Finance Engineering
Back-office agents that move money
An agent reconciles invoices, posts journal entries, and initiates vendor payments — actions that are effectively irreversible once they clear.
Real example — shipping today
source →Stripe · Agent Toolkit / agentic commerce
An open-source toolkit (and MCP server) that lets agents call Stripe to create charges, issue refunds, manage subscriptions, and mint single-use virtual cards.
Their own controls — Stripe recommends restricted, per-resource API keys and Shared Payment Tokens bounded to a specific seller, amount, and time window.
The danger without a gate
Without per-call control, a compromised prompt or a logic error moves money to the wrong account — and coarse logs written after execution are exactly what an attacker tampers with to hide the trail.
How MCPIP handles it, step by step
Read it top to bottom. Each step shows the real command and exactly what MCPIP returns — the same allow / step-up / denied envelope every time.
The agent initiates a $42,000 payment
It requests a wire to a payee it only knows by an opaque alias. MCPIP holds it for approval.
$ mcpip --json authorize skill_wire_payment --arg payee=payee_9QX2 --arg amount_usd=42000{
"error": "step_up_pending",
"challenge_id": "chg_5d20cc",
"correlation_id": "8f0a1e6d"
}The controller approves — separation of duties by construction
A different person (never the agent) confirms with a PIN bound to this payee and amount. The signed record is written before the money moves.
$ mcpip --json complete --challenge chg_5d20cc{
"decision": "allow",
"status": "executed",
"transaction_ref": "txn_9f10ab",
"executed_target_class": "rest",
"worm_sequence": 48217,
"correlation_id": "8f0a1e6d"
}attackThe attack: swap the payee after approval
A tampered follow-up keeps the amount but swaps the payee to an attacker. The payload no longer matches the approval, so it’s denied.
$ mcpip --json authorize skill_wire_payment --arg payee=payee_ATTACKER --arg amount_usd=42000{
"error": "denied",
"correlation_id": "e02fa1b8"
}The result
Enforced segregation-of-duties and an audit trail regulators can trust.
The same flow, at a glance
Every command above runs against a local sandbox in one line.
run it yourself — curl … | bash && mcpip up →