# What an agent can do > The real scope of an agent connected to the MCP server: which tools read, which tools change state, and which controls exist. - kind: guide - status: stable - last_verified: 2026-10-20 - url: https://tilopay.com/en/developers/agentes/mcp/permisos ## Scope of the tools [#alcance] Of the 117 tools, 63 only read and 54 change state. 20 of those 54 are marked as sensitive. The ones marked as sensitive, grouped by theme. The list comes from the catalog: it is every tool with the sensitive access level. Sending messages (links, receipts or notices over WhatsApp or email) counts as a write, not as a sensitive operation. **Move money: refunds and captures, stored-card charges, bank transfers, their confirmation and dual control** - [`tilopay_modify_transaction`](https://tilopay.com/en/developers/agentes/mcp/ventas#tilopay-modify-transaction): Capture, refund or reverse - [`tilopay_charge_saved_card`](https://tilopay.com/en/developers/agentes/mcp/tarjetas-guardadas#tilopay-charge-saved-card): Charge a customer's saved card - [`tilopay_saved_cards_create_payments`](https://tilopay.com/en/developers/agentes/mcp/tarjetas-guardadas#tilopay-saved-cards-create-payments): Charge stored cards - [`baas_send_transfer`](https://tilopay.com/en/developers/agentes/mcp/api-bancario/send-transfer#baas-send-transfer): Send BaaS transfer - [`baas_confirm_transfer`](https://tilopay.com/en/developers/agentes/mcp/api-bancario/confirm-transfer#baas-confirm-transfer): Authorize the pending transfer - [`banca_decide_approval`](https://tilopay.com/en/developers/agentes/mcp/api-bancario/otras-operaciones#banca-decide-approval): Approve or reject a pending operation **Delete or deactivate: links, products, plans, coupons, contacts, stored cards, reminders, stores, domains and orders** - [`tilopay_delete_payment_link`](https://tilopay.com/en/developers/agentes/mcp/enlaces-de-pago#tilopay-delete-payment-link): Delete payment link - [`tilopay_catalog_delete_item`](https://tilopay.com/en/developers/agentes/mcp/catalogo#tilopay-catalog-delete-item): Delete a catalog product - [`tilopay_delete_contact`](https://tilopay.com/en/developers/agentes/mcp/contactos#tilopay-delete-contact): Delete contact - [`tilopay_store_delete`](https://tilopay.com/en/developers/agentes/mcp/microtienda#tilopay-store-delete): Disable a micro-store - [`tilopay_store_domain_remove`](https://tilopay.com/en/developers/agentes/mcp/microtienda#tilopay-store-domain-remove): Remove a custom domain - [`tilopay_orders_disable`](https://tilopay.com/en/developers/agentes/mcp/microtienda#tilopay-orders-disable): Turn off order management - [`tilopay_cancel_reminder`](https://tilopay.com/en/developers/agentes/mcp/recordatorios#tilopay-cancel-reminder): Cancel reminder - [`tilopay_recurring_delete_plan`](https://tilopay.com/en/developers/agentes/mcp/recurrentes#tilopay-recurring-delete-plan): Delete subscription plan - [`tilopay_recurring_delete_coupon`](https://tilopay.com/en/developers/agentes/mcp/recurrentes#tilopay-recurring-delete-coupon): Delete a coupon - [`tilopay_remove_saved_card`](https://tilopay.com/en/developers/agentes/mcp/tarjetas-guardadas#tilopay-remove-saved-card): Delete a customer's saved card **Change a subscriber's status and their future charges** - [`tilopay_recurring_manage_subscriber`](https://tilopay.com/en/developers/agentes/mcp/recurrentes#tilopay-recurring-manage-subscriber): Pause, reactivate or delete a subscriber - [`tilopay_recurring_edit_subscriber`](https://tilopay.com/en/developers/agentes/mcp/recurrentes#tilopay-recurring-edit-subscriber): Edit a plan's subscriber **Cut access: unlinking the account and removing an employee** - [`tilopay_unlink_account`](https://tilopay.com/en/developers/agentes/mcp/cuenta#tilopay-unlink-account): Unlink my account - [`tilopay_remove_employee`](https://tilopay.com/en/developers/agentes/mcp/cuenta#tilopay-remove-employee): Remove an employee's access ## Permission inheritance [#herencia-de-permisos] The server uses your API credentials, so it inherits exactly its permissions: it does not impose additional barriers per tool. An active user can issue refunds and run bulk charges; those operations require the confirmation code sent to the email (see [Confirmations Tilopay requires](#confirmaciones)). ## Controls that do exist [#controles] - A per-user activation switch, which cuts access without deleting the account. - A separate administrator role, which only serves to manage users and credentials. - A rate limit of 60 calls per minute per user. ## Confirmations Tilopay requires [#confirmaciones] Tilopay enforces server-side confirmations for the operations detailed below. For other write tools, human confirmation is the responsibility of the MCP client. **6-digit code by email (second factor).** Required by `tilopay_modify_transaction`, `tilopay_charge_saved_card`, `tilopay_saved_cards_create_payments`, `tilopay_remove_saved_card`, `tilopay_delete_payment_link` and `tilopay_recurring_manage_subscriber`. The cycle is: 1. Call the tool without `confirmation_code`. 2. The response carries `structuredContent` with `{requires_confirmation: true, channel: "email", expires_in_seconds: 600, summary, details[], risk_level, second_channel}` and Tilopay sends the code to the merchant's email. 3. Repeat the SAME call with the same parameters plus `confirmation_code`. The code expires after 10 minutes, allows 5 attempts, 3 codes can be requested every 10 minutes and each new code invalidates the previous one. With elevated risk the same code also arrives by SMS if a number is configured. **Deposit extensions.** `tilopay_deposit_extend` requires a 6-digit email code and is owner-only. Its schema does not declare `confirmation_code`, so the two-call flow is completed through the WhatsApp Assistant. **Mandatory `confirm: true`.** `tilopay_unlink_account`, `tilopay_remove_employee` and `baas_get_account_number` only run with `confirm: true`. **Batch fingerprint.** `tilopay_recurring_settle_batch` returns a summary with a `fingerprint` and only executes with `confirm: true` and the same fingerprint (maximum 20 links). **Bank transfers.** The Banca Cliente portal sends the code to the email and it is passed as `code` to `baas_confirm_transfer` (or to `banca_decide_approval` under dual control). ### Human confirmation in the MCP client [#confirmacion-humana] For the remaining write tools, the MCP client must ask for human confirmation before running them. > **Warning:** `tilopay_charge_saved_card` and `tilopay_saved_cards_create_payments` do not deduplicate: repeating > the operation with a new code charges again. Before retrying, verify the result with > `tilopay_sales_summary` or `tilopay_saved_cards_list_collections`. `tilopay_catalog_delete_item` does not require an email code: the WhatsApp Assistant asks for confirmation in chat; MCP clients must ask for human confirmation. `tilopay_recurring_edit_subscriber` does not require an email code either; use `tilopay_recurring_manage_subscriber` for second-factor pause, reactivation or deletion.