{ "data": { "similar": [ { "grade": "BB", "json": "https://www.anchorterminal.com/tools/shopify.json", "name": "Shopify API + MCP", "score": 75, "shared": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "slug": "shopify" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/woocommerce.json", "name": "WooCommerce API + MCP", "score": 72.9, "shared": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "slug": "woocommerce" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/shopware.json", "name": "Shopware", "score": 71.4, "shared": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "slug": "shopware" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/commercetools.json", "name": "commercetools", "score": 71.3, "shared": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "slug": "commercetools" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/vendure.json", "name": "Vendure", "score": 70.9, "shared": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "slug": "vendure" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/saleor.json", "name": "Saleor API + MCP", "score": 68.6, "shared": [ "commerce.products", "commerce.cart", "commerce.checkout", "commerce.orders", "commerce.headless" ], "slug": "saleor" } ], "tool": { "slug": "square", "name": "Square", "vendor": "Block, Inc.", "vendorUrl": "https://squareup.com", "kind": "http-api", "category": "commerce", "summary": "Square is Block's commerce and payments platform for sellers. Its REST API covers catalogue, orders, payment links, payments, inventory and customers, with seven SDKs and a beta MCP server hosted at mcp.squareup.com.", "url": "https://www.anchorterminal.com/tools/square", "markdownUrl": "https://www.anchorterminal.com/tools/square.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/square.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/square.json", "repo": "https://github.com/square/square-mcp-server", "license": "Proprietary service under the Square Developer Terms of Service. The MCP server and the OpenAPI specification on GitHub are Apache 2.0, and the Node.js SDK is MIT", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://mcp.squareup.com/mcp", "packages": [ { "registry": "npm", "name": "square" }, { "registry": "npm", "name": "square-mcp-server" }, { "registry": "pypi", "name": "squareup" } ], "auth": "mixed", "authNotes": "Access needs a Square account and an application created in the Developer Console, both self-serve. Two token types go in the `Authorization: Bearer` header. A personal access token gives unrestricted access to the owner's own account, with a separate sandbox token. OAuth access tokens are limited to the scopes a seller grants, expire after 30 days and can be refreshed and revoked. The remote MCP server signs in through OAuth, and Square keeps an allowlist of MCP clients that may register.", "pricing": "usage", "pricingNotes": "The API and sandbox carry no charge. Sellers pay processing fees, 2.9% + 30 cents for card payments through the payments APIs in the US. Square Free is $0 a month, Plus $49 and Premium $149 per location. The sandbox lets an agent start without a contract (https://squareup.com/us/en/payments/our-fees, checked 2026-10-08).", "priceSummary": "2.9% fee", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs index at developer.squareup.com/llms.txt or the OpenAPI spec (checked 2026-10-08).", "endpoints": [] }, "toolCount": 3, "popularity": { "githubStars": null, "npmWeekly": 453743, "pypiWeekly": 72138, "asOf": "2026-10-08" }, "docsUrl": "https://developer.squareup.com/docs", "llmsTxt": "https://developer.squareup.com/llms.txt", "openapi": "https://raw.githubusercontent.com/square/connect-api-specification/master/api.json", "capabilities": [ "commerce.products", "commerce.orders", "commerce.checkout", "commerce.cart", "commerce.headless", "payments.card", "payments.checkout" ], "tags": [ "hosted", "closed-source", "mcp", "oauth", "openapi", "llms-txt", "webhooks", "sandbox", "graphql", "typescript", "python", "status-page", "bug-bounty" ], "lastRelease": "2026-09-16", "graded": true, "anchor": { "graded": true, "score": 69.2, "grade": "B", "agentReady": false, "rank": 166, "ranked": true, "rankOf": 722, "categoryRank": 6, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 81, "payments": 40, "reliability": 58, "schema": 87, "security": 67, "transparency": 70 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 58, "points": 11.6, "reason": "Graded on the hosted REST API. Status page at issquareup.com with an incident history, though its components endpoint returns an empty list (20). In the 90 days to 8 October 2026 the page lists 15 incidents, all labelled minor. One, on 27 September, reported widespread elevated latency and service errors across Square, including payment authorisation and refunds, and closed 1 hour 47 minutes after the first post. The others were partial, by card network, device or feature (10). No numeric limits were found for the REST API, and the docs say endpoints might enforce different limits. GraphQL is limited to 10 queries a second (5). The docs describe 429 `RATE_LIMITED` errors, exponential backoff with jitter and idempotency keys on writes (15). No SLA found in the developer terms or docs (0). The REST API is generally available, but 97 of 332 operations in the spec are beta and the MCP server is beta (8)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 87, "points": 14.14, "reason": "Public OpenAPI 3.0 spec in square/connect-api-specification with 332 operations and 1,476 schemas (25). developer.squareup.com/llms.txt indexes the docs and links llms-full.txt (10). 327 of 332 operations carry a description stating purpose, with little guidance on when not to use one (14). Request schemas are typed, 204 schemas are enums and required fields are marked. The MCP tool `make_api_request` takes an untyped request object, with types fetched through `get_type_info` (12). Errors are documented as category, code, detail and field with a published code list, but the spec lists only 200 responses and names endpoint errors on 82 of 332 operations (11). Dated API versions set by the `Square-Version` header and monthly release notes (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 83, "points": 13.49, "reason": "List endpoints take `limit` and a cursor, and GraphQL selects fields for reads. The MCP server has three tools that load service and type detail on request (20). Cursor pagination, search endpoints with filters, and batch endpoints. Cursors expire after 5 minutes (18). Errors carry a category, a code and the request field at fault (18). Idempotency keys on 78 request schemas and optimistic concurrency by version. The MCP tools carry no readOnlyHint or destructiveHint annotations in the source (14). Official SDKs in seven languages. An MCP call needs two discovery calls first (13)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 67, "points": 11.73, "reason": "OAuth with code and PKCE flows, read and write scopes for each resource, 30-day access tokens, refresh and revocation. The remote MCP server uses OAuth with registration limited to an allowlist of clients and advertises 48 scopes. Personal access tokens are unrestricted (26). Read-only scopes, and `DISALLOW_WRITES` on the local MCP server. No confirmation step for destructive calls was found (12). The API returns seller and customer text. The MCP page advises testing prompts in the sandbox, and no prompt-injection guidance was found (3). API Logs show each request and response for 28 days, with webhook event logs (12). A Bugcrowd programme is linked from the security page, which states ISO 27001 and PCI certification. squareup.com and developer.squareup.com return 404 for security.txt, and the Bugcrowd and trust centre pages didn't render for us (14)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 found in the docs index or the spec (0). Fees are public without login. The API has no charge, and card payments through the payments APIs cost 2.9% + 30 cents in the US (20). The sandbox is