# purchase_credits

Start a prepaid credit purchase. If the request is authenticated, credits will be loaded into the authenticated account after PayPal payment. If the request is not authenticated, provide email and name to create a new prepaid account (or load credits into an existing one with the same email). Returns a PayPal payment URL the user must visit to complete the purchase.

Agent View of the PolicyLayer registry record for `purchase_credits`. HTML page: https://policylayer.com/tools/com-gotfreefax-mcp/purchase-credits

## Facts

- Tool: `purchase_credits`
- Server: GotFreeFax (`https://www.gotfreefax.com/mcp`) — https://policylayer.com/tools/com-gotfreefax-mcp.md
- Homepage: https://github.com/vannet/gotfreefax-mcp
- Risk category: Financial (Critical risk)
- Registry record: grade D, identity unverified
- Server auth posture: open
- Server CORS policy: *
- Server rate-limited: no
- Parameters: 3 (1 required)
- Recommended policy verdict: Approval-gated

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | no | Required when the request is not authenticated. Account holder name. |
| `email` | string | no | Required when the request is not authenticated. Used to create or load an existing prepaid account. |
| `service_type` | string | yes | Purchase option. One of: prepaid10 (100 pages, $9.95), prepaid20 (250 pages, $19.95), prepaid50 (800 pages, $49.95), intprepaid50 ($49.95 international balance) |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "purchase_credits",
    "arguments": {
      "service_type": "<service_type>"
    }
  }
}
```

## Why purchase_credits is rated Critical

This tool initiates a real financial transaction via PayPal to purchase prepaid credits. It directly commits financial obligations by triggering a payment flow. Misuse could cause unauthorized charges to a user's PayPal account, making it Financial category with critical severity.

From the tool's own definition: "purchase_credits: 'Start a prepaid credit purchase... credits will be loaded into the authenticated account after PayPal payment... Returns a PayPal payment URL the user must visit to complete the purchase'"

## Use case

AI agents use purchase_credits to commit financial operations through GotFreeFax, usually the final step of a payment, billing, or trading workflow. A call moves real money.

## Recommended policy (PolicyLayer)

Verdict: **Approval-gated**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches GotFreeFax:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "purchase_credits": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}
```

## Other tools on GotFreeFax (6)

- `send_fax` — Financial — https://policylayer.com/tools/com-gotfreefax-mcp/send-fax.md
- `check_fax_status` — Read — https://policylayer.com/tools/com-gotfreefax-mcp/check-fax-status.md
- `get_account_balance` — Read — https://policylayer.com/tools/com-gotfreefax-mcp/get-account-balance.md
- `list_sent_faxes` — Read — https://policylayer.com/tools/com-gotfreefax-mcp/list-sent-faxes.md
- `list_supported_formats` — Read — https://policylayer.com/tools/com-gotfreefax-mcp/list-supported-formats.md
- `send_free_fax` — Write — https://policylayer.com/tools/com-gotfreefax-mcp/send-free-fax.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=com-gotfreefax-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/com-gotfreefax-mcp