Square

Three tools dispatching to 283 Square API methods — take a payment, issue a refund, publish an invoice that emails the…

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Square connector does

The Square MCP server connects a Square seller account to Claude, ChatGPT and any MCP-compatible agent. It publishes three tools, but one of them dispatches to 283 methods across 38 Square services — payments, refunds, invoices, orders, catalog, payroll and more. Sign-in is OAuth with 49 named Square permissions.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Square tools (3)

  • get_service_info
  • get_type_info
  • make_api_request

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • We never read a live tool list. Both endpoints returned HTTP 401 to an anonymous request, so the three tools, their descriptions and their schemas come from Square's published source at commit 9aeafc9, not from a handshake. The hosted server could in principle register tools the open-source repository does not — we could not rule that out.
  • The tool count is not a measure of capability here. Three tools reach 283 methods. Any policy, review or risk assessment that counts tools will badly under-read this connector.
  • No safety annotations. All three tools ship unannotated, so an MCP client cannot tell a read from a refund before the call.
  • No scope separates a payment from a refund. PAYMENTS_WRITE grants both.
  • No read-only mode on the hosted server. DISALLOW_WRITES exists only for the local server, and its underlying isWrite flags miss PayOrder, BatchChangeInventory, RemoveGroupFromCustomer, AddGroupToCustomer, ChangeBillingAnchorDate, TestWebhookSubscription and RevokeToken.
  • Production only. The remote server cannot reach a Square sandbox, so there is no safe place to rehearse a prompt that ends in a charge.
  • Beta. Square labels the server Beta in its own documentation.
  • Client allowlist. Square gates which MCP clients may register, so an unlisted client will fail to connect until Square adds it.
  • Idempotency is the caller's job. Square documents idempotency_key as the protection against a duplicate charge, and warns that a repeated CreatePayment without one charges the customer twice. Nothing in the MCP layer supplies or enforces that key — an agent that retries a failed call is the exact scenario the key exists to prevent.
  • We found no published rate limits. Square's documentation index does not list a rate-limits page, and the URL we tried returned 404. Treat limits as unknown rather than absent.
  • The npm package lags the repository. square-mcp-server on npm was last published at version 0.1.2 in April 2025, while the GitHub repository's head commit is dated April 2026. A local install from npm is not the code we read.

Frequently asked questions

Can the Square MCP server take a payment or issue a refund?

Yes to both. Square's open-source server routes CreatePayment and RefundPayment through the same make_api_request tool, and Square's own commit history shows RefundPayment being corrected to a write operation in April 2026. The three-tool listing hides this because the money-moving verbs are arguments, not tool names.

Why does the Square connector list only three tools?

Because it is a dispatcher, not a curated subset. Square's published source registers exactly three tools, and one of them, make_api_request, forwards a service and method pair to any of 283 REST methods across 38 Square services. The tool count measures the interface, not the reach.

What OAuth scopes does the Square MCP server request?

Forty-nine named Square permissions, published by the server's own RFC 9728 descriptor on 2026-08-22. They are per-domain and genuinely narrowing, covering payments, orders, invoices, customers, inventory, gift cards, disputes and payouts separately. You can grant reading payments without granting writing customers.

Does a Square OAuth scope separate taking a payment from refunding one?

No. Square's permissions reference assigns CreatePayment and RefundPayment the same PAYMENTS_WRITE scope, so any grant that lets an agent charge a card also lets it send money back. The scope boundary falls between business domains, never between a routine write and an irreversible one.

Can the Square connector email my customers?

Yes, through invoices. Square documents that publishing an invoice makes Square follow up per the invoice configuration, which can mean emailing the customer or charging their card on file. The connector's own directory listing showcases invoice creation, so this outbound path is the advertised use case rather than an edge case.

Can I run the Square MCP server in read-only mode?

Only the local server, and the guard is incomplete. A DISALLOW_WRITES environment variable blocks methods flagged as writes, but Square's source flags PayOrder, BatchChangeInventory and RemoveGroupFromCustomer as non-writes despite each mutating state. The hosted remote server exposes no read-only switch at all.

Does the Square MCP server work against a sandbox account?

Not the hosted one. Square's documentation states that remote instances only access production resources, and that a local instance is the way to test against a seller's sandbox. Square also recommends testing prompts against a sandbox before production, which the remote server cannot do.

What is the correct Square MCP server endpoint?

Both work, and the two sources disagree. Square's documentation only ever gives the SSE path, while Anthropic's directory and Square's own Claude Code install command give the streamable HTTP path. Both returned an authentication challenge on 2026-08-22, so both are live.

Sources

More Finance connectors

  • Affinity

    Search your CRM, prep for meetings and update deal records from your AI assistant.

  • Aiera

    Pull earnings-call transcripts, event calendars, SEC filings and company publications into your AI assistant.

  • Airwallex Developer

    Search Airwallex documentation and exercise a sandbox account from an AI agent.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Square to work.

Connect Square once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio
Call (650) 285-1019Our AI receptionist answers.