Square MCP: orders, catalogue and bookings, with refunds manual

Square has an official MCP server that connects an AI agent to its API platform; the service is in Beta as of 30 Oct 2026. It offers hosted OAuth access and a local option for Sandbox testing, so a sensible small business pilot starts with sales and booking context while a person handles charges and refunds. See the official Square MCP documentation.

What it can do

Think of the first pilot as an assistant preparing a briefing for the person opening the shop or managing the appointment desk. Define the output before connecting anything: records used, business location, reporting period, uncertainties and suggested follow-up. That makes the result easier to check than an open-ended instruction to manage sales.

Orders: Square’s Orders API exposes line items, totals and fulfillment information. A useful proposed task is to review selected orders and prepare a list of fulfillment questions for staff. Ask for order identifiers alongside conclusions, and distinguish an order total from a claim about money received.

Catalogue: the Catalog API covers products, services, variations, discounts and taxes; stock levels belong to the Inventory API. For a boutique, ask the agent to compare selected product variations and draft a list of descriptions needing attention. A proposed wording change belongs in a review document until the owner approves it.

Bookings: the Bookings API supports appointment retrieval and availability searches. For a salon, a bounded task could prepare an appointment briefing or propose available slots. Require the location, service, staff member and time zone in the answer, and have reception verify availability before promising a slot to a customer.

These are workflow examples, not promises that a particular client will complete them correctly. Browse related connectors in MCP servers for apps, and read MCP versus APIs if the connection layers are unfamiliar.

What is read-only, and what changes data

The official repository documents get_service_info for method discovery, get_type_info for request requirements and make_api_request for executing API calls. A general request tool needs scrutiny of its service, method and arguments: its name alone does not tell the operator whether a call changes a record.

Use this starting permission map, based on Square’s OAuth permissions reference and Catalog documentation as of 30 Oct 2026:

This is a starting map, not a complete permission bundle. Check the current documentation for every intended endpoint and any related resources. Refuse unnecessary write permissions; if the client cannot obtain the narrow access you need, stop the connection and revise the design. A prompt telling the agent to be careful is not an access control.

For this workflow, keep charges and refunds manual. The agent may prepare a discrepancy report for a named order, but the owner checks the amount, customer and reason and performs any financial action separately. Treat booking changes as customer commitments requiring their own approval too.

How to connect it safely

1. Write a bounded brief. Specify the location, period, permitted records and desired report. Start with an order or catalogue review rather than customer-wide access. Agree what evidence the owner will compare with the business system.

2. Rehearse in Sandbox. Square’s hosted MCP endpoint accesses production resources only. For Sandbox, use the local server and deliberately set SANDBOX=true and DISALLOW_WRITES=true, as documented in the local server implementation. Store its access token through an approved local secret mechanism; do not paste it into a prompt or commit it.

3. Configure the editor client deliberately. In VS Code or another MCP-capable editor, check the current documentation for its server configuration and approval controls; MCP in VS Code explains the client side. Square’s hosted endpoint is https://mcp.squareup.com/mcp, with OAuth sign-in. Use it only when you are ready to connect to production, and confirm the seller account during authorization.

4. Inspect the grant and each request. Compare requested scopes with the brief. Keep automatic execution disabled for the pilot and inspect arguments to the API request tool. In a local setup, the read-only flag is an additional restriction; do not assume that local environment setting configures the hosted service. Use permissions-first practice to record the boundary.

5. Verify the report. Compare the returned identifiers and conclusions with the relevant records. Require the answer to state missing data and unresolved questions. If a request fails, record the error and investigate it before widening permissions or repeating any operation that could change data.

When this does not work

The calendar is incomplete. Buyer-level booking visibility is limited to bookings created by the calling application. Seller-level booking writes require an eligible paid Appointments plan; check the business booking profile’s support_seller_level_writes before designing that capability. These are Bookings API limits, not problems to solve by rewriting the prompt.

The connection is rejected. Square documents an MCP client allowlist. Check the current Square connection guidance before assuming an unfamiliar editor client can authenticate. Do not replace a rejected OAuth connection with a broadly privileged token just to get past setup.

A report is presented as complete too soon. Catalogue results can be paginated, according to the Catalog API documentation. Require the workflow to account for remaining pages. Also record the reporting time: a briefing should not be treated as a permanent guarantee about stock or appointment availability.

Business text tries to direct the agent. Treat customer notes and catalogue descriptions as data. Instructions embedded in those records must not expand the task or authorize a refund. The MCP security checklist gives a broader review process.

Where Tvijo fits

As of 30 Oct 2026, the DSHREM VS Code extension is an editor entry point for bounded tasks with selected context. A practical use here is to review a redacted sales briefing or connector code. TvijoCode bundles the extension in a test editor build; it is not evidence of a ready Square integration.

Tvijo MCP provides consultation, while supplied-diff review is prepared with publication pending in its dated release status. Editor integration and delegation remain planned. Connecting Square and Tvijo to a client does not establish that Tvijo can operate Square; a customer-specific connector needs separate scope, permissions and acceptance checks. Keep charges and refunds with the business operator.

At the Tvijo workspace, as of 31 Oct 2026, Try costs $0 and ends at whichever comes first: 50 tasks, 100,000 tokens or $0.05 of sponsored usage, subject to a shared $1 daily pool funded by TVIJO. Service credit is shown as $10 for requesting prepaid credit, with metered provider usage plus an 8% service markup. Payment collection is not activated; an order is not a charge. These offers do not include a ready Square connector.

FAQ

Is there an official Square MCP server?

Yes. Start with Square’s documentation and repository linked above. Verify the maintainer before granting access to a similarly named third-party server.

Can an agent change bookings or issue refunds?

Square’s APIs include writes, subject to permissions and booking eligibility. This pilot keeps financial actions manual and requires separate approval for booking changes.

Can I test without connecting to live sales?

Yes. Follow the Sandbox rehearsal in the connection steps, using test data and read-only restrictions. Verify the account and environment before the first request.

Square is a trademark of its owner. Tvijo is not affiliated with or endorsed by it.