Square MCP — security audit

Risk flags

• Community-authored

  Maintained by Community. Confirm the repo and signing before installing.

• No public repository linked

  Without a public repo we cannot independently audit the code. Caution warranted.

Capability surface

• Outbound network

  Medium risk

  Calls external APIs (GitHub, Slack, Stripe, etc.). Data leaves the machine.

  Evidence: api

Trust signals

Total trust score is the sum of these contributions. Each signal carries a fixed weight.

• Verified by Loadout

  +20 / 20

  Manually verified.

• Official author

  +0 / 15

  Maintained by community contributors.

• Community traction

  +11 / 20

  180 GitHub stars.

• Public source

  +0 / 15

  No linked public repository.

• Stability

  +0 / 15

  Stability not yet assessed.

• Capability surface

  +15 / 15

  No high-risk capabilities detected.