Spend controls for MCP image and video generation

Keep top-ups as an explicit funding decision

The published MCP server does not expose a Stripe Checkout tool. Alert on low balance, but require an account owner to decide whether to buy credits in Studio, change model, reduce iteration, stop, or intentionally enable an x402 wallet for machine-payable challenges. Card top-ups remain human-controlled; x402 is a separate rail with a local spend cap.

Require a ledger check at four points: immediately before submission, after reservation, after a documented provider failure or eligible cancellation, and before any replacement job. Preserve the job identifier and expected credit delta. If the observed balance does not match the expected state, pause generation and investigate rather than using a top-up to conceal the mismatch.

Preflight every generation with model cost and balance

OfflineCreator publishes a credit cost per model and exposes list_models plus get_credits before submission. Current catalog costs range from 1 credit for FLUX Schnell to 96 credits for Veo 3.1 Fast, with other image and video choices between those points. Treat the catalog as a current snapshot and compare the selected model's visible cost with the current balance before an agent reserves work.

A useful spend policy sets an allowed model set, a maximum cost per job, and an approval threshold for expensive or repeated attempts. It should also require a final prompt, aspect ratio, and rights-cleared source before submission. Concurrency limits control simultaneous work but do not replace a total budget or an approval log.

Turn the credit ledger into an approval checklist

Before submission, capture the current balance, selected model, published per-generation cost, maximum attempt count, and the person who approved the brief. Multiply cost by the allowed attempts rather than checking only whether one request fits. For mixed image and video work, calculate each workflow separately because the launch catalog spans materially different credit costs. This is a planning calculation, not a promise about how many acceptable assets a balance will produce.

After submission, attach the returned job identifier to the approval record. If the client times out, check status or recent jobs before authorizing another reservation. If a job fails or is canceled, compare the post-event balance with the preflight record and escalate a mismatch instead of silently increasing the budget. The product sources document automatic failure refunds and eligible cancellation refunds, but this research did not measure posting time.

Set separate controls for concurrency and total spend. A plan's concurrent-generation allowance limits simultaneous jobs; it does not cap how many sequential jobs an agent can request. Keep the generate scope narrow, require a human to complete any top-up Checkout, and revisit model costs and plan terms at the page's monthly freshness interval.

Use scenario arithmetic to expose risk before approval. Ten FLUX Schnell drafts at the cited one-credit cost reserve 10 credits; one Veo 3.1 Fast attempt at the cited 96-credit cost reserves 96. A policy that only checks whether each individual call fits can approve both while hiding a 106-credit combined envelope. The calculation is deterministic from current catalog values, but it says nothing about creative success.