MCP server for OpenCode: add Sume in opencode.json

To add an MCP server to OpenCode, put it under mcp in opencode.json with "type": "remote" and its url; for Sume, the URL is https://mcp.sume.com/mcp. Leave credentials out and OpenCode runs OAuth itself, through the dynamic client registration Sume's server currently offers; the session is read-only until you turn Write on. Or send your Sume API key in headers for the full tool set.

OpenCode's side comes from its MCP servers and Config docs; Sume's from MCP quickstart, OAuth and API keys, and MCP tools and gates, all read on 2026-09-27. Sume has no official OpenCode integration: this is a plain remote MCP connection. Sume's basics page says hosted MCP still works but is not the primary integration path today.

How do I add Sume to opencode.json?

Use the global file, ~/.config/opencode/opencode.json, for every project, or an opencode.json in a project root, which overrides it. Give the server a unique name; OpenCode prefixes each of its tools with that name. This entry uses OAuth:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sume": {
      "type": "remote",
      "url": "https://mcp.sume.com/mcp",
      "enabled": true
    }
  }
}

How does OpenCode sign in to Sume?

OpenCode detects the 401 response, starts the OAuth flow, and uses dynamic client registration when the server supports it, which Sume's server currently advertises, so no client ID is needed. It prompts you the first time you use the server, or you run opencode mcp auth sume, and it stores tokens in ~/.local/share/opencode/mcp-auth.json.

On Sume's consent page, Read is locked on and Write is off by default. With Read only, the session sees read-only tools and paid tools such as generate_image return insufficient_scope; turn Write on at consent to use them. In current code, a Sume token lasts one hour and comes with no refresh token, so expect to sign in again. opencode mcp debug sume shows the auth status, tests the connection, and tries OAuth discovery.

How do I use an API key instead?

For automation that can't open a browser, send the key. Sume accepts Authorization: Bearer or x-api-key, and an API-key session sees the full hosted tool set, write and paid tools included. OpenCode's docs show "oauth": false for servers that use API keys, and its {env:VAR} substitution keeps the key in your environment; an unset variable becomes an empty string.

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "sume": {
      "type": "remote",
      "url": "https://mcp.sume.com/mcp",
      "oauth": false,
      "headers": { "Authorization": "Bearer {env:SUME_API_KEY}" }
    }
  }
}

Which options matter, and is there a tool timeout?

OpenCode's timeout is for fetching the tool list, not for tool calls, and its MCP page documents no tool-call limit. Long Sume jobs don't hold one call open: jobs_wait holds at most 55 seconds per call (50 by default), so the agent waits in slices on the same ids and never resubmits the paid create. MCP tool call timeouts on long-running video jobs has the pattern.

How do I keep paid Sume tools in check?

• Explore with OAuth and Write off: read tools such as jobs_list and catalog_list work, and paid tools are refused.
• With Write on, or with a key, Sume's own gates apply: every write and paid call needs an idempotency_key, and dry_run=true previews admission and cost without submitting. Safe automation for AI agents that call paid APIs covers the rest.
• OpenCode warns that MCP servers add to the context, so set enabled to false when you don't need Sume. To confirm a session, ask the agent to call mcp_health, then tools_list.