The buy-flow chain
To buy a product, tools must run in this order. The key rule:create_payment_session authorizes
payment but never places an order. Only shop_checkout buys.
shop_searchfinds products.shop_productgets the exact variant.shop_quotelocks a live total and returns acheckout_session_id.create_payment_sessionfor that exact total returns apayment_url.- The user opens the
payment_urland approves with their passkey (a biometric confirmation on their device). shop_checkoutplaces the order. Credentials stay server-side.
create_payment_session → user approves → done.
Payments
create_payment_session — checkout:run
Creates a payment session and returns a payment_url for the user to approve. Charges nothing by
itself.
Returns
{ session_id, payment_url, expires_at, replayed }.
get_payment_status — payments:read
Checks a payment session. Returns status only: pending, completed, failed, or not_found.
Payment credentials never leave the gateway.
Mandates
Manage standing mandates — spend authorizations the owner approves once with a passkey, then an agent charges within caps. Setting one up returns an approval URL; it charges nothing by itself. Charging a mandate is not available over MCP — use the CLI or the REST API.create_mandate — payments:write
Starts mandate setup and returns an approval_url for the owner to approve with a
passkey. Spends nothing.
Returns
{ approval_url, ... }. Send the URL to the owner; after they approve, call
list_mandates to confirm the mandate is active before spending against it.
list_mandates — payments:read
Returns the owner’s standing mandates (transient per-checkout mandates are
excluded). Each entry includes merchant, frequency, approved/remaining amount,
status, and validity.
No required parameters.
get_mandate — payments:read
Returns one mandate with its spend and charge history.
cancel_mandate — payments:write
Revokes a mandate; stops all future charges. Terminal.
pause_mandate — payments:write
Temporarily suspends a mandate. No charges succeed until resumed.
resume_mandate — payments:write
Reactivates a paused mandate.
Shopping
shop_search — payments:read
Returns product listings:
product_id, price estimate, merchant.
shop_product — payments:read
Returns purchasable offers and variants:
variant_id, price, availability.
shop_quote — payments:write
Opens a checkout and locks a live price. Requires a delivery address on file (check with
shop_list_addresses).
Returns
checkout_session_id plus the exact total to pay.
shop_checkout — checkout:run
The required final step. Places the order for a prior quote, paying with an approved payment
session. The session’s amount must match the quote total.
Returns
{ status, order_id, amount, replayed }. If the payment isn’t approved yet, the tool says
so; poll get_payment_status until completed, then retry.
Addresses
Address reads are masked. Full address details stay server-side and go only to the merchant.shop_list_addresses — payments:read
No parameters. Returns masked summaries (id, label, short summary, which is default) plus whether a
contact phone is on file.
shop_add_address — payments:write
shop_set_default_address — payments:write
Account
list_cards — payments:read
No parameters. Returns the user’s saved cards, masked: last4, brand, expiry. Never full numbers.
list_agents — payments:read
No parameters. Returns the user’s connected agents, including this connection.
ping — no scope
Health probe. Returns{ pong: true } and the server time. Use it to confirm the connection after
setup.