MCP MEETS
MONEY
ARTICLE · 007Quaestrum
DBDavid BörgerFounder

July 22, 2026

MCP and money: designing financial tools for AI agents

The Model Context Protocol, donated by Anthropic to the Agentic AI Foundation under the Linux Foundation in December 2025, has become the default way agents connect to external tools. Financial tools can ride the same protocol, but they need design rules that a weather API never needed.

How the agent standards consolidated

Dec 2025

Anthropic donates MCP to the Agentic AI Foundation under the Linux Foundation, with cross vendor governance from OpenAI, Microsoft and GitHub.

Apr 2026

The A2A protocol for agent to agent communication reaches version 1.0, with more than 150 organisations behind it, according to the project.

Jul 2026

Visa and Mastercard run agent initiated payments on live European rails, closing the loop from tools to money.

Scope the tool surface to the mandate

An agent should not see tools it is not allowed to use. If a mandate excludes bank transfers, the transfer tool should not appear in the agent's tool list at all. Scoped visibility beats runtime rejection: it removes temptation from the model's plan space and reduces failure loops where an agent retries a forbidden action.

Design for repetition and failure

Agents retry. Networks time out mid call. Every money moving tool therefore needs idempotency keys so that a retried request cannot pay twice, explicit state so that a half finished payment can be resolved, and reconciliation against the underlying rails so that intent and settlement always match. This is classic payments engineering, and it does not become optional because the caller is a model.

Keep the decision out of the model

The most important rule is architectural: the MCP tool receives requests, the policy engine decides. Budgets, limits, allow lists and approval thresholds live in deterministic infrastructure, and every decision lands in an append only audit log with the mandate reference attached. The model can ask for anything. What happens next is not up to the model, and that separation is what lets a company connect an agent to its account without holding its breath.