purchase_credits

SERVERGotFreeFax SOURCEhttps://www.gotfreefax.com/mcp

Critical RISK CLASS

Category Financial

Parameters 31 required

Recommended Approval-gatedsee the rule below

Registry record Grade D, identity unverified Pull the record →

This record as markdown: /tools/com-gotfreefax-mcp/purchase-credits.md

WHAT IT DOES

What purchase_credits does on GotFreeFax

AI agents use purchase_credits to commit financial operations through GotFreeFax, usually the final step of a payment, billing, or trading workflow. A call moves real money.

Parameter	Type	Required	Description
`name`	string	—	Required when the request is not authenticated. Account holder name.
`email`	string	—	Required when the request is not authenticated. Used to create or load an existing prepaid account.
`service_type`	string	Yes	Purchase option. One of: prepaid10 (100 pages, $9.95), prepaid20 (250 pages, $19.95), prepaid50 (800 pages, $49.95), intprepaid50 ($49.95 international balance)

Parameters from the server's own tool schema.

RISK

Why purchase_credits is rated Critical

This tool initiates a real financial transaction via PayPal to purchase prepaid credits. It directly commits financial obligations by triggering a payment flow. Misuse could cause unauthorized charges to a user's PayPal account, making it Financial category with critical severity.

From the tool's definition purchase_credits: 'Start a prepaid credit purchase... credits will be loaded into the authenticated account after PayPal payment... Returns a PayPal payment URL the user must visit to complete the purchase'

Attacks that exploit this kind of access

RECOMMENDED RULE

The rule that runs purchase_credits safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GotFreeFax, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For purchase_credits, this is the rule to start with:

purchase_credits Approval-gated

Any call to purchase_credits is blocked until a human approves it. The rest of the server keeps working.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "purchase_credits": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}

GATE THIS TOOL → Instant setup, no code required.

The button opens the PolicyLayer dashboard: create your workspace, connect GotFreeFax, apply this rule, and every purchase_credits call is checked against it from then on.

FAQ

Questions about purchase_credits

What does the purchase_credits tool do? +

Start a prepaid credit purchase. If the request is authenticated, credits will be loaded into the authenticated account after PayPal payment. If the request is not authenticated, provide email and name to create a new prepaid account (or load credits into an existing one with the same email). Returns a PayPal payment URL the user must visit to complete the purchase. It is categorised as a Financial tool in the GotFreeFax MCP Server, which means it involves financial transactions. Block by default and require explicit approval.

What parameters does purchase_credits accept? +

purchase_credits accepts 3 parameters: name, email, service_type. Required: service_type. The full parameter table on this page comes from the server's own tool schema.

How do I enforce a policy on purchase_credits? +

Register the GotFreeFax MCP server in PolicyLayer and add a rule for purchase_credits: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches GotFreeFax. Nothing to install.

What risk level is purchase_credits? +

purchase_credits is a Financial tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.

Can I rate-limit purchase_credits? +

Yes. Add a rate_limit block to the purchase_credits rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block purchase_credits completely? +

Set action: deny in the PolicyLayer policy for purchase_credits. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides purchase_credits? +

purchase_credits is provided by the GotFreeFax MCP server (https://www.gotfreefax.com/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

KEEP EXPLORING

More on GotFreeFax, and thousands of servers like it.

This server

All 7 GotFreeFax tools → Critical-risk tools on this server →

Across the catalogue

All critical-risk MCP tools → The MCP Attack Database →

Guides

Govern MCP payment tools →Human-in-the-loop →Tool call approval →