Every MCP tool in the SCOPE compliance index, grouped by server — risk posture, regulatory exposure, and the tools that warrant tighter governance.
2 critical 3 high 1 med 3 low · 9 tools · 1 SoD-flagged
regimes CCPACOSOGDPRGLBAISO_27001PIPEDAPSD2SOC2SOXUK_GDPR
Tools needing tighter control (5 of 9)
gocardless.payments critical conf mediumhuman approval
Creates, retries, and cancels bank debits against live customer mandates — money moves out of a payer's account and the collection lands in the merchant's revenue ledger.
gocardless.refunds critical conf mediumhuman approval
Issues refunds that return collected funds to a payer, reversing recognised revenue and disbursing money with a single actor and no second approver.
gocardless.mandates high conf mediumOBO
Cancels a customer's Direct Debit authorisation, permanently ending the merchant's right to collect from that payer until a new mandate is signed.
gocardless.subscriptions high conf mediumOBO
Creates recurring billing schedules that draw funds from a payer on every interval, committing future revenue without further review.
gocardless.customers high conf mediumOBO
Browses the full payer list and individual customer records, surfacing personal and banking-relationship data at list scale even with sensitive fields masked.
All other tools (4)
gocardless.events low conf mediumallow
Reads the lifecycle history of payments and mandates, revealing when each was submitted, confirmed, or failed.
gocardless.integration_guidance low conf mediumallow
Returns GoCardless API reference material, integration patterns, and code samples; no account data is touched.
gocardless.payment_links medium conf mediumaudit
Generates shareable billing request flows that solicit payment authorisation from customers under the merchant's brand.
gocardless.payouts low conf mediumallow
Reads settlement amounts and dates paid into the merchant's bank account, exposing revenue volumes to whoever holds the connection.