# Square

**Status:** Connect script implemented. Design: [design/mcp-integrations.md](../../design/mcp-integrations.md).

- **Agent path:** remote Square MCP (`mcp.squareup.com`).
- **Allow:** bookings, customers, catalog, inventory/location reads.
- **Deny:** payments, refunds, cards, checkout, payouts.
- **Connect:** operator `scripts/connect/connect-square.sh` + owner browser OAuth.

## Connect procedure

```bash
# Preview (default)
./scripts/connect.sh square --dry-run

# Execute (prompts for access token)
./scripts/connect.sh square --apply
```

### What the script does

1. **Dry-run:** Shows MCP URL, allowed/denied tools, and step-by-step procedure.
2. **Apply:**
   - Prompts for Square OAuth access token (read scope).
   - Stores token via `openshell provider set square-access-token`.
   - Registers MCP server URL via `nemohermes config set`.
   - Applies tool allowlist (read-only) and denylist (payment tools).
   - Records status in `.local/capability_state.json`.

### Owner steps (browser only)

1. Create a Square application at [developer.squareup.com](https://developer.squareup.com).
2. Generate an OAuth access token with read-only scope.
3. Provide the token to the operator.

### Tool filters

| Allowed (read) | Denied |
|----------------|--------|
| `bookings/list_bookings` | `payments/*` |
| `bookings/get_booking` | `refunds/*` |
| `customers/list_customers` | `cards/*` |
| `customers/get_customer` | `checkout/*` |
| `catalog/list_catalog` | `payouts/*` |
| `catalog/search_catalog_objects` | |
| `inventory/list_inventory` | |
| `locations/list_locations` | |
| `locations/get_location` | |