PayPal MCP Server: Tools, Setup and Security

The PayPal MCP server lets an AI app work with your PayPal business account. It can create invoices, look up orders and disputes, manage subscriptions and issue refunds. PayPal publishes both a local package and hosted remote endpoints.

Checked against: PayPal's MCP server documentation on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

PayPal lists its tools in the agent tools catalog. The MCP page says the complete catalog is available in both the local and remote servers.

The catalog also lists search_product, create_cart and checkout_cart for the remote server, for gift cards, behind a feature-flag header.

How to connect it

Local server. You need Node.js 18 or later and a PayPal access token. PayPal's example config for Claude Desktop is:

{
  "mcpServers": {
    "paypal": {
      "command": "npx",
      "args": [
        "-y",
        "@paypal/mcp",
        "--tools=all"
      ],
      "env": {
        "PAYPAL_ACCESS_TOKEN": "YOUR_PAYPAL_ACCESS_TOKEN",
        "PAYPAL_ENVIRONMENT": "SANDBOX"
      }
    }
  }
}

Set PAYPAL_ENVIRONMENT to SANDBOX or PRODUCTION.

Remote server. The endpoints are:

• Sandbox: https://mcp.sandbox.paypal.com
• Production: https://mcp.paypal.com

Add /sse or /http for the transport you want. PayPal's examples use the mcp-remote helper. After you save the config, the client redirects you to PayPal's login page to grant consent.

{
  "mcpServers": {
    "paypal-mcp-server": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://mcp.sandbox.paypal.com/sse"
      ]
    }
  }
}

PayPal's examples use Claude but say any MCP client works, "such as Cursor or Cline." PayPal notes a known issue with Cursor on Windows for remote connections. If sign-in gets stuck, PayPal suggests clearing ~/.mcp-auth.

Security notes

• Money-moving tools. Per PayPal's catalog, pay_order captures payment for an authorized order and create_refund refunds a captured payment. checkout_cart finalizes a cart and processes payment. accept_dispute_claim resolves a dispute in the buyer's favor.
• No documented approval step. The PayPal pages we read do not describe a server-side human confirmation step. Your AI client's tool-approval prompt is your main check. Keep it on, and read about approval fatigue so people do not click yes to everything.
• Load fewer tools. The local example passes --tools=all. Loading only the tools you need cuts risk.
• Use the sandbox. Both local and remote servers support a sandbox. Test prompts there before you point an agent at production.
• Protect credentials. Keep access tokens and client secrets out of shared config files. See secrets and credential leakage in MCP.
• What the spec says. The MCP tools specification says there SHOULD always be a human in the loop who can deny tool calls. The spec's security best practices also recommend scope minimization.

The MCP security center has a full checklist for payment servers.

Alternatives

• Stripe MCP server: remote only, with server-side approval for refunds and outbound payments.
• Square MCP server: beta, with OAuth on the remote server and a read-only mode locally.
• Mollie MCP server: remote, OAuth only, and no refund tool as of October 2026.

Next step

Invoicing and dispute lookups are good first jobs for an agent. Refunds and payment capture should wait until your approval rules are clear. If you want help designing that, see our MCP development service or browse more in the MCP server directory.

Frequently asked questions