# GoCardless: L4 · Runs on its own

As of 21 Oct 2026, an AI agent gets into GoCardless on its own and does 89% of the core work.

Source: https://agentdrives.com/tools/gocardless?via=md · driven 21 Oct 2026 by AgentDrives's agent · New level in the latest drive · Rules of 20 Oct 2026 (rules version rules-2026-10-20-24: https://agentdrives.com/method/changelog?via=md#rules-2026-10-20-24) · method release 2026-Q4.9 · category Payments · license CC BY 4.0

**Not audited**

Our agent got in on its own and ran the core payment work without a browser: L4 · Runs on its own. Signing up took a form and an emailed code, with no CAPTCHA, then a token made by hand in the dashboard. Pay stopped at "Confirm downgrade" on the plan page, never clicked, with no card form and no billing API. Through the API it created customers and mandates, took one-off and recurring payments, and issued checkout links and refunds. It ran the sandbox on the free plan, so there was nothing to cancel, and closing the account is a support form that a Cloudflare check never cleared.

_Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_

L4 · Runs on its own: An agent gets in on its own, does at least 80% of the core work and can stop paying on its own: it cancels any plan it started, or there is nothing to cancel. Whether it can also remove what it made is shown on its own, outside the level.

- Learn: Docs it can act on (llms.txt, an OpenAPI and an MCP server)
- Access: MCP sign-in, sign-up in a browser
- Use: 89% of the work
- Pay: Ready to pay (Payment not yet proven; stopped at the pay button)
- Leave: Nothing to cancel; deletes its data, but the login stays
- Ways in: MCP sign-in, 4 of 9 core tasks; Sign-up in a browser, 8 of 9 core tasks
- Next: pay without a person
- robots.txt asks crawlers to stay off sign-up and the API. Nothing to fix. It keeps these pages out of search and doesn't stop agents signing up.

## The drive, checkpoint by checkpoint

The drive this page reads, on 21 Oct 2026. A newer drive, on 24 Oct 2026, is in its history.

1. **Docs**: on its own (21 Oct 2026)
2. **Sign up**: in a browser (21 Oct 2026)
3. **Verify**: in a browser (21 Oct 2026)
4. **Key**: in a browser (21 Oct 2026)
5. **First call**: on its own (21 Oct 2026)
6. **First action**: on its own (21 Oct 2026)
7. **Pay**: ready to pay (21 Oct 2026)
8. **Cancel**: not needed (21 Oct 2026)
9. **Delete**: blocked (21 Oct 2026)

Where it stopped: **Delete** (21 Oct 2026). Nothing to cancel; deletes its data, but the login stays.

## How an agent gets in

2 of 4 ways in worked without a person.

- **Email and code**, 10 min (drive of 21 Oct 2026): an inbox needed, a browser needed, a person not needed; core tasks done this way: 8 of 9
- **Sign-in for apps (OAuth, MCP)**, 12 min (drive of 21 Oct 2026): an inbox not needed, a browser needed, a person not needed; core tasks done this way: 4 of 9

The other ways in, as our agent tried them:

- No key needed: Stopped by a bot check
- CLI code login: Not reached

## Two kinds of agent

- An assistant in a browser (like ChatGPT agent or Claude on a computer): Signs up, confirms its email and does 89% of the core work. Payment: ready to pay, payment not yet proven; stopped at the pay button.
- An agent talking to it directly (API, MCP, agent payments): Stops at sign-up: it works only in a browser.

## Who gets in

- Agents on a server: Get in on their own.
- Signed agents: The sign-up page opens.
- Agents in a person's browser: Needs a person.

Sign-up page checked 24 Oct 2026. Signed agents: the ones Cloudflare verifies.

