Square
by Square
Three tools that dispatch to 283 Square API methods — including taking a payment, issuing a refund and publishing an invoice that emails the customer. OAuth with 49 named scopes. Beta, production-only.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Square via MCP
https://mcp.squareup.com/mcpWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Use in Agentman
Connect Square once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioSquare Tools & Capabilities (3)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- We never read a live tool list. Both endpoints returned HTTP 401 to an anonymous request, so the three tools, their descriptions and their schemas come from Square's published source at commit
9aeafc9, not from a handshake. The hosted server could in principle register tools the open-source repository does not — we could not rule that out. - The tool count is not a measure of capability here. Three tools reach 283 methods. Any policy, review or risk assessment that counts tools will badly under-read this connector.
- No safety annotations. All three tools ship unannotated, so an MCP client cannot tell a read from a refund before the call.
- No scope separates a payment from a refund.
PAYMENTS_WRITEgrants both. - No read-only mode on the hosted server.
DISALLOW_WRITESexists only for the local server, and its underlyingisWriteflags missPayOrder,BatchChangeInventory,RemoveGroupFromCustomer,AddGroupToCustomer,ChangeBillingAnchorDate,TestWebhookSubscriptionandRevokeToken. - Production only. The remote server cannot reach a Square sandbox, so there is no safe place to rehearse a prompt that ends in a charge.
- Beta. Square labels the server Beta in its own documentation.
- Client allowlist. Square gates which MCP clients may register, so an unlisted client will fail to connect until Square adds it.
- Idempotency is the caller's job. Square documents
idempotency_keyas the protection against a duplicate charge, and warns that a repeatedCreatePaymentwithout one charges the customer twice. Nothing in the MCP layer supplies or enforces that key — an agent that retries a failed call is the exact scenario the key exists to prevent. - We found no published rate limits. Square's documentation index does not list a rate-limits page, and the URL we tried returned 404. Treat limits as unknown rather than absent.
- The npm package lags the repository.
square-mcp-serveron npm was last published at version 0.1.2 in April 2025, while the GitHub repository's head commit is dated April 2026. A local install from npm is not the code we read.
Frequently asked questions
Yes to both. Square's open-source server routes CreatePayment and RefundPayment through the same make_api_request tool, and Square's own commit history shows RefundPayment being corrected to a write operation in April 2026. The three-tool listing hides this because the money-moving verbs are arguments, not tool names.
Because it is a dispatcher, not a curated subset. Square's published source registers exactly three tools, and one of them, make_api_request, forwards a service and method pair to any of 283 REST methods across 38 Square services. The tool count measures the interface, not the reach.
Forty-nine named Square permissions, published by the server's own RFC 9728 descriptor on 2026-08-22. They are per-domain and genuinely narrowing, covering payments, orders, invoices, customers, inventory, gift cards, disputes and payouts separately. You can grant reading payments without granting writing customers.
No. Square's permissions reference assigns CreatePayment and RefundPayment the same PAYMENTS_WRITE scope, so any grant that lets an agent charge a card also lets it send money back. The scope boundary falls between business domains, never between a routine write and an irreversible one.
Yes, through invoices. Square documents that publishing an invoice makes Square follow up per the invoice configuration, which can mean emailing the customer or charging their card on file. The connector's own directory listing showcases invoice creation, so this outbound path is the advertised use case rather than an edge case.
Only the local server, and the guard is incomplete. A DISALLOW_WRITES environment variable blocks methods flagged as writes, but Square's source flags PayOrder, BatchChangeInventory and RemoveGroupFromCustomer as non-writes despite each mutating state. The hosted remote server exposes no read-only switch at all.
Not the hosted one. Square's documentation states that remote instances only access production resources, and that a local instance is the way to test against a seller's sandbox. Square also recommends testing prompts against a sandbox before production, which the remote server cannot do.
Both work, and the two sources disagree. Square's documentation only ever gives the SSE path, while Anthropic's directory and Square's own Claude Code install command give the streamable HTTP path. Both returned an authentication challenge on 2026-08-22, so both are live.
Sources
- Square Model Context Protocol Server documentation (retrieved 2026-08-22) · retrieved 2026-08-22
- Square MCP server source,
square/square-mcp-serverat commit9aeafc9cd2d9ff70b626123a12849a741ea3a162(read 2026-08-22). Apache-2.0. All method counts, HTTP verbs andisWriteflags on this page were derived from the 38 files underservices/. · retrieved 2026-08-22 - Square OAuth permissions reference (retrieved 2026-08-22) · retrieved 2026-08-22
- Square Invoices API, Publish invoice (retrieved 2026-08-22) · retrieved 2026-08-22
- Square Invoices API overview, delivery methods (retrieved 2026-08-22) · retrieved 2026-08-22
- Square idempotency guide (retrieved 2026-08-22) · retrieved 2026-08-22
- Square developer documentation index, llms.txt (retrieved 2026-08-22).
developer.squareup.com/robots.txtnames GPTBot, ClaudeBot and PerplexityBot in explicit allow groups; the MCP documentation page is not in any disallow list. · retrieved 2026-08-22 - Live OAuth posture check: anonymous requests to
https://mcp.squareup.com/mcpandhttps://mcp.squareup.com/sseeach returned HTTP 401 withWWW-Authenticate: Bearer; RFC 9728 metadata athttps://mcp.squareup.com/.well-known/oauth-protected-resourceand authorization server metadata athttps://mcp.squareup.com/.well-known/oauth-authorization-server(2026-08-22) · retrieved 2026-08-22 square-mcp-serveron npm, version 0.1.2 published 2025-04-25, read from the registry metadata at (retrieved 2026-08-22). The human-facing page atnpmjs.com/package/square-mcp-serverreturns 403 to a non-browser client. · retrieved 2025-04-25- Anthropic Connectors Directory entry — , read from our directory snapshot dated 2026-08-16 · retrieved 2026-08-16
- Square developer support — · Privacy
Server Info
- Category
- Finance
- Developer
- Square
- Tools
- 3
- Domain
- mcp.squareup.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.
Similar MCP Servers for Finance
Related Resources
Ready to connect Square?
Connect Square once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.