# record_invoice_payment

Record a manual payment against an invoice (cash, bank transfer, cheque, card terminal). Updates invoice status to PARTIAL or PAID based on the running total.

Agent View of the PolicyLayer registry record for `record_invoice_payment`. HTML page: https://policylayer.com/tools/io-favcrm-favcrm/record-invoice-payment

## Facts

- Tool: `record_invoice_payment`
- Server: FavCRM (`https://api.favcrm.io/mcp`) — https://policylayer.com/tools/io-favcrm-favcrm.md
- Homepage: https://github.com/favcrm/mcp
- Risk category: Financial (Critical risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server CORS policy: *
- Server rate-limited: no
- Parameters: 5 (3 required)
- Recommended policy verdict: Approval-gated

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `note` | string | no | Internal note about this payment |
| `amount` | string | yes | Payment amount as decimal string, e.g. "100.00" |
| `method` | string | yes | Payment method |
| `invoiceId` | string | yes | Invoice ID to record payment against |
| `reference` | string | no | External reference (cheque number, bank transfer ID) |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "record_invoice_payment",
    "arguments": {
      "amount": "<amount>",
      "method": "<method>",
      "invoiceId": "<invoiceId>"
    }
  }
}
```

## Why record_invoice_payment is rated Critical

This tool directly records financial transactions (payments) against invoices and modifies their payment status. It commits financial obligations and records monetary flows, making it a Financial category tool. Misuse could result in fraudulent payment records, incorrect financial statements, or unauthorized marking of invoices as paid — hence critical severity.

From the tool's own definition: "Record a manual payment against an invoice (cash, bank transfer, cheque, card terminal). Updates invoice status to PARTIAL or PAID based on the running total."

## Use case

AI agents use record_invoice_payment to commit financial operations through FavCRM, usually the final step of a payment, billing, or trading workflow. A call moves real money.

## Recommended policy (PolicyLayer)

Verdict: **Approval-gated**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches FavCRM:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "record_invoice_payment": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}
```

## Other tools on FavCRM (219)

- `cancel_booking` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/cancel-booking.md
- `delete_account` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-account.md
- `delete_campaign` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-campaign.md
- `delete_category` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-category.md
- `delete_contact` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-contact.md
- `delete_custom_field` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-custom-field.md
- `delete_deal` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-deal.md
- `delete_invoice` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-invoice.md
- `delete_knowledge_document` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-knowledge-document.md
- `delete_post` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-post.md
- `delete_post_type` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-post-type.md
- `delete_post_type_field` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-post-type-field.md
- `delete_promotion` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-promotion.md
- `delete_segment` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-segment.md
- `delete_service_package` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-service-package.md
- `delete_tag` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-tag.md
- `delete_task` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-task.md
- `remove_post_block` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/remove-post-block.md
- `void_invoice` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/void-invoice.md
- `execute_tool` — Execute — https://policylayer.com/tools/io-favcrm-favcrm/execute-tool.md
- `switch_company` — Execute — https://policylayer.com/tools/io-favcrm-favcrm/switch-company.md
- `cancel_subscription` — Financial — https://policylayer.com/tools/io-favcrm-favcrm/cancel-subscription.md
- `create_plan_upgrade_link` — Financial — https://policylayer.com/tools/io-favcrm-favcrm/create-plan-upgrade-link.md
- `create_subscription` — Financial — https://policylayer.com/tools/io-favcrm-favcrm/create-subscription.md
- `enrol_membership` — Financial — https://policylayer.com/tools/io-favcrm-favcrm/enrol-membership.md
- `check_plan_operation` — Read — https://policylayer.com/tools/io-favcrm-favcrm/check-plan-operation.md
- `get_attachment_text` — Read — https://policylayer.com/tools/io-favcrm-favcrm/get-attachment-text.md
- `get_audit_log` — Read — https://policylayer.com/tools/io-favcrm-favcrm/get-audit-log.md
- `get_available_slots` — Read — https://policylayer.com/tools/io-favcrm-favcrm/get-available-slots.md
- `get_booking_detail` — Read — https://policylayer.com/tools/io-favcrm-favcrm/get-booking-detail.md
- …and 189 more: https://policylayer.com/tools/io-favcrm-favcrm.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-favcrm-favcrm · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-favcrm-favcrm