Critical-risk tools in Africa Payments MCP
14 of the 32 tools in Africa Payments MCP are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
b2c_transferFinancialSend money from business to customer (B2C transfer). Used for payouts, refunds, salaries, and disbursements.
-
bank_transferFinancialSend money directly to a bank account using supported providers. Requires bank account details and bank code.
-
mpesa_b2cFinancialSend money from business to customer (B2C). Used for payouts, refunds, salaries.
-
mpesa_stk_pushFinancialInitiate M-Pesa STK Push (Paybill/Till number payment). Sends payment prompt to customer phone.
-
paystack_initializeFinancialInitialize a Paystack transaction. Returns payment link/authorization.
-
paystack_refundFinancialCreate a refund for a Paystack transaction.
-
paystack_transferFinancialSend money to a bank account or mobile money wallet via Paystack.
-
refundFinancialProcess a full or partial refund for a completed transaction. The original transaction ID must be provided. Refund is processed through the same provider.
-
request_paymentFinancialRequest payment from a customer using STK push (M-Pesa) or payment links. Sends a payment prompt directly to the customer
-
send_moneyFinancialSend money to a recipient using any available payment provider. Supports mobile money (M-Pesa, MTN MoMo, Airtel Money, etc.) and bank transfers. Auto-selects the best provider ...
-
stk_pushFinancialInitiate M-Pesa STK Push (SIM Toolkit push) to request payment from a customer. This sends a payment prompt directly to the customer
-
unified_refundFinancialRefund a transaction. Supports full or partial refunds.
-
unified_request_paymentFinancialRequest payment from a customer using the most appropriate provider for their country.
-
unified_send_moneyFinancialSend money to a recipient using the best available provider. Automatically selects the appropriate provider based on recipient country and phone number. Support...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.