free, and the Square Free plan is $0 a month (20). A person must create a Square account and an application in the Developer Console, or approve OAuth in a browser (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 81, "points": 7.09, "reason": "API version 2026-09-16 was released 22 days before the check (30). Three dated releases in 90 days, on 15 July, 19 August and 16 September 2026 (20). Public release notes, a developer forum and a Discord community are linked from the docs. GitHub issues were not readable, and the MCP server repository has one commit since May 2025 (10). Seven official SDKs were regenerated for 2026-09-16, the Node.js one at 46.0.0. No Square server appears in the official MCP registry (15). The Node.js SDK has CI and integration workflows. The npm package square-mcp-server is still 0.1.2, published in April 2025 (6)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 70, "points": 6.13, "note": "editorial 56, provenance 84", "reason": "Closed service under published developer terms. The API spec and MCP server are Apache 2.0 and the Node.js SDK is MIT (15). The privacy notice was updated on 15 September 2026 and says retention is decided case by case, with no periods given. No public DPA was found at the addresses we tried (13). APIs are typically deprecated at least 12 months before retirement, retired endpoints return 410, and deprecated items are listed with dates (20). The privacy notice names categories of service providers and processing in the US, Japan, the UK and the EU. No named sub-processor list was found (8)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "List endpoints take `limit` and a cursor, and GraphQL selects fields for reads. The MCP server has three tools that load service and type detail on request (20). Cursor pagination, search endpoints with filters, and batch endpoints. Cursors expire after 5 minutes (18). Errors carry a category, a code and the request field at fault (18). Idempotency keys on 78 request schemas and optimistic concurrency by version. The MCP tools carry no readOnlyHint or destructiveHint annotations in the source (14). Official SDKs in seven languages. An MCP call needs two discovery calls first (13).", "maintenance": "API version 2026-09-16 was released 22 days before the check (30). Three dated releases in 90 days, on 15 July, 19 August and 16 September 2026 (20). Public release notes, a developer forum and a Discord community are linked from the docs. GitHub issues were not readable, and the MCP server repository has one commit since May 2025 (10). Seven official SDKs were regenerated for 2026-09-16, the Node.js one at 46.0.0. No Square server appears in the official MCP registry (15). The Node.js SDK has CI and integration workflows. The npm package square-mcp-server is still 0.1.2, published in April 2025 (6).", "payments": "No x402, MPP or L402 found in the docs index or the spec (0). Fees are public without login. The API has no charge, and card payments through the payments APIs cost 2.9% + 30 cents in the US (20). The sandbox is free, and the Square Free plan is $0 a month (20). A person must create a Square account and an application in the Developer Console, or approve OAuth in a browser (0).", "reliability": "Graded on the hosted REST API. Status page at issquareup.com with an incident history, though its components endpoint returns an empty list (20). In the 90 days to 8 October 2026 the page lists 15 incidents, all labelled minor. One, on 27 September, reported widespread elevated latency and service errors across Square, including payment authorisation and refunds, and closed 1 hour 47 minutes after the first post. The others were partial, by card network, device or feature (10). No numeric limits were found for the REST API, and the docs say endpoints might enforce different limits. GraphQL is limited to 10 queries a second (5). The docs describe 429 `RATE_LIMITED` errors, exponential backoff with jitter and idempotency keys on writes (15). No SLA found in the developer terms or docs (0). The REST API is generally available, but 97 of 332 operations in the spec are beta and the MCP server is beta (8).", "schema": "Public OpenAPI 3.0 spec in square/connect-api-specification with 332 operations and 1,476 schemas (25). developer.squareup.com/llms.txt indexes the docs and links llms-full.txt (10). 327 of 332 operations carry a description stating purpose, with little guidance on when not to use one (14). Request schemas are typed, 204 schemas are enums and required fields are marked. The MCP tool `make_api_request` takes an untyped request object, with types fetched through `get_type_info` (12). Errors are documented as category, code, detail and field with a published code list, but the spec lists only 200 responses and names endpoint errors on 82 of 332 operations (11). Dated API versions set by the `Square-Version` header and monthly release notes (15).", "security": "OAuth with code and PKCE flows, read and write scopes for each resource, 30-day access tokens, refresh and revocation. The remote MCP server uses OAuth with registration limited to an allowlist of clients and advertises 48 scopes. Personal access tokens are unrestricted (26). Read-only scopes, and `DISALLOW_WRITES` on the local MCP server. No confirmation step for destructive calls was found (12). The API returns seller and customer text. The MCP page advises testing prompts in the sandbox, and no prompt-injection guidance was found (3). API Logs show each request and response for 28 days, with webhook event logs (12). A Bugcrowd programme is linked from the security page, which states ISO 27001 and PCI certification. squareup.com and developer.squareup.com return 404 for security.txt, and the Bugcrowd and trust centre pages didn't render for us (14).", "transparency": "Closed service under published developer terms. The API spec and MCP server are Apache 2.0 and the Node.js SDK is MIT (15). The privacy notice was updated on 15 September 2026 and says retention is decided case by case, with no periods given. No public DPA was found at the addresses we tried (13). APIs are typically deprecated at least 12 months before retirement, retired endpoints return 410, and deprecated items are listed with dates (20). The privacy notice names categories of service providers and processing in the US, Japan, the UK and the EU. No named sub-processor list was found (8)." }, "sources": [ { "what": "MCP server docs", "url": "https://developer.squareup.com/docs/mcp", "seen": "2026-10-08" }, { "what": "MCP server source and README", "url": "https://github.com/square/square-mcp-server", "seen": "2026-10-08" }, { "what": "remote MCP OAuth metadata", "url": "https://mcp.squareup.com/.well-known/oauth-protected-resource", "seen": "2026-10-08" }, { "what": "OpenAPI spec", "url": "https://github.com/square/connect-api-specification", "seen": "2026-10-08" }, { "what": "llms.txt", "url": "https://developer.squareup.com/llms.txt", "seen": "2026-10-08" }, { "what": "status incidents", "url": "https://www.issquareup.com/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "error handling and rate limiting", "url": "https://developer.squareup.com/docs/build-basics/general-considerations/handling-errors", "seen": "2026-10-08" }, { "what": "API lifecycle", "url": "https://developer.squareup.com/docs/build-basics/api-lifecycle", "seen": "2026-10-08" }, { "what": "versioning", "url": "https://developer.squareup.com/docs/build-basics/versioning-overview", "seen": "2026-10-08" }, { "what": "access tokens", "url": "https://developer.squareup.com/docs/build-basics/access-tokens", "seen": "2026-10-08" }, { "what": "OAuth refresh and revoke", "url": "https://developer.squareup.com/docs/oauth-api/refresh-revoke-limit-scope", "seen": "2026-10-08" }, { "what": "pagination", "url": "https://developer.squareup.com/docs/build-basics/common-api-patterns/pagination", "seen": "2026-10-08" }, { "what": "API Logs", "url": "https://developer.squareup.com/docs/devtools/api-logs", "seen": "2026-10-08" }, { "what": "sandbox", "url": "https://developer.squareup.com/docs/devtools/sandbox/overview", "seen": "2026-10-08" }, { "what": "GraphQL limits", "url": "https://developer.squareup.com/docs/devtools/graphql", "seen": "2026-10-08" }, { "what": "release notes", "url": "https://developer.squareup.com/docs/changelog/connect", "seen": "2026-10-08" }, { "what": "release 2026-09-16", "url": "https://developer.squareup.com/docs/changelog/connect-logs/2026-09-16", "seen": "2026-10-08" }, { "what": "developer terms", "url": "https://squareup.com/us/en/legal/general/developers", "seen": "2026-10-08" }, { "what": "privacy notice", "url": "https://squareup.com/us/en/legal/general/privacy", "seen": "2026-10-08" }, { "what": "plans", "url": "https://squareup.com/us/en/pricing", "seen": "2026-10-08" }, { "what": "processing fees", "url": "https://squareup.com/us/en/payments/our-fees", "seen": "2026-10-08" }, { "what": "security page", "url": "https://squareup.com/us/en/security", "seen": "2026-10-08" }, { "what": "security.txt (404)", "url": "https://squareup.