mark_invoice_paid · MCPDischarge MCP: Risk & Policy

WHAT IT DOES

What mark_invoice_paid does on MCPDischarge

AI agents use mark_invoice_paid to commit financial operations through MCPDischarge — usually the final step of a payment, billing, or trading workflow. A call moves real money.

WHY IT NEEDS A POLICY

Why mark_invoice_paid needs a policy

This tool directly commits a financial state change by marking an invoice as paid, which affects billing records and financial obligations. In a hospital billing context, incorrectly or fraudulently marking invoices as paid could result in significant financial loss, audit failures, or compliance violations.

From the tool's definition Mark a patient's invoice as paid

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

mark_invoice_paid Approval-gated

Any call to mark_invoice_paid is blocked until a human approves it. The rest of the server keeps working.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "mark_invoice_paid": {
      "deny_if": [
        {
          "conditions": [],
          "on_deny": "Requires human approval."
        }
      ]
    }
  }
}

GATE THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches MCPDischarge, so you can run agents against it safely.

FAQ

Questions about mark_invoice_paid

What does the mark_invoice_paid tool do? +

Mark a patient's invoice as paid. It is categorised as a Financial tool in the MCPDischarge MCP Server, which means it involves financial transactions. Block by default and require explicit approval.

How do I enforce a policy on mark_invoice_paid? +

Register the MCPDischarge MCP server in PolicyLayer and add a rule for mark_invoice_paid: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches MCPDischarge. Nothing to install.

What risk level is mark_invoice_paid? +

mark_invoice_paid is a Financial tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.

Can I rate-limit mark_invoice_paid? +

Yes. Add a rate_limit block to the mark_invoice_paid rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block mark_invoice_paid completely? +

Set action: deny in the PolicyLayer policy for mark_invoice_paid. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides mark_invoice_paid? +

mark_invoice_paid is provided by the MCPDischarge MCP server (prashantsingh1234/mcp_project). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.