generate_invoice_qr_code

What generate_invoice_qr_code does on PayPal

AI agents call generate_invoice_qr_code to retrieve information from PayPal without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why generate_invoice_qr_code is rated Low

Generating a QR code is a read/render operation: it encodes existing invoice data into a QR format without moving money, modifying records, or executing transactions. The worst-case misuse is leaking an invoice link, hence low severity. Confidence is slightly reduced because some implementations could trigger invoice delivery or status changes, but the description gives no indication of that.

From the tool's definition 'Generate a QR code for an invoice' — this creates a derived representation (QR image) of an existing invoice for display/sharing purposes, with no financial transaction or data mutation implied

The rule that runs generate_invoice_qr_code safely

PolicyLayer is an MCP gateway: it sits between your AI agents and PayPal, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For generate_invoice_qr_code, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "generate_invoice_qr_code": {}
  }
}

Questions about generate_invoice_qr_code