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "npm metadata", "url": "https://registry.npmjs.org/square/latest", "seen": "2026-10-08" }, { "what": "MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=square", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: the tool list of the remote MCP server at mcp.squareup.com, which answers 401 without an OAuth token. The three tools are read from the open-source local server", "unchecked: GitHub stars and open issues, because the GitHub API refused us for its rate limit", "unchecked: the Bugcrowd programme page and trust.squareup.com, which render with JavaScript only", "unchecked: whether Square publishes a DPA or a named sub-processor list. Two guessed addresses returned 404 and the privacy notice links neither", "No numeric REST rate limits and no SLA were found in the reviewed documentation", "The MCP README gives https://mcp.squareup.com/sse and the docs give https://mcp.squareup.com/mcp. Both answered 401 on 8 October 2026", "Whether creating a Square account needs a card was not checked. The sandbox is documented as free", "The category fits the catalogue, orders and payment-link APIs. Square is also a payment processor, so the payments category would be a reasonable second home" ] }, "negative": 0, "verdict": "The REST API has a public OpenAPI 3.0 spec, OAuth scopes split by read and write for each resource, idempotency keys on writes and a free sandbox. The MCP server is in beta and its remote instance reaches production only. No numeric REST rate limits or SLA were found, and the status page recorded widespread errors on 27 September 2026.", "bestFor": "Agents working for a seller already on Square, on catalogue, inventory, orders, payment links and customers, online and in person.", "strengths": [ "Public OpenAPI 3.0 spec with 332 operations and 1,476 schemas, regenerated for API version 2026-09-16", "OAuth scopes are split by read and write for each resource, and access tokens expire after 30 days", "78 request schemas carry an `idempotency_key`, and the docs describe backoff with jitter for 429 responses", "Free sandbox at connect.squareupsandbox.com with test cards, and API Logs kept for 28 days", "Deprecated APIs are typically retired at least 12 months after deprecation, with dated release notes each month" ], "weaknesses": [ "The MCP server is marked beta, and the remote server reaches production data only", "No numeric rate limits were found for the REST API. Only GraphQL states a figure, 10 queries a second", "No SLA was found in the developer terms or documentation", "The status page recorded widespread latency and errors on 27 September 2026, including payment authorisation", "A personal access token grants unrestricted access to the whole Square account", "97 of the 332 operations in the spec are marked beta" ], "agentNotes": [ "Test against the sandbox first with the local MCP server and `SANDBOX=true`. The remote server at mcp.squareup.com reaches production only", "Set `DISALLOW_WRITES=true` on the local MCP server when the task only reads", "Call `get_service_info`, then `get_type_info`, before each `make_api_request`. The request body is otherwise untyped", "Send a fresh `idempotency_key` on every write, and reuse it when retrying the same write", "Pin `Square-Version` in each request. Use a page cursor within 5 minutes of receiving it" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 69.2 } ], "editorialScores": { "ergonomics": 83, "maintenance": 81, "payments": 40, "reliability": 58, "schema": 87, "security": 67, "transparency": 56 }, "provenanceScore": 84 }, "connect": { "install": "npx square-mcp-server start", "http": "curl https://connect.squareupsandbox.com/v2/locations \\\n -H 'Square-Version: 2026-09-16' \\\n -H 'Authorization: Bearer {SANDBOX_ACCESS_TOKEN}' \\\n -H 'Content-Type: application/json'", "config": { "mcpServers": { "mcp_square_api": { "args": [ "mcp-remote", "https://mcp.squareup.com/mcp" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/commerce.products", "tool": "https://letme.dev/square" }, "notable": [ "The MCP server is marked beta. Block hosts a remote server at https://mcp.squareup.com/mcp with OAuth sign-in, and the local server runs with `npx square-mcp-server start` (https://developer.squareup.com/docs/mcp)", "Remote MCP instances reach production resources only. Sandbox testing needs the local server with `SANDBOX=true` (https://developer.squareup.com/docs/mcp)", "The open-source MCP server has three tools, `get_service_info`, `get_type_info` and `make_api_request`, covering 38 API services (https://github.com/square/square-mcp-server)", "The OpenAPI 3.0 spec for version 2026-09-16 has 332 operations, 97 marked beta and 24 deprecated (https://github.com/square/connect-api-specification)", "Release 2026-09-16 retired the write operations of the Transactions API. Read operations remain (https://developer.squareup.com/docs/changelog/connect-logs/2026-09-16)", "The status page reported widespread elevated latency and service errors across Square on 27 September 2026 (https://www.issquareup.com)", "The weekly npm figure is for the `square` SDK. `square-mcp-server` had 926 downloads in the week to 4 October 2026 (https://api.npmjs.org/downloads/point/last-week/square-mcp-server)" ], "area": "business", "details": [ { "label": "APIs", "value": "REST at https://connect.squareup.com/v2, sandbox at https://connect.squareupsandbox.com/v2. 332 operations in the 2026-09-16 spec, among them catalogue (14), orders (8), checkout and payment links (10), payments (7), inventory (19) and customers (14). GraphQL for reads" }, { "label": "MCP server", "value": "Beta. Remote at https://mcp.squareup.com/mcp with OAuth, production only. Local over stdio with `npx square-mcp-server start`, an access token, and `SANDBOX` or `PRODUCTION` set. Three tools in the open-source server" }, { "label": "Cart and checkout", "value": "Orders API with a DRAFT state, CalculateOrder for totals and discounts on orders, PayOrder, and CreatePaymentLink for a Square-hosted checkout page" }, { "label": "Credentials", "value": "Personal access token (unrestricted, own account) or OAuth access token limited by scopes. OAuth tokens expire after 30 days, with refresh and revoke endpoints" }, { "label": "Rate limits", "value": "No numbers published for REST. 429 with `RATE_LIMITED`, and the docs ask for exponential backoff with jitter. GraphQL allows 10 queries a second, depth 10 and a complexity score of 250" }, { "label": "Errors", "value": "An `errors` array with category, code, detail and field. Retired endpoints return 410" }, { "label": "Idempotency", "value": "`idempotency_key` on 78 request schemas, and optimistic concurrency by object version" }, { "label": "Versioning", "value": "Dated versions (YYYY-MM-DD) pinned per application and overridden with the `Square-Version` header. Releases roughly monthly" }, { "label": "SDKs", "value": "Java 48.0.0.20260916, .NET 47.0.0, Node.js 46.0.0, PHP 47.0.0.20260916, Python 