What an agent can do

Scope of the tools#

Of the 117 tools, 63 only read and 54 change state. 20 of those 54 are marked as sensitive.

The ones marked as sensitive, grouped by theme. The list comes from the catalog: it is every tool with the sensitive access level. Sending messages (links, receipts or notices over WhatsApp or email) counts as a write, not as a sensitive operation.

Move money: refunds and captures, stored-card charges, bank transfers, their confirmation and dual control

tilopay_modify_transaction: Capture, refund or reverse
tilopay_charge_saved_card: Charge a customer's saved card
tilopay_saved_cards_create_payments: Charge stored cards
baas_send_transfer: Send BaaS transfer
baas_confirm_transfer: Authorize the pending transfer
banca_decide_approval: Approve or reject a pending operation

Delete or deactivate: links, products, plans, coupons, contacts, stored cards, reminders, stores, domains and orders

tilopay_delete_payment_link: Delete payment link
tilopay_catalog_delete_item: Delete a catalog product
tilopay_delete_contact: Delete contact
tilopay_store_delete: Disable a micro-store
tilopay_store_domain_remove: Remove a custom domain
tilopay_orders_disable: Turn off order management
tilopay_cancel_reminder: Cancel reminder
tilopay_recurring_delete_plan: Delete subscription plan
tilopay_recurring_delete_coupon: Delete a coupon
tilopay_remove_saved_card: Delete a customer's saved card

Change a subscriber's status and their future charges

tilopay_recurring_manage_subscriber: Pause, reactivate or delete a subscriber
tilopay_recurring_edit_subscriber: Edit a plan's subscriber

Cut access: unlinking the account and removing an employee

tilopay_unlink_account: Unlink my account
tilopay_remove_employee: Remove an employee's access

Permission inheritance#

The server uses your API credentials, so it inherits exactly its permissions: it does not impose additional barriers per tool. An active user can issue refunds and run bulk charges; those operations require the confirmation code sent to the email (see Confirmations Tilopay requires).

Controls that do exist#

A per-user activation switch, which cuts access without deleting the account.
A separate administrator role, which only serves to manage users and credentials.
A rate limit of 60 calls per minute per user.

Confirmations Tilopay requires#

Tilopay enforces server-side confirmations for the operations detailed below. For other write tools, human confirmation is the responsibility of the MCP client.

6-digit code by email (second factor). Required by tilopay_modify_transaction, tilopay_charge_saved_card, tilopay_saved_cards_create_payments, tilopay_remove_saved_card, tilopay_delete_payment_link and tilopay_recurring_manage_subscriber. The cycle is:

Call the tool without confirmation_code.
The response carries structuredContent with {requires_confirmation: true, channel: "email", expires_in_seconds: 600, summary, details[], risk_level, second_channel} and Tilopay sends the code to the merchant's email.
Repeat the SAME call with the same parameters plus confirmation_code.

The code expires after 10 minutes, allows 5 attempts, 3 codes can be requested every 10 minutes and each new code invalidates the previous one. With elevated risk the same code also arrives by SMS if a number is configured.

Deposit extensions. tilopay_deposit_extend requires a 6-digit email code and is owner-only. Its schema does not declare confirmation_code, so the two-call flow is completed through the WhatsApp Assistant.

Mandatory confirm: true. tilopay_unlink_account, tilopay_remove_employee and baas_get_account_number only run with confirm: true.

Batch fingerprint. tilopay_recurring_settle_batch returns a summary with a fingerprint and only executes with confirm: true and the same fingerprint (maximum 20 links).

Bank transfers. The Banca Cliente portal sends the code to the email and it is passed as code to baas_confirm_transfer (or to banca_decide_approval under dual control).

Human confirmation in the MCP client#

For the remaining write tools, the MCP client must ask for human confirmation before running them.

tilopay_charge_saved_card and tilopay_saved_cards_create_payments do not deduplicate: repeating the operation with a new code charges again. Before retrying, verify the result with tilopay_sales_summary or tilopay_saved_cards_list_collections.

tilopay_catalog_delete_item does not require an email code: the WhatsApp Assistant asks for confirmation in chat; MCP clients must ask for human confirmation. tilopay_recurring_edit_subscriber does not require an email code either; use tilopay_recurring_manage_subscriber for second-factor pause, reactivation or deletion.

Last verified: 2026-10-20

View as raw Markdown