# Banking tools

> MCP tools to read accounts, balances, payments and statements, and manage transfers with email authorization. Enabled on request and only with banking API credentials.

- kind: mcp-tool
- status: stable
- access: write
- last_verified: 2026-10-22
- url: https://tilopay.com/en/developers/agentes/mcp/api-bancario

> **Warning:** These tools are not enabled by default. They are turned on on request and only work for
>   users with Tilopay banking API credentials registered by Tilopay on the server side. Standard
>   MCP access does not include the group; and if a tool is called without those credentials, it
>   replies that they do not exist. To request it, [contact us](/en/contacto) and state that you
>   need the banking API.

## What it covers [#que-cubre]

Nineteen tools over the [banking API](/en/developers/api-bancario): contexts (assignments),
credential diagnostics, accounts, balances, full account number, payments, statements, an
analytical payments report, validating a destination account, the transfer with its
authorization, cancellation and result notice, dual-control approval and closing the banking
session.

**Thirteen of the nineteen only read information.** `baas_request_statement` generates a read-only
document and moves no money. `baas_send_transfer` creates the intent of a transfer,
without executing the payment. The Banca Cliente portal sends an authorization code to your
email and `baas_confirm_transfer` executes the transfer with that code.
If the operation is held under dual control, the approver decides it with
`banca_decide_approval` and a code sent to their email. So it cannot run on the model's decision
alone.

The own account is chosen by precedence: `accountValue` (only if it matches one of the user's
accounts) → `currency` (first account in that currency) → `accountIndex` (base 1: the number shown
by `baas_list_accounts`) → if there is a single account, that one. `baas_get_account_number` accepts
only `currency` or `accountIndex`. Dates are RFC 3339
(`2026-01-01T00:00:00Z`) and `assignmentId` is only needed when the user has several contexts.

## Tools [#herramientas]

The email authorization and dual-control flow described here belongs to MCP and Banca Cliente. Direct payment creation in the [Banking API](/en/developers/api-bancario/pagos#procesamiento) has no dual control: it processes the payment when the token, permissions and data are valid.

Statements are generated asynchronously: the API returns `202 ACCEPTED` with `request_id` and `PENDING`. The status lookup returns `200` with `PENDING`, `PROCESSING`, `DONE` or `ERROR`; when `DONE`, `download_url` is valid for **48 hours**.

> These tools are enabled on request and only work for users with Tilopay banking API credentials. They are not part of the default MCP access: Tilopay enables the group case by case. Requires: Tilopay banking API credentials registered by Tilopay for that user.

- [Other BaaS operations](https://tilopay.com/en/developers/agentes/mcp/api-bancario/otras-operaciones) — `baas_list_assignments`, `baas_diagnostics`, `baas_list_accounts`, `baas_get_balance`, `baas_get_account_number`, `baas_get_statement_status`, `baas_cancel_transfer`, `banca_decide_approval`, `baas_close_session` (Read only / Read only / Read only / Read only / Read only / Read only / Write / Sensitive / Write): Assignments, credential diagnostics, account listing, balance of one account, full account number, status of a statement request, cancelling the pending transfer, dual-control approval and closing the banking session.
- [Banking API account balances](https://tilopay.com/en/developers/agentes/mcp/api-bancario/list-balances) — `baas_list_balances` (Read only): Lists the real-time balances of the accessible accounts: account, amounts and cut-off date.
- [List banking API payments](https://tilopay.com/en/developers/agentes/mcp/api-bancario/list-payments) — `baas_list_payments` (Read only): Queries (read-only) the movements/payments of one of the merchant's own bank accounts. Indicate the currency (CRC/USD) or the account number from the list: do not write the IBAN. Filters by date, status, currency, method and direction, with cursor pagination.
- [Find a payment](https://tilopay.com/en/developers/agentes/mcp/api-bancario/search-payment) — `baas_search_payment` (Read only): Searches for a BaaS payment within an account by exactly one of: paymentId (UUID), publicId (number) or clientReference. Identifiers only from data a tool already returned.
- [Payment detail](https://tilopay.com/en/developers/agentes/mcp/api-bancario/get-payment) — `baas_get_payment` (Read only): Gets the detail of a BaaS payment by its internal UUID (read-only). Use only identifiers that another tool returned in this same turn.
- [Request an account statement](https://tilopay.com/en/developers/agentes/mcp/api-bancario/request-statement) — `baas_request_statement` (Write): Requests asynchronous generation of an account statement for a banking API account, with a 60-day maximum range. It moves no money: it generates a read-only document. The API always returns 202 ACCEPTED with request_id and status PENDING. Check baas_get_statement_status for the download; when DONE, download_url is valid for 48 hours.
- [Banking API payments analyst](https://tilopay.com/en/developers/agentes/mcp/api-bancario/analyze-payments) — `baas_analyze_payments` (Read only): Analyses, read only, the payments of an account in a date range and returns a natural-language report: success, failures, reversals, net amounts and recommendations. It runs a language model over the computed figures.
- [Validate BaaS destination account](https://tilopay.com/en/developers/agentes/mcp/api-bancario/validate-destination) — `baas_validate_destination` (Read only): Validates a destination account before transferring: PHONE for SINPE Móvil or IBAN for account transfer. Returns the holder name the bank confirms.
- [Send BaaS transfer](https://tilopay.com/en/developers/agentes/mcp/api-bancario/send-transfer) — `baas_send_transfer` (Sensitive): Creates the intent of a transfer from the merchant's bank account in the Banca Cliente portal (not the payment yet). The portal validates the destination and sends a 6-digit code to the merchant's email; the payment only executes when baas_confirm_transfer is called with that code (valid for 30 minutes). Default method: SINPE Móvil (destination by phone); for an account transfer, destinationAccountType=IBAN. baas_validate_destination is optional to show the holder beforehand; this tool validates the destination on its own.
- [BaaS transfer status](https://tilopay.com/en/developers/agentes/mcp/api-bancario/get-transfer-status) — `baas_get_transfer_status` (Read only): Does not query the bank: it states that the transfer result arrives as a notice as soon as the bank confirms it. paymentId is optional and unused.
- [Authorize the pending transfer](https://tilopay.com/en/developers/agentes/mcp/api-bancario/confirm-transfer) — `baas_confirm_transfer` (Sensitive): Executes the transfer whose intent was created by baas_send_transfer, with the 6-digit code the Banca Cliente portal sent to the merchant's email. Never write or repeat the code in the answer.