## What an agent can do

8 of 9 core capabilities done on at least one surface, in the drive of 21 Oct 2026.

| Capability | Result | API | MCP | CLI | UI |
|---|---|---|---|---|---|
| Accept a one-off bank payment (Pay by Bank) | Done | Done | Not tried | Not tried | Not tried |
| Create a hosted checkout/billing request flow | Done | Done | Not tried | Not offered | Not tried |
| Start a recurring subscription for a customer | Done | Done | Not tried | Not offered | Not tried |
| Change, pause or cancel a subscription | Done | Done | Not offered | Not offered | Not tried |
| Create a customer | Done | Done | Not tried | Not offered | Not tried |
| Save a customer's bank payment method (mandate) | Done | Done | Not tried | Not tried | Not tried |
| Refund a payment | Done | Not tried | Not tried | Not offered | Done |
| Send an outbound payment to a third party | Blocked | Blocked | Not offered | Not offered | Not tried |
| Collect payments across 30+ countries in multiple currencies | Done | Done | Not offered | Not offered | Not tried |

Other capabilities: 11 of 20 done.

| Capability | Result | API | MCP | CLI | UI |
|---|---|---|---|---|---|
| Pay out the collected balance to a bank account | Done | Done | Not tried | Not offered | Not tried |
| Read the account balance | Done | Done | Not offered | Not offered | Not tried |
| List and search payments | Done | Done | Not tried | Not tried | Not tried |
| Recover failed payments with intelligent retries (Success+) | Paid plan | Not offered | Not offered | Not offered | Paid plan |
| Screen payments for fraud and challenge chargebacks (Protect+) | Paid plan | Not offered | Not offered | Not offered | Paid plan |
| Apply for business financing (Pipe) | Not tried | Not offered | Not offered | Not offered | Not tried |
| Customise checkout branding | Paid plan | Paid plan | Not offered | Not offered | Not tried |
| Sync with accounting apps or build a custom integration | Done | Done | Not tried | Not tried | Not tried |
| Register and receive webhooks for payment/mandate events | Done | Done | Not tried | Not tried | Not tried |
| Trigger test scenarios and webhooks in a sandbox | Done | Done | Not offered | Not tried | Not tried |
| Complete end-to-end payments initiated and authorised by an AI agent (Agentic Payments) | Partly | Not offered | Partly | Not offered | Not tried |
| Look up local bank account details before collecting a payment | Done | Done | Not offered | Not offered | Not offered |
| Verify a bank account holder's identity | Paid plan | Paid plan | Not offered | Not offered | Not offered |
| Import mandates or outbound payments in bulk | Blocked | Blocked | Not offered | Not offered | Not offered |
| Set up an instalment schedule for a customer | Done | Done | Not offered | Not offered | Not tried |
| Export account data to a file | Paid plan | Paid plan | Not offered | Not offered | Not tried |
| Block specific payers or bank accounts | Done | Done | Not offered | Not offered | Not tried |
| Configure OAuth apps for partner integrations | Not tried | Not tried | Not offered | Not tried | Not tried |
| Set a tax rate applied to a payment | Done | Done | Not offered | Not offered | Not offered |
| Generate a mandate PDF for a customer | Done | Done | Not offered | Not offered | Not offered |

What it can't, and why:

- Send outbound payments: Needs a payment account GoCardless sets up during onboarding for the feature; the sandbox account has none (GET /outbound_payments 401)
- Create an API token without the dashboard: No token endpoint; tokens and OAuth consent are browser-only
- Close the account: Only through a support ticket whose form sits behind a Cloudflare interstitial
- Confirm MCP subscription creation or mandate cancellation on its own: The MCP refuses a confirm that arrives within about a second of its preview
- Install the CLI: Only on brew tap and GitHub releases, which robots.txt closes to our agent

## GoCardless, drive by drive

- 24 Oct 2026: Level L4 → L3. Our agent changed.

| Drive | Level | Stopped at | Agent |
|---|---|---|---|
| 24 Oct 2026 | L3 | Delete | Version 4 |
| 21 Oct 2026 | L4 | Delete | Version 4 |

Every drive and move as data: https://agentdrives.com/api/tools/gocardless/changes.json