46.0.0.20260916, Ruby 47.0.0.20260916, Go v5.0.0" }, { "label": "Sandbox", "value": "Free, provisioned for each application, with test cards and payment tokens. Hardware, the Point of Sale API, Snippets API and Sites API aren't supported in it" }, { "label": "Audit", "value": "API Logs in the Developer Console keep each request and response for 28 days, filterable by API, endpoint, status and error code. GraphQL queries aren't logged there" }, { "label": "Deprecations", "value": "Typically at least 12 months between deprecation and retirement, and at least 6 months in maintenance once a replacement is generally available" }, { "label": "Status", "value": "issquareup.com, 15 incidents between 10 July and 8 October 2026, all labelled minor by Square" } ], "unitPrices": [ { "item": "Card payment through the payments APIs (US)", "unit": "pct", "usd": 2.9, "note": "plus 30 cents per transaction" }, { "item": "ACH bank transfer through the API (US)", "unit": "pct", "usd": 1, "note": "$1 minimum, $5 fee cap" }, { "item": "Square Free", "unit": "month", "usd": 0, "note": "per location" }, { "item": "Square Plus", "unit": "month", "usd": 49, "note": "per location" }, { "item": "Square Premium", "unit": "month", "usd": 149, "note": "per location" } ], "provenance": { "legalEntity": "Block, Inc.", "domain": "squareup.com", "domainRegistered": "2007-05-26", "endpointOnVendorDomain": true, "terms": "https://squareup.com/us/en/legal/general/developers", "privacy": "https://squareup.com/us/en/legal/general/privacy", "statusPage": "https://www.issquareup.com", "changelog": "https://developer.squareup.com/docs/changelog/connect", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Square Developer Terms of Service (last updated 10 September 2026) are an agreement with Block, Inc. and govern the APIs, SDKs and developer tools. Payment processing through an API is also subject to Square's General Terms.", "The Privacy Notice for Square Sellers and Website Visitors (last updated 15 September 2026) names Block, Inc., 1955 Broadway, Suite 600, Oakland, CA 94612 as the entity for US sellers, with other Square entities for Canada, Japan, Australia and the EU.", "The API answers at connect.squareup.com and the remote MCP server at mcp.squareup.com. The sandbox uses the separate domain squareupsandbox.com.", "squareup.com/.well-known/security.txt and developer.squareup.com/.well-known/security.txt return 404. The security page links a Bugcrowd programme.", "RDAP for squareup.com gives a registration date of 2007-05-26." ], "score": 84, "checks": [ { "check": "Legal entity named", "value": "Block, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "squareup.com, registered 2007-05-26 (19 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "mcp.squareup.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 5.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "www.issquareup.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://squareup.com/us/en/legal/general/developers", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-10", "words": 9322, "points": 5.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: September 10, 2026", "says": "Last updated 2026-09-10" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "Our relationship is governed by the laws of California, federal law, or both.", "says": "The law of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE TOTAL LIABILITY OF SQUARE IS LIMITED TO THE GREATER OF (A) THE AMOUNT OF FEES EARNED BY US IN CONNECTION WITH YOUR USE OF THE SERVICES DURING THE THREE (3) MONTH PERIOD IMMEDIATELY PRECEEDING THE EVENT GIVING RISE TO THE CLAIM FOR LIABILITY OR (B) $500.", "says": "Capped at $500" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If you revoke this license, your access to the Developer Tools and Content will immediately terminate." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "We may amend these Developer Terms and the documentation and guidelines accompanying the applicable Developer Tools, at any time with notice that we deem to be reasonable in the circumstances, by posting the revised version on our website or communicating it to you through your Square account (each a “Revised Version”…", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You will not misrepresent or mask either your identity or Your Service’s identity when using the Developer Tools or developer accounts." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "scrape, access, download, store, build databases or otherwise create permanent copies of any Square Seller’s Content, including Content related to or provided by any customer of any Square Seller;", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "create a service that functions substantially the same as the Developer Tools or any Square service;", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may terminate these Developer Terms, suspend or terminate your Square account at any time for any reason, including, but not limited to, where Your Service allows Square Sellers to migrate from Square to a third party service or platform." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "YOU WAIVE ANY RIGHT TO HAVE YOUR CASE DECIDED BY A JURY AND YOU WAIVE ANY RIGHT TO PARTICIPATE IN A CLASS ACTION AGAINST SQUARE." } ], "notes": [ { "date": "2026-10-08", "text": "Developers may not use Content or other data received from Square to train or enhance any AI System, whether or not the data is anonymised.", "quote": "use any Content or other data received from Square (anonymized or not) to train or otherwise enhance any “AI System” (as defined in Section 7)." }, { "date": "2026-10-08", "text": "Content submitted through the Developer Tools is licensed to Square on a perpetual and irrevocable basis.", "quote": "you give Square a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute such content." }, { "date": "2026-10-08", "text": "Square's total liability is limited to the greater of the fees it earned from the developer's use in the preceding three months or 500 US dollars.", "quote": "THE TOTAL LIABILITY OF SQUARE IS LIMITED TO THE GREATER OF (A) THE AMOUNT OF FEES EARNED BY US IN CONNECTION WITH YOUR USE OF THE SERVICES DURING THE THREE (3) MONTH PERIOD IMMEDIATELY PRECEEDING THE EVENT GIVING RISE TO THE CLAIM FOR LIABILITY OR (B) $500." } ] }, { "kind": "privacy", "url": "https://squareup.com/us/en/legal/general/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-15", "words": 9443, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: September 15, 2026", "says": "Last updated 2026-09-15" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "We collect information about you in three ways: (i) when you provide it to us directly;" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We store your information for as long as is necessary for the purposes identified in this Privacy Notice, including to provide our Services, to comply with legal obligations, to enforce and prevent violations of our Terms of Services, to protect against fraudulent activity, and to defend our legal rights, property and…", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "…\"log-in\" and \"log-out\" information, browser type and language, the domain name of your internet service provider, other attributes about your browser, any specific page you visit on our platform, content you view, features you use, the date and time of your use of the Services, your search terms, and the website you v…" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "While we do not sell personal information as that term is commonly understood, we have, “sold or shared” over the last 12 months Usage Data for the purpose of interest-based advertising (or “targeted advertising”) as described below.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You can exercise your right to opt-out of targeted advertising by clicking the \"Your Privacy Choices\" link in the footer of any page on our browser site, or by enabling the Global Privacy Control or a similar opt-out preference setting within the browser you use to access our website." