# prepare_buy_checkout

Prepare a manual checkout URL for a Sanka Buy merchant purchase after Purchase Order creation. This does not complete payment.

Agent View of the PolicyLayer registry record for `prepare_buy_checkout`. HTML page: https://policylayer.com/tools/sankahq-sanka-mcp/prepare-buy-checkout

## Facts

- Tool: `prepare_buy_checkout`
- Server: Sanka MCP Server (`sankahq/sanka-mcp`) — https://policylayer.com/tools/sankahq-sanka-mcp.md
- Homepage: https://github.com/sankaHQ/sanka-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "prepare_buy_checkout",
    "arguments": {}
  }
}
```

## Why prepare_buy_checkout is rated Medium

The tool prepares checkout infrastructure (URL generation) rather than executing payment or transferring funds, making it Write rather than Financial. However, it sits in the payment flow and could be misused to prepare fraudulent checkouts. Severity is medium because while it creates checkout state, payment completion is blocked and the actual financial transaction requires additional steps.

From the tool's own definition: "Tool name 'prepare_buy_checkout' and description indicates it prepares a checkout URL for a merchant purchase after PO creation. The description explicitly states 'This does not complete payment', confirming no financial transaction is executed."

## Use case

AI agents use prepare_buy_checkout to create or update resources in Sanka MCP Server, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Sanka MCP Server environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Sanka MCP Server:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "prepare_buy_checkout": {
      "limits": [
        {
          "counter": "prepare_buy_checkout_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Sanka MCP Server (348)

- `cancel_buy_request` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/cancel-buy-request.md
- `cancel_export_job` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/cancel-export-job.md
- `cancel_import_job` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/cancel-import-job.md
- `cancel_workspace_invitation` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/cancel-workspace-invitation.md
- `delete_absence` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-absence.md
- `delete_approval_rule` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-approval-rule.md
- `delete_association` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-association.md
- `delete_attendance_record` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-attendance-record.md
- `delete_bill` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-bill.md
- `delete_company` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-company.md
- `delete_contact` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-contact.md
- `delete_deal` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-deal.md
- `delete_delivery_rule` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-delivery-rule.md
- `delete_disbursement` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-disbursement.md
- `delete_disbursement_allocation` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-disbursement-allocation.md
- `delete_estimate` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-estimate.md
- `delete_expense` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-expense.md
- `delete_ferry_diagram` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-ferry-diagram.md
- `delete_ferry_todo` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-ferry-todo.md
- `delete_inventory` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-inventory.md
- `delete_inventory_transaction` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-inventory-transaction.md
- `delete_invoice` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-invoice.md
- `delete_item` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-item.md
- `delete_location` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-location.md
- `delete_lock_rule` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-lock-rule.md
- `delete_order` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-order.md
- `delete_payment` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-payment.md
- `delete_project` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-project.md
- `delete_property` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-property.md
- `delete_purchase_order` — Destructive — https://policylayer.com/tools/sankahq-sanka-mcp/delete-purchase-order.md
- …and 318 more: https://policylayer.com/tools/sankahq-sanka-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=sankahq-sanka-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/sankahq-sanka-mcp