is for HTTP servers that advertise the MCP OAuth flow, which Sume's does. openclaw mcp login sume prints an authorization URL; after you approve in the browser, OpenClaw normally captures the loopback redirect and saves the credentials. Sume's consent page shows Read locked on and Write off by default; with Write off, paid tools return insufficient_scope. If you set --oauth-scope, Sume's current server accepts only mcp:read and mcp:write.

Sume's current access tokens last one hour, and it issues no refresh token, so an OAuth session needs openclaw mcp login sume again after an hour. For an agent that runs unattended, Sume keeps API-key remote MCP for automation: drop auth, and reference the key from the environment, since OpenClaw substitutes ${VAR_NAME} in any config string and says to keep credentials out of config literals. For example, headers: { "x-api-key": "${SUME_API_KEY}" }, with the key in the environment or ~/.openclaw/.env. An API-key session sees Sume's full hosted tool set, paid tools included.

How do I stop the agent from spending without asking?

Filter first. toolFilter.include and toolFilter.exclude (--include and --exclude on the CLI) filter Sume's tools before they become OpenClaw tools, with simple * globs. Leave generate_image and generate_video out unless the agent should create paid jobs; each one needs an idempotency_key, dry_run=true previews the cost, and max_spend_usd caps a call only when sent.

Approval modes apply to Codex-backed runs, where the default full-permission posture does not prompt. openclaw mcp configure sume --approval prompt asks for every call, auto uses each tool's safety annotations, and approve bypasses per-call approval. Sume's current server marks its read tools readOnlyHint: true and its write and paid tools false.

Why does the request timeout matter?

Sume's paid tools answer with a job, and the agent waits with jobs_wait, which holds one call for at most 55 seconds (50 by default). OpenClaw documents requestTimeoutMs without a default; 20000 and 30000 are the values in its examples, and either could cut a Sume wait short. After wait_slice_expired, the agent calls jobs_wait again with the same id and never resubmits the paid create. MCP tool call timeouts on long-running video jobs covers the rest.

How do I check the connection?

• openclaw mcp doctor sume --probe checks the saved definition, then opens a live connection and reports the tools the server advertises.
• openclaw mcp status --verbose prints the resolved transport, auth, timeout, and filter without connecting.
• Ask the agent to call mcp_health, which confirms the endpoint, auth source, and safety posture. Hosted MCP cannot read files from your laptop, so image references must be public HTTPS URLs.