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": false }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "When we transfer your personal data to our affiliates and/or service providers outside the EU, we make use of standard contractual clauses (which have been approved by the European Commission) to help ensure your information is afforded a high standard of protection, and that your privacy rights can be vindicated.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "These disclosures may qualify as “sales” or “sharing” of personal information as defined under CCPA." } ], "notes": [ { "date": "2026-10-08", "text": "Square shares account holders' information with other Block business units and affiliates, naming Cash App, Afterpay/Clearpay and TIDAL.", "quote": "With other business units, such as Cash App, and affiliates, including Afterpay/Clearpay and TIDAL and between wholly-owned subsidiaries of Block, Inc., such as Square Financial Services, Inc." }, { "date": "2026-10-08", "text": "In some circumstances Square processes personal information about a seller's customers on its own behalf as a controller, not only as the seller's processor.", "quote": "However, in other circumstances, we also obtain and process personal information from your customers on our own behalf as a “controller” or “business”." }, { "date": "2026-10-08", "text": "Square may use aggregated and deidentified transaction data in economic indices, research reports and similar publications.", "quote": "We may also use aggregated and deidentified transaction data to create economic indices, research reports, and similar publications that do not identify individual customers or merchants." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/square.json", "live": { "slug": "square", "probe": { "target": "https://mcp.squareup.com/mcp", "method": "get", "lastAt": "2026-10-08T19:53:02.961463391Z", "lastOk": true, "lastStatus": 401, "lastMs": 37, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 63, "p95ms24h": 137, "samples24h": 27, "samples30d": 27, "days": [ { "date": "2026-10-08", "probes": 27, "ok": 27 } ] }, "vendorStatus": { "page": "https://www.issquareup.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T19:51:03.78936354Z" }, "pages": [ { "url": "https://developer.squareup.com/docs/changelog/connect", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:17:18.308620553Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "62494a1dd472" }, { "url": "https://squareup.com/us/en/legal/general/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:24:44.136652202Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "18b57fb2f3f3" }, { "url": "https://squareup.com/us/en/legal/general/developers", "kind": "terms", "status": 200, "checkedAt": "2026-10-08T18:24:40.889937356Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "10ccc5457da5" } ], "updatedAt": "2026-10-08T19:53:02.961463391Z" } }, "verify": { "accepts": "a page on squareup.com or one of its subdomains, or the README of github.com/square/square-mcp-server", "badgeUrl": "https://www.anchorterminal.com/badges/square.svg", "body": { "slug": "square", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/square", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/square\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/square.svg\" alt=\"Square on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Square on Anchor Terminal](https://www.anchorterminal.com/badges/square.svg)](https://www.anchorterminal.com/tools/square)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/square\"\u003eSquare on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/square", "json": "https://www.anchorterminal.com/tools/square.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/square.md", "slim": "https://www.anchorterminal.com/tools/square.min.md" }, "markdown": "## Overview\n\n**Grade B · 69.2/100 · rank #166 of 722 · #6 in Commerce \u0026 checkout · not agent-ready · confidence medium**\n\n\n## Assessment\n\nThe REST API has a public OpenAPI 3.0 spec, OAuth scopes split by read and write for each resource, idempotency keys on writes and a free sandbox. The MCP server is in beta and its remote instance reaches production only. No numeric REST rate limits or SLA were found, and the status page recorded widespread errors on 27 September 2026.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Block, Inc. (https://squareup.com) |\n| Kind | HTTP API |\n| Category | Commerce \u0026 checkout (https://www.anchorterminal.com/categories/commerce) |\n| Transport | HTTP, Streamable HTTP, stdio |\n| Endpoint | `https://mcp.squareup.com/mcp` |\n| Auth | OAuth or key · Access needs a Square account and an application created in the Developer Console, both self-serve. Two token types go in the `Authorization: Bearer` header. A personal access token gives unrestricted access to the owner's own account, with a separate sandbox token. OAuth access tokens are limited to the scopes a seller grants, expire after 30 days and can be refreshed and revoked. The remote MCP server signs in through OAuth, and Square keeps an allowlist of MCP clients that may register. |\n| Pricing | Pay per use (2.9% fee) · The API and sandbox carry no charge. Sellers pay processing fees, 2.9% + 30 cents for card payments through the payments APIs in the US. Square Free is $0 a month, Plus $49 and Premium $149 per location. The sandbox lets an agent start without a contract (https://squareup.com/us/en/payments/our-fees, checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the docs index at developer.squareup.com/llms.txt or the OpenAPI spec (checked 2026-10-08). |\n| Licence | Proprietary service under the Square Developer Terms of Service. The MCP server and the OpenAPI specification on GitHub are Apache 2.0, and the Node.js SDK is MIT |\n| Tools exposed | 3 |\n| Packages | npm: `square`; npm: `square-mcp-server`; pypi: `squareup` |\n| Source | https://github.com/square/square-mcp-server |\n| Docs | https://developer.squareup.com/docs |\n| llms.txt | https://developer.squareup.com/llms.txt |\n| Last release | 2026-09-16 |\n| npm downloads / week | 453,743 |\n| PyPI downloads / week | 72,138 |\n| APIs | REST at https://connect.squareup.com/v2, sandbox at https://connect.squareupsandbox.com/v2. 332 operations in the 2026-09-16 spec, among them catalogue (14), orders (8), checkout and payment links (10), payments (7), inventory (19) and customers (14). GraphQL for reads |\n| MCP server | Beta. Remote at https://mcp.squareup.com/mcp with OAuth, production only. Local over stdio with `npx square-mcp-server start`, an access token, and `SANDBOX` or `PRODUCTION` set. Three tools in the open-source server |\n| Cart and checkout | Orders API with a DRAFT state, CalculateOrder for totals and discounts on orders, PayOrder, and CreatePaymentLink for a Square-hosted checkout page |\n| Credentials | Personal access token (unrestricted, own account) or OAuth access token limited by scopes. OAuth tokens expire after 30 days, with refresh and revoke endpoints |\n| Rate limits | No numbers published for REST. 429 with `RATE_LIMITED`, and the docs ask for exponential backoff with jitter. GraphQL allows 10 queries a second, depth 10 and a complexity score of 250 |\n| Errors | An `errors` array with category, code, detail and field. Retired endpoints return 410 |\n| Idempotency | `idempotency_key` on 78 request schemas, and optimistic concurrency by object version |\n| Versioning | Dated versions (YYYY-MM-DD) pinned per application and overridden with the `Square-Version` header. Releases roughly monthly |\n| SDKs | Java 48.0.0.20260916, .NET 47.0.0, Node.js 46.0.0, PHP 47.0.0.20260916, Python 46.0.0.20260916, Ruby 47.0.0.20260916, Go v5.0.0 |\n| Sandbox | Free, provisioned for each application, with test cards and payment tokens. Hardware, the Point of Sale API, Snippets API and Sites API aren't supported in it |\n| Audit | API Logs in the Developer Console keep each request and response for 28 days, filterable by API, endpoint, status and error code. GraphQL queries aren't logged there |\n| Deprecations | Typically at least 12 months between deprecation and retirement, and at least 6 months in maintenance once a replacement is generally available |\n| Status | issquareup.com, 15 incidents between 10 July and 8 October 2026, all labelled minor by Square |\n| Capabilities | commerce.products, commerce.orders, commerce.checkout, commerce.cart, commerce.headless, payments.card, payments.checkout |\n| Tags | hosted, closed-source, mcp, oauth, openapi, llms-txt, webhooks, sandbox, graphql, typescript, python, status-page, bug-bounty |\n| JSON | https://www.anchorterminal.com/api/v1/tools/square.