Square MCP Server
by squareA Model Context Protocol (MCP) server for square
Square MCP Server is an open-source mcp server by square, written mainly in TypeScript, with 109 GitHub stars and the Apache-2.0 license. Its code was last updated Oct 14, 2026.
Scan summary: scanned Nov 5, 2026 at commit b276734. No capabilities flagged by our checks. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
b276734 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings. BuildsIt installed from a fresh machine. BootsIt started, and MCP servers answered the protocol handshake. No undeclared egressWhile running it only contacted the domains it declared. ReproducibleEarned in this scan.
Passed. This check ran and found nothing it flags.Static code scanpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Secrets scanpassPassed. This check ran and found nothing it flags.
Flagged. This check found an issue. See the findings below.Dependency audit31 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Passed. This check ran and found nothing it flags.BuildpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Boot & handshake3 toolspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Network egresspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Reproducible (×3)passPassed. This check ran and found nothing it flags.
Findings (12)
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.9.0: 5 known vulnerabilitiesGHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-8r9q-7v3j-jr4g, GHSA-rvq5-wwqv-78pq, GHSA-w48q-cv73-mx4w
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.2.0: 3 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-wqch-xfxh-vrr4
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.11: 8 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +3 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@3.1.2: 3 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@8.2.0: 2 known vulnerabilitiesGHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.24.2: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.14.0: 5 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.yaml@2.7.1: 1 known vulnerabilityGHSA-48c2-rrv3-qjmp
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.package.json has a prepare scriptnpm run build
package.json - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Network activity
During install
registry.npmjs.org
While running
No connections
Tools exposed (3)
make_api_requestUnified tool for all Square API operations. Be sure to get types before calling. Available services: applepay, bankaccounts, bookingcustomattributes, bookings, cards, cashdrawers, catalog, checkout, customercustomattributes, customergroups, customersegments, customers, devices, disputes, events, g
get_type_infoGet type information for a Square API method. You must call this before calling the make_api_request tool.
get_service_infoGet information about a Square API service. Call me before trying to get type info
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Square MCP Server alternatives
View more →Similar mcp servers in Other, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Square MCP Server (this page) square | 109 | Apache-2.0 | Oct 14, 2026 | Scanned, no flagged issues |
| Github MCP Server github | 34k | MIT | Oct 30, 2026 | Scanned, no flagged issues |
| Fastapi MCP tadata-org | 12k | MIT | Nov 24, 2025 | Scanned, no flagged issues |
| GhidraMCP LaurieWired | 12k | Apache-2.0 | Oct 10, 2026 | Scanned, no flagged issues |
| MCP Go mark3labs | 9.2k | MIT | Oct 30, 2026 | Scanned, no flagged issues |
| Git MCP idosal | 8.5k | Apache-2.0 | May 8, 2026 | Scanned, no flagged issues |