# policy/openshell/overlays/square-mcp.yaml
# Square MCP policy overlay (applied at S7 when Square is connected).
#
# Allows the sandbox to reach Square's MCP server for bookings, customers,
# catalog, and inventory reads. Payment/refund/payout tools are excluded
# at the MCP tool level, not the network level.
#
# Apply via: nemohermes <name> policy-add --from-file <this-file> --yes

preset:
  name: square-mcp
network_policies:
  square-mcp:
    name: square-mcp
    endpoints:
      - host: connect.squareup.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow:
              method: GET
              path: /**
          - allow:
              method: POST
              path: /**
    binaries:
      - path: /usr/local/bin/hermes
      - path: /usr/bin/python3*
      - path: /opt/hermes/.venv/bin/python