Quote first, charge on confirm: paid tool calls in an MCP server

Wiro AI creates an MCP (Model Composition Platform) server to facilitate the deployment and management of various AI models, including image, video, audio, and large language models (LLMs). These models can be chained together in workflows to form agents, which can be hosted and accessed through the platform. The cost of these actions varies, depending on the specific tools being utilized.

The primary challenge in designing this system was to allow users to spend money on the assistant's behalf without surprising them with unexpected charges. To address this issue, the team implemented several key patterns:

1. Tools that charge a fixed, known amount return a quote upon being called without confirm: true. This quote includes the amount in USD, a description of what will happen, which wallet will pay, and a nextAction indicating the same tool with the same arguments plus confirm: true and confirm_charge_usd set to the quoted amount. The assistant then presents the quote to the user, waits for a clear affirmation, and only then proceeds with the charge.

2. The server re-prices any confirmed calls to ensure the price is accurate at the time of execution. If the price has changed since the initial quote, the server will not charge and will return a new quote. The assistant must then show the new price and request confirmation again. For prorated upgrades, the exact amount is only known at the time of charging, so the confirm_charge_usd field represents the maximum amount the user agreed to pay.

3. The server's instructions specify that no tool should set confirm: true on its own, and users should not reuse a "yes" for a different charge or change. Additionally, a "yes" given before the price is shown does not constitute valid consent. For batch operations, one clear "yes" covers the entire list or total shown.

4. Certain actions, such as deleting a workflow or agent, cancelling a plan, replacing a workflow's contents, or disconnecting an account, require the same two-step process. The first call describes the change, while confirm: true finalizes the action.

5. For long-running jobs, such as model runs, workflow executions, or agent replies, the server defaults to a 45-second timeout. If the call times out, the tool returns the job's current state and a nextAction instructing the assistant to continue the task without invoking the run_model tool again. This prevents the assistant from inadvertently billing a second job due to a timeout.

6. For usage-priced work, where there is no fixed quote to confirm, the server encourages the assistant to provide an estimated cost before executing the work. The assistant should only proceed with the request if the user explicitly asked for that specific workload and, for large or open-ended jobs, or for runs the user did not request (like retries), the assistant should seek initial confirmation.

In summary, the Wiro AI MCP server employs a series of structured rules to ensure users are aware of and agree to all charges associated with the usage of AI models and tools. These rules are implemented both on the server side, through carefully crafted instructions, and on the client side, where the assistant follows the server's directives to facilitate transparent and predictable billing.