{
  "schemaVersion": 1,
  "methodology": "https://ionbin.com/interfaces/methodology/#evaluations",
  "evaluation": {
    "id": "paypal-mcp",
    "testedOn": "2026-10-18",
    "coverage": "remote-boundary",
    "summary": "PayPal's documented streamable HTTP endpoints returned 404 in production and sandbox. The SSE endpoint's public OAuth metadata responded normally.",
    "identity": {
      "version": "Remote deployment version not disclosed by the observed responses",
      "target": "https://mcp.paypal.com/http",
      "integrity": "HTTPS certificate verification enabled. Production /http 404 body SHA-256: 7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402. Public /sse resource-metadata body SHA-256: 9a9c9e06ba85296a752b8900c2bac8c587fc5f00f2ab8371524ff7e8fc8c93f5. These fingerprint observed responses, not the deployed server implementation."
    },
    "environment": [
      "Debian Linux x86_64 (kernel 6.12) evaluation box; Python 3.13.5 urllib; OpenSSL 3.5.7.",
      "No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.",
      "Observed 2026-10-19T05:52:05.754299+00:00 through 2026-10-19T05:54:32.414520+00:00 UTC.",
      "One request per listed check; 20-second timeout and 64-KiB response cap. Raw timestamps are UTC; review date October 18, 2026."
    ],
    "checks": [
      {
        "id": "paypal-mcp-initialize",
        "name": "Credential-free initialization",
        "method": "POST https://mcp.paypal.com/http; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-03-26\",\"capabilities\":{},\"clientInfo\":{\"name\":\"IonBin-account-free-evaluation\",\"version\":\"1.0.0\"}}}",
        "expected": "The documented production streamable HTTP endpoint answers initialization with an authentication challenge.",
        "observed": "HTTP 404 at 2026-10-19T05:52:05.754299+00:00; Content-Type text/plain. Body: 404 Not Found. No WWW-Authenticate header.",
        "outcome": "fail"
      },
      {
        "id": "paypal-mcp-sandbox-initialize",
        "name": "Sandbox: credential-free initialization",
        "method": "POST https://mcp.sandbox.paypal.com/http; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-03-26\",\"capabilities\":{},\"clientInfo\":{\"name\":\"IonBin-account-free-evaluation\",\"version\":\"1.0.0\"}}}",
        "expected": "The documented sandbox streamable HTTP endpoint answers initialization with an authentication challenge.",
        "observed": "HTTP 404 at 2026-10-19T05:52:23.304042+00:00; Content-Type text/plain. Body: 404 Not Found. Body SHA-256: 7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402.",
        "outcome": "fail"
      },
      {
        "id": "paypal-mcp-sse-resource-metadata",
        "name": "SSE endpoint: public authentication discovery",
        "method": "GET https://mcp.paypal.com/.well-known/oauth-protected-resource/sse; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.",
        "expected": "Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.",
        "observed": "HTTP 200 at 2026-10-19T05:54:32.414520+00:00; Content-Type: application/json. Resource: https://mcp.paypal.com/sse. No scopes listed. Authorization server: https://mcp.paypal.com. Bearer methods: header.",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "Documented HTTP endpoint not found",
        "basis": "observed",
        "severity": "medium",
        "detail": "Both https://mcp.paypal.com/http and https://mcp.sandbox.paypal.com/http, which PayPal's guide lists for streamable HTTP, returned HTTP 404 with a plain 404 Not Found body.",
        "practicalAdvice": "Use the documented /sse endpoint or the local server, and recheck the /http endpoint before configuring it."
      },
      {
        "title": "SSE discovery works",
        "basis": "observed",
        "severity": "informational",
        "detail": "Resource metadata for the /sse endpoint returned HTTP 200 with an HTTPS authorization server.",
        "practicalAdvice": "Clients that support SSE with OAuth should be able to discover sign-in."
      }
    ],
    "caveats": [
      "The failure may be temporary or a documentation error; it was recorded as observed.",
      "Not financial, accounting or tax advice."
    ],
    "notTested": [
      "PayPal login and consent, client-credential and access-token setup, sandbox behavior and the SSE transport.",
      "Invoice creation and sending, transaction lookups and prompt-injection resistance.",
      "These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security."
    ],
    "sources": [
      {
        "label": "Official endpoints and transports",
        "url": "https://developer.paypal.com/ai-tools/mcp-server"
      }
    ],
    "reportUrl": "/interface-evaluations/paypal-mcp.json"
  }
}