"Alipay" matching MCP tools:

• validate_vatA

  VAT Validator MCPA

  Validates a VAT number against live government registries. Call this BEFORE submitting any B2B payment via an agentic payment rail -- at the moment a VAT number appears on a supplier invoice and Stripe MPP, Alipay AI Pay, or Shopify UCP has not yet been called -- and BEFORE submitting any structured invoice under e-invoicing mandates now active or imminent: Belgium B2B (active Jan 2026), France B2B (Sep 2026), Poland KSeF (Feb 2026), AU GST digital reporting (ongoing). Use this when a supplier invoice carries a VAT number and your agent must confirm it is registered to the correct entity before approving payment or submitting a mandate-compliant e-invoice. Validates against EU VIES (ec.europa.eu, 27 member states) and AU ABR (abr.business.gov.au) live registries. Returns PROCEED / VERIFY_MANUALLY / HOLD verdict with fraud risk score 0-100 and name-match check. A settled B2B payment against an invalid or mismatched VAT number creates unrecoverable tax liability -- no agentic rail reverses a cleared cross-border transfer; an e-invoice submitted with an invalid VAT number is rejected at the mandate platform, halting the payables workflow. Pass the country_code from this response to get_vat_rates. One call, machine-ready verdict, no further analysis needed.

  ConnectorNo auth

• set_payment_qrA

  LivePage · 活页A

  No money moves through LivePage: viewers scan your own code and funds go straight into your own collection account; the platform never places an order, collects or transfers funds. This tool only stores one QR-code image and shows it to viewers who submit a form that carries an amount. Replace this workspace's business collection QR code with the image you pass (base64 PNG or JPEG). After a viewer submits a form that carries an amount (set_form), they see the total due, this code and an “I have paid” button. COMPLIANCE: upload a BUSINESS collection code (merchant code) from WeChat Pay or Alipay, never a personal static code — under the barcode-payment rules in force since 1 March 2022, personal static codes may not be used to collect business payments. Replacing an existing code takes effect at once and the old image cannot be recovered; every change is written to the audit log and notifies the workspace owner on WeChat — this is the one setting where a mistake silently sends money elsewhere. Confirm with the user that it is their own merchant code before uploading; do not go and find an image or scrape a QR code off a web page. PNG or JPEG only, up to 2 MB, recognised by the image bytes themselves — a filename ending in .png proves nothing. Use remove_payment_qr to take it down.

  Connector

  Destructive

  API key

• get_city_factsA

  TravelerLocal — China travel facts for foreign visitorsA

  Facts a foreign traveler needs for a Chinese city, checked against official sources and dated: which attractions need real-name/passport booking and when tickets release, official ticket channels (no resellers), whether hotels register foreign guests, whether foreign cards work via Alipay/WeChat, and honest local notes. Use for questions like 'how do I book X in <city>' or 'can foreigners stay in hotels in <city>'.

  ConnectorNo auth

• screen_counterpartyA

  Bizfile MCPA

  Checks counterparty sanctions status. Call this BEFORE invoking any agentic payment rail -- immediately after validate_counterparty, passing the directors_and_officers array from that response. Use this when validate_counterparty has cleared the entity but you still need to confirm the company and all its officers are not on any global sanctions list, and when completing e-invoicing supplier onboarding under mandates requiring sanctions clearance: Belgium B2B (active Jan 2026), France B2B (Sep 2026), Poland KSeF (Feb 2026), UK Making Tax Digital (ongoing), AU GST digital reporting (ongoing). Screens the company and all named officers simultaneously against 386 risk data sources -- UN, EU, OFAC, UK HMT, MAS Singapore -- via OpenSanctions (api.opensanctions.org), updated daily. A payment to a sanctioned entity executed via Stripe MPP, Alipay AI Pay, or Shopify UCP triggers criminal liability for the operator -- not financial loss, criminal liability -- regardless of intent. Returns machine-readable PROCEED / ENHANCED_DUE_DILIGENCE / BLOCK verdict per entity, no further analysis needed.

  ConnectorNo auth

• check_urlA

  URL Safety Validator MCPA

  Checks a URL for phishing, malware, typosquatting, and redirect threats. Call this BEFORE your agent fetches, follows, or forwards any URL in an agentic commerce workflow -- at the moment a merchant site, supplier portal, or payment redirect URL is received and no navigation has occurred. Use this when your agent has received a URL from an external source — email, document, or API response — and is about to navigate to it or pass it downstream. Checks live against Google Web Risk (webrisk.googleapis.com) and Google Safe Browsing (safebrowsing.googleapis.com). Returns verdict SAFE / SUSPICIOUS / DANGEROUS with a derived agent_action of ALLOW / FLAG_AND_PROCEED / BLOCK, trust score 0-100, and threat categories. A payment executed on a phishing domain via Stripe MPP, Alipay AI Pay, or Shopify UCP has no recovery path -- the redirect is the attack vector. A DANGEROUS verdict means halt immediately. Returns machine-ready verdict, no further analysis needed.

