Square MCP Server: Tools, Setup and Security

The Square MCP server lets an AI app call the Square API for payments, orders, catalog, inventory, customers, bookings and more. Square publishes it in beta, as a hosted server run by Block and as a local package you run yourself.

Checked against: Square's MCP server documentation on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

The project README lists three tools:

• get_service_info: discover the methods available for a Square service.
• get_type_info: get the parameters a request needs.
• make_api_request: run the API call.

Those tools sit on top of a long list of Square services. Examples from the README include catalog, checkout, customers, disputes, giftcards, inventory, invoices, locations, loyalty, bookings, cards, bankaccounts and labor.

Because make_api_request is generic, what the AI can do depends on the service, the method and the scopes you grant. It can read and also change records.

How to connect it

Remote server (Claude Desktop example from Square):

{
  "mcpServers": {
    "mcp_square_api": {
      "command": "npx",
      "args": ["mcp-remote", "https://mcp.squareup.com/mcp"]
    }
  }
}

You log in with your Square account and approve only the scopes you need. Square also gives steps for Claude.ai, Goose, Cursor and Windsurf (now Devin Desktop). In Cursor, set the type to "Command" and enter npx mcp-remote https://mcp.squareup.com/mcp.

Local server (sandbox example):

{
  "mcpServers": {
    "mcp_square_api": {
      "command": "npx",
      "args": ["square-mcp-server", "start"],
      "env": {
        "ACCESS_TOKEN": "YOUR_SQUARE_ACCESS_TOKEN",
        "SANDBOX": "true"
      }
    }
  }
}

The local server reads these environment variables, per Square's docs:

Square keeps an allowlist of MCP clients. To get a client added, Square says to ask in its developer forum.

Security notes

• Beta software. Square says the server is in beta. Expect changes, and test before you rely on it.
• Remote means production. Square says remote instances only access production resources. For Sandbox tests, run the local server with SANDBOX.
• Read-only mode. DISALLOW_WRITES=true restricts the local server to read operations. Square's docs do not describe the same switch for the remote server, so limit OAuth scopes there instead.
• Generic write tool. make_api_request can call write methods across many services. Square's pages do not describe a server-side human approval step, so keep your client's approval prompt on.
• Scopes. On the remote server you authorize only the scopes you need. See excessive permissions in MCP servers for how to choose.
• What the spec says. The MCP tools specification says there SHOULD always be a human in the loop who can deny tool calls. The spec's security best practices also recommend scope minimization.

For a full checklist, see the MCP security center and MCP security risks.

Alternatives

• Stripe MCP server: remote, with server-side approval for refunds and outbound payments.
• PayPal MCP server: local or remote, with sandbox and production endpoints.
• Adyen MCP server: local, alpha, with a --tools flag to load only what you need.

Next step

Point-of-sale data is a good fit for read-only reporting first. Start with DISALLOW_WRITES=true and a Sandbox token, then decide which writes you really need. Our MCP readiness audit can help you plan that, and the MCP server directory lists more options.

Frequently asked questions