Human-approved media generation for AI agents
Place explicit approval around spend, source rights, publication, and credential changes.
The current package does not expose top-up or Checkout operations as MCP tools. CLI or API flows can return a Checkout URL, but payment completion remains a human browser action and agents are not documented as directly charging a payment method. A low-balance response should pause the workflow and ask an account owner to buy credits, select a lower-cost model, or stop.
Remote OAuth avoids storing a personal API key in the client configuration and can be revoked from account settings. Where a fallback key is necessary, place it in supported secret configuration, restrict its scope, and require human approval for creation, rotation, or revocation. Never paste it into a prompt or URL.
Approve the brief before the agent reserves credits
A human-approved generation flow should expose the selected model, published credit cost, prompt, aspect ratio, source asset, and intended use before submission. OfflineCreator provides list_models and get_credits for preflight and filters MCP tool visibility by models, read, and generate scopes. Grant generate only to the connection that needs it; read or model discovery does not require the same authority.
Approval should also confirm that the operator may disclose the prompt and source media to the selected cloud provider. MCP changes the interface, not the processing location. A checked box cannot substitute for source rights, client permission, or legal review where those are required.
Define what invalidates approval. A changed prompt, source asset, model, aspect ratio, cost, provider, destination, or attempt ceiling requires a new pre-submit decision. The agent may fill in a prepared record, but it should not infer that approval of one draft authorizes a more expensive model or a different source image.
Review the result before download and publication
After submission, the agent may track status, wait within a bound, and retrieve a completed output. Human review should inspect the actual result for rights, safety, brand, and factual concerns before it reaches a public destination. Preserve the job identifier and approval record; do not treat a successful provider state as publication approval.
The post-generation decision should record accept, revise, reject, or escalate. Accept authorizes only the named destination. Revise returns to a new pre-submit record with another cost ceiling. Reject preserves enough provenance to avoid accidental reuse. Escalate pauses publication when rights, safety, brand, or factual review cannot be completed by the assigned approver.