didit-mcp-server

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents access to identity and verification platforms via MCP tools, including didit_org_top_up which initiates a Stripe checkout link for funding organization balance/credits (an in-scope direct financial operation). This tool requires confirm: true and explicit human approval via agent instructions, but does not document an independent, service-enforced authentication or authorization control specifically validating the financial instruction at the execution layer (it relies on the agent's OAuth 2.1 user token and instruction-based confirmation flag). Therefore, direct financial exposure without qualifying independent control results in high severity.