MCP · Payments and commerce · PayPal
PayPal MCP Server
Create invoices and work with PayPal transactions from an AI host via PayPal's MCP server. Its documented HTTP endpoint returned 404 when tested.
Invoices reach real customers. Sent invoices request real money. Test in the sandbox and review before sending.
Understand the tool
What it does.
PayPal's MCP server exposes PayPal tools, such as invoicing and transaction lookups, to AI hosts. PayPal documents remote endpoints for production and sandbox over SSE and streamable HTTP, and a local server run with npx.
Why use it?
Use it to draft and send invoices or look up transactions, starting in the sandbox. It is not financial advice; confirm amounts and recipients before anything is sent.
A useful fit for
- Drafting invoices
- Looking up recent transactions
- Sandbox testing of payment flows
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Draft an invoice
A freelancer bills a client for a finished project.
- Give the client email, items and amounts.
- Create a draft invoice in the sandbox first.
- Review, then send from PayPal.
Intended outputA reviewed invoice, sent only after a person checks it.
Use case 02
Find a payment
A customer says they paid but it is not showing.
- Search transactions for the customer and date range.
- Report status and amount.
- Leave any refund to a person.
Intended outputA transaction status to share with the customer.
A concrete starting point
Illustrative prompt: sandbox invoice draft
Sandbox and draft-only keep this from reaching real customers or money.
Using the PayPal MCP server connected to the sandbox, create a draft invoice to the test email I give you for two line items I list, in USD. Show me the full draft and do not send it.What this can change
Invoice and transaction data enter the AI host and its model provider. Not financial, accounting or tax advice.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- A PayPal developer or business account.
- For remote use, an MCP client that supports SSE or streamable HTTP; for the local server, Node.js and a PayPal access token.
- A sandbox environment for testing.
- Authentication
- Remote server: PayPal login and consent through the MCP client, or your PayPal client ID and secret from the Developer Dashboard. Local server: a PayPal access token.
- Can read
- Invoices, transactions and other PayPal data the account can access
- Can write or change
- Invoices and other PayPal objects the enabled tools can create or change
- Network and data flow
- PayPal services
- AI host/model provider
- Approval and control
- Use the sandbox first. Approve every create or send, and never let an agent move money unattended.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Documented SSE and streamable HTTP endpoints for production and sandbox
- Local server via npx with an access token
- At test time the documented /http endpoints returned 404
Costs and account requirements
No separate MCP fee is documented; PayPal's transaction and invoicing fees apply to the underlying activity.
Current pricing or plan information ↗Hosted service terms
No public source license for PayPal's hosted implementation is asserted. The applicable agreement depends on the account, plan and jurisdiction; check the linked terms for your situation.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Invoices reach real customers
Sent invoices request real money. Test in the sandbox and review before sending.
Endpoint drift
The documented streamable HTTP endpoints returned 404 during testing. Confirm the current endpoint before relying on it.
Where it may fall short
- The documented /http endpoints returned 404 in production and sandbox; only /sse resource metadata responded.
- No authenticated call was made.
Observed behavior · 2026-10-18
Runtime and security findings.
PayPal's documented streamable HTTP endpoints returned 404 in production and sandbox. The SSE endpoint's public OAuth metadata responded normally.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation · medium severity under stated conditions
Documented HTTP endpoint not found
Both https://mcp.paypal.com/http and https://mcp.sandbox.paypal.com/http, which PayPal's guide lists for streamable HTTP, returned HTTP 404 with a plain 404 Not Found body.
In practice: Use the documented /sse endpoint or the local server, and recheck the /http endpoint before configuring it.
Observed in this evaluation
SSE discovery works
Resource metadata for the /sse endpoint returned HTTP 200 with an HTTPS authorization server.
In practice: Clients that support SSE with OAuth should be able to discover sign-in.
Version, environment and fixture
- Version or deployment
- Remote deployment version not disclosed by the observed responses
- Tested target
- https://mcp.paypal.com/http
- Artifact identity
- HTTPS certificate verification enabled. Production /http 404 body SHA-256: 7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402. Public /sse resource-metadata body SHA-256: 9a9c9e06ba85296a752b8900c2bac8c587fc5f00f2ab8371524ff7e8fc8c93f5. These fingerprint observed responses, not the deployed server implementation.
- Environment and fixture
- Debian Linux x86_64 (kernel 6.12) evaluation box; Python 3.13.5 urllib; OpenSSL 3.5.7.
- No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
- Observed 2026-10-19T05:52:05.754299+00:00 through 2026-10-19T05:54:32.414520+00:00 UTC.
- One request per listed check; 20-second timeout and 64-KiB response cap. Raw timestamps are UTC; review date October 18, 2026.
Checks and results
3 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Credential-free initializationDid not meet expectation
- Method
POST https://mcp.paypal.com/http; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}- Expected
- The documented production streamable HTTP endpoint answers initialization with an authentication challenge.
- Observed
- HTTP 404 at 2026-10-19T05:52:05.754299+00:00; Content-Type text/plain. Body: 404 Not Found. No WWW-Authenticate header.
Sandbox: credential-free initializationDid not meet expectation
- Method
POST https://mcp.sandbox.paypal.com/http; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}- Expected
- The documented sandbox streamable HTTP endpoint answers initialization with an authentication challenge.
- Observed
- HTTP 404 at 2026-10-19T05:52:23.304042+00:00; Content-Type text/plain. Body: 404 Not Found. Body SHA-256: 7d04f7431bbfa41a04bcc7e6b98b9de0d919756c4c671c5785c99fff45f16402.
SSE endpoint: public authentication discoveryMet expectation
- Method
GET https://mcp.paypal.com/.well-known/oauth-protected-resource/sse; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.- Expected
- Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
- Observed
- HTTP 200 at 2026-10-19T05:54:32.414520+00:00; Content-Type: application/json. Resource: https://mcp.paypal.com/sse. No scopes listed. Authorization server: https://mcp.paypal.com. Bearer methods: header.
Practical caveats
- The failure may be temporary or a documentation error; it was recorded as observed.
- Not financial, accounting or tax advice.
What this evaluation does not establish
- PayPal login and consent, client-credential and access-token setup, sandbox behavior and the SSE transport.
- Invoice creation and sending, transaction lookups and prompt-injection resistance.
- These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
First-party and broadly useful, but the documented HTTP endpoint failed when tested and the tools can bill real customers, so it ranks near the end.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Documented remote endpoints
- Authentication discovery on /sse
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official PayPal MCP server guide ↗developer.paypal.com
- PayPal user agreement ↗www.paypal.com
- PayPal merchant fees ↗www.paypal.com