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 58 | 11.6 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 87 | 14.1 |\n| Agent ergonomics | 13% | 16.2 | 83 | 13.5 |\n| Security \u0026 auth | 14% | 17.5 | 67 | 11.7 |\n| Payments \u0026 pricing | 10% | 12.5 | 40 | 5.0 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 81 | 7.1 |\n| Transparency \u0026 trust (editorial 56, provenance 84) | 7% | 8.8 | 70 | 6.1 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **69.2 → B** |\n\n### Why each score\n\n- Reliability 58: Graded on the hosted REST API. Status page at issquareup.com with an incident history, though its components endpoint returns an empty list (20). In the 90 days to 8 October 2026 the page lists 15 incidents, all labelled minor. One, on 27 September, reported widespread elevated latency and service errors across Square, including payment authorisation and refunds, and closed 1 hour 47 minutes after the first post. The others were partial, by card network, device or feature (10). No numeric limits were found for the REST API, and the docs say endpoints might enforce different limits. GraphQL is limited to 10 queries a second (5). The docs describe 429 `RATE_LIMITED` errors, exponential backoff with jitter and idempotency keys on writes (15). No SLA found in the developer terms or docs (0). The REST API is generally available, but 97 of 332 operations in the spec are beta and the MCP server is beta (8).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 87: Public OpenAPI 3.0 spec in square/connect-api-specification with 332 operations and 1,476 schemas (25). developer.squareup.com/llms.txt indexes the docs and links llms-full.txt (10). 327 of 332 operations carry a description stating purpose, with little guidance on when not to use one (14). Request schemas are typed, 204 schemas are enums and required fields are marked. The MCP tool `make_api_request` takes an untyped request object, with types fetched through `get_type_info` (12). Errors are documented as category, code, detail and field with a published code list, but the spec lists only 200 responses and names endpoint errors on 82 of 332 operations (11). Dated API versions set by the `Square-Version` header and monthly release notes (15).\n- Agent ergonomics 83: List endpoints take `limit` and a cursor, and GraphQL selects fields for reads. The MCP server has three tools that load service and type detail on request (20). Cursor pagination, search endpoints with filters, and batch endpoints. Cursors expire after 5 minutes (18). Errors carry a category, a code and the request field at fault (18). Idempotency keys on 78 request schemas and optimistic concurrency by version. The MCP tools carry no readOnlyHint or destructiveHint annotations in the source (14). Official SDKs in seven languages. An MCP call needs two discovery calls first (13).\n- Security \u0026 auth 67: OAuth with code and PKCE flows, read and write scopes for each resource, 30-day access tokens, refresh and revocation. The remote MCP server uses OAuth with registration limited to an allowlist of clients and advertises 48 scopes. Personal access tokens are unrestricted (26). Read-only scopes, and `DISALLOW_WRITES` on the local MCP server. No confirmation step for destructive calls was found (12). The API returns seller and customer text. The MCP page advises testing prompts in the sandbox, and no prompt-injection guidance was found (3). API Logs show each request and response for 28 days, with webhook event logs (12). A Bugcrowd programme is linked from the security page, which states ISO 27001 and PCI certification. squareup.com and developer.squareup.com return 404 for security.txt, and the Bugcrowd and trust centre pages didn't render for us (14).\n- Payments \u0026 pricing 40: No x402, MPP or L402 found in the docs index or the spec (0). Fees are public without login. The API has no charge, and card payments through the payments APIs cost 2.9% + 30 cents in the US (20). The sandbox is free, and the Square Free plan is $0 a month (20). A person must create a Square account and an application in the Developer Console, or approve OAuth in a browser (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 81: API version 2026-09-16 was released 22 days before the check (30). Three dated releases in 90 days, on 15 July, 19 August and 16 September 2026 (20). Public release notes, a developer forum and a Discord community are linked from the docs. GitHub issues were not readable, and the MCP server repository has one commit since May 2025 (10). Seven official SDKs were regenerated for 2026-09-16, the Node.js one at 46.0.0. No Square server appears in the official MCP registry (15). The Node.js SDK has CI and integration workflows. The npm package square-mcp-server is still 0.1.2, published in April 2025 (6).\n- Transparency \u0026 trust 70: Closed service under published developer terms. The API spec and MCP server are Apache 2.0 and the Node.js SDK is MIT (15). The privacy notice was updated on 15 September 2026 and says retention is decided case by case, with no periods given. No public DPA was found at the addresses we tried (13). APIs are typically deprecated at least 12 months before retirement, retired endpoints return 410, and deprecated items are listed with dates (20). The privacy notice names categories of service providers and processing in the US, Japan, the UK and the EU. No named sub-processor list was found (8).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (18 items): https://www.anchorterminal.com/fixes/square.md (JSON https://www.anchorterminal.com/fixes/square.json)\n\n### What we couldn't check\n\n- unchecked: the tool list of the remote MCP server at mcp.squareup.com, which answers 401 without an OAuth token. The three tools are read from the open-source local server\n- unchecked: GitHub stars and open issues, because the GitHub API refused us for its rate limit\n- unchecked: the Bugcrowd programme page and trust.squareup.com, which render with JavaScript only\n- unchecked: whether Square publishes a DPA or a named sub-processor list. Two guessed addresses returned 404 and the privacy notice links neither\n- No numeric REST rate limits and no SLA were found in the reviewed documentation\n- The MCP README gives https://mcp.squareup.com/sse and the docs give https://mcp.squareup.com/mcp. Both answered 401 on 8 October 2026\n- Whether creating a Square account needs a card was not checked. The sandbox is documented as free\n- The category fits the catalogue, orders and payment-link APIs. Square is also a payment processor, so the payments category would be a reasonable second home\n\n### Sources\n\n- MCP server docs: \u003chttps://developer.squareup.com/docs/mcp\u003e (seen 2026-10-08)\n- MCP server source and README: \u003chttps://github.com/square/square-mcp-server\u003e (seen 2026-10-08)\n- remote MCP OAuth metadata: \u003chttps://mcp.squareup.com/.well-known/oauth-protected-resource\u003e (seen 2026-10-08)\n- OpenAPI spec: \u003chttps://github.com/square/connect-api-specification\u003e (seen 2026-10-08)\n- llms.txt: \u003chttps://developer.squareup.com/llms.txt\u003e (seen 2026-10-08)\n- status incidents: \u003chttps://www.issquareup.com/api/v2/incidents.json\u003e (seen 2026-10-08)\n- error handling and rate limiting: \u003chttps://developer.squareup.com/docs/build-basics/general-considerations/handling-errors\u003e (seen 2026-10-08)\n- API lifecycle: \u003chttps://developer.squareup.com/docs/build-basics/api-lifecycle\u003e (seen 2026-10-08)\n- versioning: \u003chttps://developer.squareup.com/docs/build-basics/versioning-overview\u003e (seen 2026-10-08)\n- access tokens: \u003chttps://developer.squareup.com/docs/build-basics/access-tokens\u003e (seen 2026-10-08)\n- OAuth refresh and revoke: \u003chttps://developer.squareup.com/docs/oauth-api/refresh-revoke-limit-scope\u003e (seen 2026-10-08)\n- pagination: \u003chttps://developer.squareup.com/docs/build-basics/common-api-patterns/pagination\u003e (seen 2026-10-08)\n- API Logs: \u003chttps://developer.squareup.com/docs/devtools/api-logs\u003e (seen 2026-10-08)\n- sandbox: \u003chttps://developer.squareup.com/docs/devtools/sandbox/overview\u003e (seen 2026-10-08)\n- GraphQL limits: \u003chttps://developer.squareup.com/docs/devtools/graphql\u003e (seen 2026-10-08)\n- release notes: \u003chttps://developer.squareup.com/docs/changelog/connect\u003e (seen 2026-10-08)\n- release 2026-09-16: \u003chttps://developer.squareup.com/docs/changelog/connect-logs/2026-09-16\u003e (seen 2026-10-08)\n- developer terms: \u003chttps://squareup.com/us/en/legal/general/developers\u003e (seen 2026-10-08)\n- privacy notice: \u003chttps://squareup.com/us/en/legal/general/privacy\u003e (seen 2026-10-08)\n- plans: \u003chttps://squareup.com/us/en/pricing\u003e (seen 2026-10-08)\n- processing fees: \u003chttps://squareup.com/us/en/payments/our-fees\u003e (seen 2026-10-08)\n- security page: \u003chttps://squareup.com/us/en/security\u003e (seen 2026-10-08)\n- security.txt (404): \u003chttps://squareup.com/.well-known/security.txt\u003e (seen 2026-10-08)\n- npm metadata: \u003chttps://registry.npmjs.org/square/latest\u003e (seen 2026-10-08)\n- MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=square\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 84/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Block, Inc. | 20/20 |\n| Domain age | squareup.com, registered 2007-05-26 (19 years) | 15/15 |\n| Endpoint on the vendor's domain | mcp.squareup.com | 15/15 |\n| Terms of service | read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points | 5.1/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 |\n| Status page | www.issquareup.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe Square Developer Terms of Service (last updated 10 September 2026) are an agreement with Block, Inc. and govern the APIs, SDKs and developer tools. Payment processing through an API is also subject to Square's General Terms.\n\nThe Privacy Notice for Square Sellers and Website Visitors (last updated 15 September 2026) names Block, Inc., 1955 Broadway, Suite 600, Oakland, CA 94612 as the entity for US sellers, with other Square entities for Canada, Japan, Australia and the EU.\n\nThe API answers at connect.squareup.com and the remote MCP server at mcp.squareup.com. The sandbox uses the separate domain squareupsandbox.com.\n\nsquareup.com/.well-known/security.txt and developer.squareup.com/.well-known/security.txt return 404. The security page links a Bugcrowd programme.\n\nRDAP for squareup.com gives a registration date of 2007-05-26.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://squareup.com/us/en/legal/general/developers), read 2026-10-08, dated 2026-09-10, states 6 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"scrape, access, download, store, build databases or otherwise create permanent copies of any Square Seller’s Content, including Content related to or provided by any customer of any Square Seller;\"\n- To know. Restricts benchmarking or competitive use (costs points). \"create a service that functions substantially the same as the Developer Tools or any Square service;\"\n- To know. Says access can be ended without notice or for any reason. \"We may terminate these Developer Terms, suspend or terminate your Square account at any time for any reason, including, but not limited to, where Your Service allows Square Sellers to migrate from Square to a third party service or platform.\"\n- To know. Requires arbitration or waives class actions. \"YOU WAIVE ANY RIGHT TO HAVE YOUR CASE DECIDED BY A JURY AND YOU WAIVE ANY RIGHT TO PARTICIPATE IN A CLASS ACTION AGAINST SQUARE.\"\n- Gives the date it was last updated. Last updated 2026-09-10.\n- Names the governing law or courts. The law of California.\n- States a limit on its liability. Capped at $500.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). Developers may not use Content or other data received from Square to train or enhance any AI System, whether or not the data is anonymised. \"use any Content or other data received from Square (anonymized or not) to train or otherwise enhance any “AI System” (as defined in Section 7).\"\n- Also in the text (2026-10-08). Content submitted through the Developer Tools is licensed to Square on a perpetual and irrevocable basis. \"you give Square a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute such content.\"\n- Also in the text (2026-10-08). Square's total liability is limited to the greater of the fees it earned from the developer's use in the preceding three months or 500 US dollars. \"THE TOTAL LIABILITY OF SQUARE IS LIMITED TO THE GREATER OF (A) THE AMOUNT OF FEES EARNED BY US IN CONNECTION WITH YOUR USE OF THE SERVICES DURING THE THREE (3) MONTH PERIOD IMMEDIATELY PRECEEDING THE EVENT GIVING RISE TO THE CLAIM FOR LIABILITY OR (B) $500.\"\n\n**Privacy policy** (https://squareup.com/us/en/legal/general/privacy), read 2026-10-08, dated 2026-09-15, states 7 of the 8 things a reader expects.\n\n- To know. Says it sells personal data or shares it for advertising. \"These disclosures may qualify as “sales” or “sharing” of personal information as defined under CCPA.\"\n- Gives the date it was last updated. Last updated 2026-09-15.\n- Says how long data is kept. For as long as needed, with no period named.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Not found in the text. Gives a privacy contact.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n- Also in the text (2026-10-08). Square shares account holders' information with other Block business units and affiliates, naming Cash App, Afterpay/Clearpay and TIDAL. \"With other business units, such as Cash App, and affiliates, including Afterpay/Clearpay and TIDAL and between wholly-owned subsidiaries of Block, Inc., such as Square Financial Services, Inc.\"\n- Also in the text (2026-10-08). In some circumstances Square processes personal information about a seller's customers on its own behalf as a controller, not only as the seller's processor. \"However, in other circumstances, we also obtain and process personal information from your customers on our own behalf as a “controller” or “business”.\"\n- Also in the text (2026-10-08). Square may use aggregated and deidentified transaction data in economic indices, research reports and similar publications. \"We may also use aggregated and deidentified transaction data to create economic indices, research reports, and similar publications that do not identify individual customers or merchants.\"\n\n## Live (updated 2026-10-08 19:53 UTC)\n\n- Right now: up, HTTP 401, 37 ms, checked 2026-10-08 19:53 UTC (get on `https://mcp.squareup.com/mcp`, asks for auth)\n- Uptime 24h 100.0% (27 probes) · 30 days 100.0% (27 probes) · p50 63 ms · p95 137 ms\n- Vendor status page: none, All Systems Operational\n- Watching changelog \u003chttps://developer.squareup.com/docs/changelog/connect\u003e\n- Watching privacy \u003chttps://squareup.com/us/en/legal/general/privacy\u003e\n- Watching terms \u003chttps://squareup.com/us/en/legal/general/developers\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/square.