Agentzon vs Square

Agentzon

Public OpenAPI 3.1 description and llms.txt, with a whole-basket checkout that needs no account or key. The buyer pays on a private page, so a person completes each purchase. No status page, security.txt or registered seller address was found on agentzon.co, and 34 of 500 listed items cannot be bought.

Square

The REST API has a public OpenAPI 3.0 spec, OAuth scopes split by read and write for each resource, idempotency keys on writes and a free sandbox. The MCP server is in beta and its remote instance reaches production only. No numeric REST rate limits or SLA were found, and the status page recorded widespread errors on 27 September 2026.

Agentzon

1. Search with GET /api/products. Use only items with checkoutAvailable true and a non-null unitAmount, because a null price means unavailable, never free
2. Send every item and quantity in one POST /api/checkout, with a new Idempotency-Key for each purchase attempt and the same key only to retry that basket
3. Show the buyer the product image from /api/products/{id}/image and get their approval before opening the checkout URL
4. Tell the buyer that catalogue prices exclude sales tax, that shipping is U.S. only and that change-of-mind returns exclude hygiene and food items
5. Keep the checkout URL and the orderToken private. A paid status confirms payment, not shipment

Square

1. Test against the sandbox first with the local MCP server and SANDBOX=true. The remote server at mcp.squareup.com reaches production only
2. Set DISALLOW_WRITES=true on the local MCP server when the task only reads
3. Call get_service_info, then get_type_info, before each make_api_request. The request body is otherwise untyped
4. Send a fresh idempotency_key on every write, and reuse it when retrying the same write
5. Pin Square-Version in each request. Use a page cursor within 5 minutes of receiving it