## How an agent connects

- **MCP server**: yes. Official server. 24 tools, OAuth (DCR), the older 25 Nov 2025 spec · id srf_01m5en8zh331jm9tk2xct5r103
- **API**: yes. REST, 109 paths in the public OpenAPI; sandbox at api-sandbox.gocardless.com · id srf_01m5en8zh3z03dx6ems0b48csw
- **OpenAPI**: yes. declares 3.0.0; some paths drift (payer_themes 403 for non-Embed, mandate_imports 403 with no restriction named)
- **CLI**: yes. official gocardless CLI, sandbox only, distributed via brew tap / GitHub releases · id srf_01m5en8zh36z53ced6dg47dj52
- **SDK**: yes · id srf_01m5en8zh3r7tq9td5fgxkgjbj
- **Agent payments**: none found
- **llms.txt**: yes

## Does GoCardless have an MCP server, and can an agent connect to it?

Yes. GoCardless has an official MCP server. The server lists 24 tools, signs an agent in with OAuth and speaks the older 25 Nov 2025 MCP spec.

A new agent can get in on its own: in the drive of 21 Oct 2026, our agent signed up, verified and got its key without a person. Through the MCP server, 0 of our agent's 1 attempt worked, not on a core task.

## How does an AI agent get a GoCardless API key?

In the drive of 21 Oct 2026, our agent got its GoCardless API key in a browser, without a person. Read-write access token made in the dashboard (Developers > Create access token); no API to create tokens. OAuth (own partner app) and the MCP sign-in also give tokens after a browser consent; the code exchange is done without a browser.

## Paying the agent way

Ready to pay: payment not yet proven; stopped at the pay button.

The checkout: Walked to the last click ("Confirm downgrade") and stopped: Standard; Checkout: its own checkout; No CAPTCHA at checkout.

What would let agents pay on their own:
- Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card.
- List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev).
Ways to pay checked 21 Oct 2026.

Is this your product? Claim it free to reply next to the result and see how many things this drive found to fix. An Audit Drive ($499) gives you your fix list with how to make each fix, the whole drive here for 12 months, and new drives after your fixes: https://agentdrives.com/pricing?via=md#audit. Fixed something? Tell us in your account and our agent drives it again for free, up to twice a year.

## Behind the level

- Holds up: 76/100
- Agent-ready setup: llms.txt found, OpenAPI found, MCP server found, CLI found
- Not measured in this drive: Docs match

## The docs

598 of 7,642 pages read. Complete.

- A getting-started page
- An auth page
- Errors listed with their codes
- Code examples on some pages
- Newest page updated 20 Oct 2026
- A page for 9 of 9 core tasks

## Tried as documented

12 of 17 documented ways to do the core work worked when tried.

- 1 documented way didn't work
- 3 not tried (a paid plan, or no way to reach it)

## GoCardless in Payments

1st of 2 Payments products our agent got into on its own.

GoCardless is the highest of the 5 products we drove in Payments. As of 21 Oct 2026.

Products by level: L0 0, L1 3, L2 0, L3 1, L4 1, L5 0.

Also stopped at delete:

- [Stripe](https://agentdrives.com/tools/stripe.md?via=md): L3 · Does the work, driven 17 Oct 2026

All of Payments, by level: https://agentdrives.com/categories/payments?via=md

## Tips for agent builders

- Use the sandbox (manage-sandbox / api-sandbox.gocardless.com): free, no card, every core endpoint works.
- Send an Idempotency-Key on every create: a repeat returns 409 idempotent_creation_conflict with the original id; without a key a repeat duplicates.
- Use the scenario simulators (POST /scenario_simulators/{id}/actions/run) to activate mandates and confirm, pay out or fail payments instead of waiting.
- Refunds are off by default: enable them in Company settings > Refunds, and refund only confirmed payments while funds are in the balance.
- The MCP's write tools return a preview_token; the confirm call must come as a separate user turn, a confirm within about a second is refused.
- Some endpoints (bank_account_holder_verifications) require an Idempotency-Key header and say so in a clear 400.

## As data

- JSON: https://agentdrives.com/api/tools/gocardless.json?via=md
- Markdown: https://agentdrives.com/tools/gocardless.md?via=md
- Changes: https://agentdrives.com/api/tools/gocardless/changes.json
- Stable id: prd_01m57vgtnect30je46veeaxzf4 (https://agentdrives.com/id/prd_01m57vgtnect30je46veeaxzf4)
- MCP: get_tool {"slug":"gocardless"}