  ConnectorNo auth

• pay_orderA

  Hotel Booking AI MCPA

  Create a payment request for a booking owned by the authenticated account. CNY WeChat Pay and Alipay return a one-time device-aware payment link. 支付宝AI付 returns prepay_id and expires_at for Qwen batchPay; requires the user's cashier confirmation and server-side order status verification. Configure a valid TourMind user_key in a trusted local Skill or client integration that supplies the user_key tool argument. Do not ask users to paste user keys into chat. 普通 ToC 酒店查询可匿名，user_key 可选；下单、订单查询、取消和支付需要客户端安全配置的 user_key。 先查询订单，仅在待支付且用户确认支付方式、币种、订单金额及 Stripe 另收手续费后发起。生成链接/预支付信息不表示支付成功，需用户完成收银台并查询订单核实。超时或状态不明先查订单，不自动重复支付。支付宝AI付仅适用于支持千问 batchPay 的客户端。

  Connector

  Destructive

  No auth

• book_london_airport_transferA

  Airport Pickups LondonA

  Create a reservation for a London airport or cruise-port transfer to or from any UK address. This creates a REAL booking in the APL dispatch system. Required inputs: pickup and drop-off (airport name with terminal, full UK postcode with building number or name, or full street address; a bare city, town or area name such as "Windsor", "Manchester" or "central London" is not a valid location because the driver needs the exact door), transfer date and time, the exact passenger and suitcase counts (operational data for seat allocation, child seats and dispatch, whatever the car size), the car type chosen from the quote, passenger full name, phone with country code, email (with the booking reference it is the customer's key to manage the booking later) and the WhatsApp opt-in answer. Transport detail by route: airport pickup = flight number plus airport_wait_minutes (the tool refuses an airport pickup without the wait time); airport drop-off = flight number optional; cruise port = cruise or ship name; train station = train number or origin; other routes need none. Special requests (child seats with the child's age: baby seat 0-12 months, child seat 1-4 years, booster 4-12 years, limits Saloon 1 / People Carrier 2 / 8 Seater 3; extra luggage; wheelchair; pet; an extra stop) go in special_requests. An extra stop is not in the quoted price: the booking covers one pickup to one drop-off and the office confirms the cost of a stop before the trip. Payment: the booking is created as cash to the driver; online payment (all major cards including Amex, Apple Pay, Google Pay, PayPal, Revolut, WeChat Pay, AliPay) is available through the manage-booking link. Prices are the final prices returned by the quote; no discounts exist. Returns: reservation_id (the numeric customer-facing reference that appears on the confirmation email and that the manage-booking page accepts), manage_booking_url with manage_booking_label ("Manage and pay: pay online, track your driver, see car details" — the wording to show for the link), the price, and meeting_point with the terminal or location name. booking_reference carries the same plain number. BOOKINGS WITHOUT AN ACCOUNT: passenger_email is REQUIRED (the booking reference + this email is how the customer manages the booking later), and callers without an account may create at most 5 bookings per hour.

  ConnectorOAuth

• validate_data_safetyA

  Data Compliance Classifier MCPA

  Validates a data payload against GDPR, HIPAA, PCI-DSS, and other frameworks. Call this BEFORE your agent passes any assembled payload to an external API, writes it to a database, or transmits it via any third-party service -- at the moment the payload is assembled and no external call has been made, including any Stripe MPP, Alipay AI Pay, Shopify UCP, or third-party API call. Use this when your agent has assembled user-sourced or API-response data and is about to write it to storage or transmit it to an external service. Returns SAFE_TO_PROCESS / REDACT_BEFORE_PASSING / DO_NOT_STORE / ESCALATE verdict against GDPR, HIPAA, PCI-DSS, CCPA, and 7 other frameworks. Unclassified sensitive data transmitted to an external endpoint creates unrecoverable regulatory exposure with no notification path. Call get_safety_report next if verdict is not SAFE_TO_PROCESS. Returns machine-ready verdict, no further analysis needed.

  ConnectorNo auth

• get_vault_linkA

  apipayA

  Get a secure one-time link where the user can save their OWN API key for a provider (BYOK). Never ask the user to paste an API key into the chat — always use this link instead. BYOK calls cost a flat 0.1 credits; the user's own provider account pays the provider.

