A lite PayPal MCP server. Per-merchant client-credentials auth — the server mints, caches, and refreshes its own access token. Read-only by default (money-safe). Runs over stdio (Claude Code / MCP gateway).
Solid foundation with consistent naming (verb_noun pattern), clear descriptions (avg 120 chars), and complete Zod schemas with type constraints. All 11 tools are read-only and money-safe by design. However, output schemas are not documented, LLMs cannot predict response structure. Parameter descriptions lack format/constraint details (e.g., ISO-8601 format stated but no regex/pattern). Error handling returns JSON but lacks recovery guidance or error classification. No tool annotations (readOnlyHint, idempotentHint). Missing batch operations and composition hints.
Get current (or as-of) account balances by currency.
Get a captured payment by id.
Get a dispute by id.
Get a single invoice by id.
Get a checkout order by id.
Get a subscription by id.
List customer disputes.
Output schemas not documented. LLMs cannot predict response structure (fields, types, nested objects). Agents must guess what data is available for downstream tool calls.
Error responses lack recovery guidance. fail() returns JSON with error/status/details but does not tell LLM what to do next (retry? ask user? call alternative tool?). No error classification (retryable vs fatal).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 67 | 2026-07-28+ | v2 |
List invoices (paginated).
List billing (subscription) plans.
Search transactions in a date range (Transaction Search API). start_date and end_date are required ISO-8601 timestamps and must be <= 31 days apart.
Verify the configured PayPal credentials by minting an access token. Returns the environment (SANDBOX/PRODUCTION). Use this to confirm the connection works.
Parameter descriptions lack format constraints. 'ISO-8601 start' is stated but no regex pattern or example format validation. 'Optional filter, e.g. S (success)' uses example values instead of enum constraints, LLMs may hallucinate invalid status codes.
No tool annotations (readOnlyHint, idempotentHint). All tools are read-only and safe to retry, but LLMs cannot infer this from the tool definition. Agents may avoid retrying on transient failures.
List tools (paypal_list_*) accept pagination but do not document result limits or total count in response. LLMs cannot predict if 500 items will be returned, risking context window exhaustion.