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Card payment through the payments APIs (US) | 2.9% | percentage fee | plus 30 cents per transaction |\n| ACH bank transfer through the API (US) | 1% | percentage fee | $1 minimum, $5 fee cap |\n| Square Free | free | per month (plan) | per location |\n| Square Plus | $49 | per month (plan) | per location |\n| Square Premium | $149 | per month (plan) | per location |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Public OpenAPI 3.0 spec with 332 operations and 1,476 schemas, regenerated for API version 2026-09-16\n- OAuth scopes are split by read and write for each resource, and access tokens expire after 30 days\n- 78 request schemas carry an `idempotency_key`, and the docs describe backoff with jitter for 429 responses\n- Free sandbox at connect.squareupsandbox.com with test cards, and API Logs kept for 28 days\n- Deprecated APIs are typically retired at least 12 months after deprecation, with dated release notes each month\n\n## Weaknesses\n\n- The MCP server is marked beta, and the remote server reaches production data only\n- No numeric rate limits were found for the REST API. Only GraphQL states a figure, 10 queries a second\n- No SLA was found in the developer terms or documentation\n- The status page recorded widespread latency and errors on 27 September 2026, including payment authorisation\n- A personal access token grants unrestricted access to the whole Square account\n- 97 of the 332 operations in the spec are marked beta\n\n## Before you call it (notes for agents)\n\n1. Test against the sandbox first with the local MCP server and `SANDBOX=true`. The remote server at mcp.squareup.com reaches production only\n2. Set `DISALLOW_WRITES=true` on the local MCP server when the task only reads\n3. Call `get_service_info`, then `get_type_info`, before each `make_api_request`. The request body is otherwise untyped\n4. Send a fresh `idempotency_key` on every write, and reuse it when retrying the same write\n5. Pin `Square-Version` in each request. Use a page cursor within 5 minutes of receiving it\n\n## Connect\n\nInstall:\n\n```bash\nnpx square-mcp-server start\n```\n\nFirst request:\n\n```bash\ncurl https://connect.squareupsandbox.com/v2/locations \\\n -H 'Square-Version: 2026-09-16' \\\n -H 'Authorization: Bearer {SANDBOX_ACCESS_TOKEN}' \\\n -H 'Content-Type: application/json'\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"mcp_square_api\": {\n \"args\": [\n \"mcp-remote\",\n \"https://mcp.squareup.com/mcp\"\n ],\n \"command\": \"npx\"\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/square. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Shopify API + MCP | BB | 75 | 52 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | no | https://www.anchorterminal.com/tools/shopify.md |\n| WooCommerce API + MCP | BB | 72.9 | 84 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | no | https://www.anchorterminal.com/tools/woocommerce.md |\n| Shopware | BB | 71.4 | 112 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | no | https://www.anchorterminal.com/tools/shopware.md |\n| commercetools | BB | 71.3 | 116 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | no | https://www.anchorterminal.com/tools/commercetools.md |\n| Vendure | BB | 70.9 | 123 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | no | https://www.anchorterminal.com/tools/vendure.md |\n| Saleor API + MCP | B | 68.6 | 175 | commerce.products, commerce.cart, commerce.checkout, commerce.orders, commerce.headless | no | https://www.anchorterminal.com/tools/saleor.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The MCP server is marked beta. Block hosts a remote server at https://mcp.squareup.com/mcp with OAuth sign-in, and the local server runs with `npx square-mcp-server start` (source: \u003chttps://developer.squareup.com/docs/mcp\u003e)\n- Remote MCP instances reach production resources only. Sandbox testing needs the local server with `SANDBOX=true` (source: \u003chttps://developer.squareup.com/docs/mcp\u003e)\n- The open-source MCP server has three tools, `get_service_info`, `get_type_info` and `make_api_request`, covering 38 API services (source: \u003chttps://github.com/square/square-mcp-server\u003e)\n- The OpenAPI 3.0 spec for version 2026-09-16 has 332 operations, 97 marked beta and 24 deprecated (source: \u003chttps://github.com/square/connect-api-specification\u003e)\n- Release 2026-09-16 retired the write operations of the Transactions API. Read operations remain (source: \u003chttps://developer.squareup.com/docs/changelog/connect-logs/2026-09-16\u003e)\n- The status page reported widespread elevated latency and service errors across Square on 27 September 2026 (source: \u003chttps://www.issquareup.com\u003e)\n- The weekly npm figure is for the `square` SDK. `square-mcp-server` had 926 downloads in the week to 4 October 2026 (source: \u003chttps://api.npmjs.org/downloads/point/last-week/square-mcp-server\u003e)\n\n## Compare\n\n- [Adobe Commerce (Magento) vs Square](https://www.anchorterminal.com/compare/adobe-commerce-vs-square.md): B 63.9 vs B 69.2\n- [BigCommerce API + MCP vs Square](https://www.anchorterminal.com/compare/bigcommerce-vs-square.md): B 64.3 vs B 69.2\n- [Commerce Layer API + MCP vs Square](https://www.anchorterminal.com/compare/commerce-layer-vs-square.md): B 63.7 vs B 69.2\n- [commercetools vs Square](https://www.anchorterminal.com/compare/commercetools-vs-square.md): BB 71.3 vs B 69.2\n- [Ecwid by Lightspeed vs Square](https://www.anchorterminal.com/compare/ecwid-vs-square.md): B 63.2 vs B 69.2\n- [Elastic Path API + MCP vs Square](https://www.anchorterminal.com/compare/elastic-path-vs-square.md): D 50.1 vs B 69.2\n- [Medusa API + MCP vs Square](https://www.anchorterminal.com/compare/medusa-vs-square.md): B 63.5 vs B 69.2\n- [Saleor API + MCP vs Square](https://www.anchorterminal.com/compare/saleor-vs-square.md): B 68.6 vs B 69.2\n- [Shopify API + MCP vs Square](https://www.anchorterminal.com/compare/shopify-vs-square.md): BB 75 vs B 69.2\n- [Shopware vs Square](https://www.anchorterminal.com/compare/shopware-vs-square.md): BB 71.4 vs B 69.2\n- [Snipcart API + MCP vs Square](https://www.anchorterminal.com/compare/snipcart-vs-square.md): E 40.8 vs B 69.2\n- [Square vs Swell](https://www.anchorterminal.com/compare/square-vs-swell.md): B 69.2 vs C 55\n- [Square vs Vendure](https://www.anchorterminal.com/compare/square-vs-vendure.md): B 69.2 vs BB 70.9\n- [Square vs Wix Stores and eCommerce API](https://www.anchorterminal.com/compare/square-vs-wix.md): B 69.2 vs C 61.4\n- [Square vs WooCommerce API + MCP](https://www.anchorterminal.com/compare/square-vs-woocommerce.md): B 69.2 vs BB 72.9\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on squareup.com or one of its subdomains, or the README of github.com/square/square-mcp-server. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"square\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/square\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/square.svg\" alt=\"Square on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Square on Anchor Terminal](https://www.anchorterminal.com/badges/square.svg)](https://www.anchorterminal.com/tools/square)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/square\"\u003eSquare on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Square is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/square-dark.png\n- Light: https://www.anchorterminal.com/assets/share/square-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Commerce \u0026 checkout", "url": "https://www.anchorterminal.com/categories/commerce" }, { "name": "Square", "url": "" } ], "description": "Square is Block's commerce and payments platform for sellers. Its REST API covers catalogue, orders, payment links, payments, inventory and customers, with seven SDKs and a beta MCP server hosted at mcp.squareup.com.", "facts": [ "rank #166 of 722", "OAuth or key auth", "0 desk reviews" ], "h1": "Square", "image": "https://www.anchorterminal.com/assets/og/tools-square.png", "path": "/tools/square", "published": "2026-10-01", "section": "tools", "title": "Square review for AI agents, grade B (69.2/100) | Anchor Terminal", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/square" }, "tokens": { "markdown": 7900, "slim": 1830 }, "version": 1 }