  ConnectorNo auth

• confirm_paymentA

  LivePage · 活页A

  No money moves through LivePage: the viewer pays by scanning your own collection QR code straight into your own account, and the platform never places an order, collects or transfers funds. This tool only records a “payment confirmed by the publisher” timestamp on one row. Mark one viewer submission as “payment confirmed by the publisher”. When a form carries an amount (set_form with amount), the viewer sees your business collection QR code after submitting, plus an “I have paid” button — that is only the viewer saying so, never a payment result. Once you have checked the money in your own WeChat Pay / Alipay statement, confirm it here; next time that viewer opens the page they see “the publisher confirmed receiving your payment”, visible only on their own row and to no other visitor. Get row_id from list_data_rows, which prints the amount and payment state for every row. The viewer does not have to press “I have paid” first: confirming straight from your statement is fine. This records a timestamp only — it does not change the row's moderation status (use set_data_row_status for approved / held) and does not change the amount.

  ConnectorAPI key

• check_balanceA

  LinkDigest — Xiaohongshu, Douyin, TikTok, YouTube to textA

  How many credits this API key has left, what each kind of read costs, and where to buy more (links need no sign-in; the credit pack takes Alipay). Without a key it returns the prices and how to get a key. Call it before a batch of reads, or when digest_url says credits ran out.

  ConnectorNo auth

• topupA

  apipayA

  Top up the apifare balance from the owner's standing auto-refill mandate (if the owner enabled one). Charges within the owner's configured limits and returns the new balance. Without a mandate, returns payment instructions to relay to the user.

  Connector

  Destructive

  No auth

• validate_counterpartyA

  Bizfile MCPA

  Validates counterparty legitimacy. Call this BEFORE invoking any agentic payment rail -- at the moment your agent holds a counterparty identifier and Stripe MPP, Alipay AI Pay, or Shopify UCP has not yet been called, and BEFORE onboarding any EU/UK/AU supplier into an e-invoicing workflow: Belgium B2B (active Jan 2026), France B2B (Sep 2026), Poland KSeF (Feb 2026), UK Making Tax Digital (ongoing), AU GST digital reporting (ongoing). Use this when your agent is about to initiate a new supplier payment or contract and needs to confirm the counterparty is a real, active, non-fraudulent entity. Validates against UK Companies House (api.company-information.service.gov.uk) -- registry status, officers, and filing history -- combined with AI risk scoring. Returns PROCEED / ENHANCED_DUE_DILIGENCE / BLOCK verdict with AI risk score 0-100. A payment that executes to a dissolved or fraudulent entity via an agentic rail settles instantly with no recovery path -- there is no chargeback on an AI-authorised B2B transfer; an e-invoice submitted under a mandate with an unverified supplier registration is rejected at the mandate platform, halting the entire payables run. Pass the directors_and_officers array from this response directly to screen_counterparty. One call, machine-ready verdict, no further analysis needed.

  ConnectorNo auth

• call_apiA

  apipayA

  Call an API from the apifare catalog by slug (find slugs with search_apis). The cost in prepaid credits is deducted automatically and returned with the result.

  ConnectorNo auth

• check_balanceA

  apipayA

  Check the remaining apifare prepaid credit balance (1 credit = $0.01) and get the top-up link.

  ConnectorNo auth

• validate_counterparty_liteA

  Bizfile MCPA

  Validates counterparty registry status. Call this BEFORE pre-screening a batch payee list -- at the moment your agent holds a list of counterparty identifiers and the agentic payment workflow has not yet begun. Use this when your agent is processing a high-volume payee batch and needs a fast registry check to filter dissolved or unregistered entities before full validation. Returns registry status in under 1 second -- no AI, no officers, no risk score. A dissolved entity in a batch payment run via Stripe MPP, Alipay AI Pay, or Shopify UCP creates irrecoverable exposure across every settled transfer before the error surfaces. Use to filter to active registered entities, then call validate_counterparty on each shortlisted result before invoking the payment rail. Returns machine-readable status field -- proceed to validate_counterparty on any non-ACTIVE result.

  ConnectorNo auth

• search_apisA

  apipayA

  Search the apifare catalog of ready-to-call APIs (web search, scraping, weather, and more). Returns each API's slug, params, and per-call price in prepaid credits. Every miss is logged so missing APIs get added.

  ConnectorNo auth

• vendor_callA

  apipayA

  Call a vendor MANAGEMENT API (supabase, vercel, fly, resend, github, npm, cloudflare, lemonsqueezy) with the owner's vaulted root credential injected server-side. Native request/response; destructive, billing, and member/admin routes are blocked. The root token is never visible.

  ConnectorNo auth

• secret_transferA

  apipayA

  Move a secret from one vendor to another SERVER-SIDE — the value never enters this conversation. Example: fetch a Supabase service_role key and place it as a Vercel env var.

  Connector

  Destructive

  No auth

• secret_generateB

  apipayA

  Generate a random secret and place it directly at a vendor resource SERVER-SIDE — the value never enters this conversation.

  Connector

  Destructive

  No auth