MCP · Payments and commerce · Square
Square MCP Server
Work with Square customers, orders, catalog and payments data from an AI host through Square's hosted beta server, with OAuth scopes.
Writes can move money. Refunds, orders and catalog changes affect real customers and accounts. Approve each one, and test prompts in Sandbox first.
Understand the tool
What it does.
Square's hosted MCP server, run by Block and currently in beta, connects AI hosts to the Square API platform: customers, orders, catalog items, payments and more. The remote server signs in with Square OAuth and only reaches production data; a local open-source server can use Sandbox.
Why use it?
Use it for questions about sales, orders or catalog data, and for developers testing against Sandbox through the local server. It is not financial advice; check figures in Square before acting on money matters.
A useful fit for
- Sales and order questions
- Catalog lookups
- Developer testing in Sandbox (local server)
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Daily sales summary
An owner wants yesterday's numbers each morning.
- Pull yesterday's completed orders.
- Total sales and refunds by location.
- Note anything unusual.
Intended outputA summary to check against the Square Dashboard; not accounting or tax advice.
Use case 02
Find a catalog item's variations
Staff need to confirm prices for an item.
- Search the catalog for the item.
- List variations and prices.
- Report the last update time.
Intended outputCurrent catalog data, read only.
A concrete starting point
Illustrative prompt: yesterday's sales
A read-only summary; money-moving actions are explicitly excluded.
Using the Square MCP server, total yesterday's completed orders and refunds by location, in each location's currency. Show the counts and amounts, and list any order over 5x the average. Read only: do not create, refund or update anything.What this can change
Sales and customer data enter the AI host and its model provider. Not financial, accounting or tax advice.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- A Square seller account.
- An MCP client that supports remote servers with OAuth.
- For Sandbox testing, the local open-source server configured for a Sandbox environment.
- Authentication
- Square OAuth with scopes you approve at sign-in.
- Can read
- Customers, orders, catalog, payments and other Square API data within approved scopes
- Can write or change
- Square API writes, such as orders, catalog changes and refunds, within approved scopes
- Network and data flow
- Square API
- AI host/model provider
- Approval and control
- Square recommends authorizing only the scopes needed. Keep host approval on for any write, and never let an agent move money unattended.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Remote MCP clients with OAuth
- Remote reaches production only; Sandbox via the local server
- Beta: tools and behavior may change
Costs and account requirements
No separate MCP fee is documented; Square's processing fees and plan pricing apply to the underlying activity.
Current pricing or plan information ↗Apache-2.0
Code license for the open-source local server; the hosted service and Square API use is governed by Square's terms.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Writes can move money
Refunds, orders and catalog changes affect real customers and accounts. Approve each one, and test prompts in Sandbox first.
Remote server is production-only
There is no Sandbox on the remote server. Use the local server for testing.
Where it may fall short
- Only the remote endpoint's authentication challenge and metadata were checked.
- The server is in beta.
Observed behavior · 2026-10-18
Runtime and security findings.
The hosted endpoint rejected credential-free initialization and pointed to public OAuth metadata that listed no scopes.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
Scope choice happens at consent
The metadata listed no scopes; Square documents choosing scopes when you authorize.
In practice: Authorize only read scopes for reporting tasks.
Documented concern · medium severity under stated conditions
Remote means production
Square documents that remote instances only access production resources.
In practice: Test new prompts against Sandbox with the local server before using the remote server.
Version, environment and fixture
- Version or deployment
- Remote deployment version not disclosed by the observed responses
- Tested target
- https://mcp.squareup.com/mcp
- Artifact identity
- HTTPS certificate verification enabled. Public resource-metadata body SHA-256: 18b9e6169cc08b20e368fe567d98660db120b36138f2d88ec7fe3fa975f39660. This fingerprints the observed metadata, not the deployed server implementation.
- Environment and fixture
- Debian Linux x86_64 (kernel 6.12) evaluation box; Python 3.13.5 urllib; OpenSSL 3.5.7.
- No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.
- Observed 2026-10-19T05:52:05.519493+00:00 through 2026-10-19T05:52:05.659360+00:00 UTC.
- One request per listed check; 20-second timeout and 64-KiB response cap. Raw timestamps are UTC; review date October 18, 2026.
Checks and results
2 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Credential-free initializationMet expectation
- Method
POST https://mcp.squareup.com/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"IonBin-account-free-evaluation","version":"1.0.0"}}}- Expected
- Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.
- Observed
- HTTP 401 at 2026-10-19T05:52:05.519493+00:00. WWW-Authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.squareup.com/.well-known/oauth-protected-resource/mcp", error="invalid_token", error_description="Missing or invalid access token". Body: {"error":"invalid_token","error_description":"Missing or invalid access token"}
Public authentication discoveryMet expectation
- Method
GET https://mcp.squareup.com/.well-known/oauth-protected-resource/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.- Expected
- Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.
- Observed
- HTTP 200 at 2026-10-19T05:52:05.659360+00:00; Content-Type: application/json. Resource: https://mcp.squareup.com/mcp. No scopes listed. Authorization server: https://mcp.squareup.com. Bearer methods: header.
Practical caveats
- Beta status: tools and behavior can change.
- Not financial, accounting or tax advice.
What this evaluation does not establish
- OAuth consent, scope selection and Sandbox use through the local server.
- Order and payment reads, writes and refunds, and prompt-injection resistance.
- These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
First-party with documented scope choice, but in beta, production-only when remote and able to change financial records, so it ranks below lower-risk servers.
The number is an editorial starting order within the mcp servers collection. It does not measure popularity, speed, reliability or safety.
Why we added it
Round-6 directory addition: first-party commerce server supporting the Square sales workflow.
Selection evidence checked .
- Repository interest
- 108 GitHub stars at this snapshot ↗
Repository-level interest
- Repository activity
- Last push reported by GitHub: . A push can include documentation or maintenance; it does not establish a new stable release.
- Release signal
- 0.1.2 ↗ · published . This selection signal can differ from the exact runtime tested above.
- Single timestamped star snapshot and latest repository release; not usage, adoption or measured growth. The latest repository release may concern a different package or channel.
- Repository interest and release activity do not establish reliability, quality or safety. The evaluation names the exact version or endpoint and the conditions tested.
What we reviewed
- Remote endpoint and authentication discovery
- Repository snapshot
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official Square MCP guide ↗developer.squareup.com
- Official open-source server and license ↗github.com
- Square pricing ↗squareup.com