Strider PayPal

Send and receive money via PayPal using Strider Labs MCP connector. Send payments, request money, check balance, view transactions. Complete autonomous onlin...

Security Scan

The skill's stated purpose (PayPal payments via a Strider Labs MCP connector) is plausible, but it instructs the agent to dynamically download and execute an npm package (npx @striderlabs/mcp-paypal) and allows autonomous payment actions without clear, enforceable safeguards — these aspects are disproportionate or under-specified and warrant caution.

Purpose & Capability

Name, description, and required binary (npx) align with a connector that runs an npm MCP package. No unexpected environment variables or unrelated binaries are requested. Requiring npx is reasonable for an MCP implemented as an npm package.

Instruction Scope

SKILL.md instructs the MCP config to run `npx -y @striderlabs/mcp-paypal` (i.e., fetch and execute code from the npm registry at runtime). It describes OAuth-based auth and claims tokens are 'stored encrypted per-user' but gives no details about where/how tokens are stored or how the 'explicit confirmation' requirement is enforced. The skill enables monetary actions (send, transfer, invoice) that could be invoked by the agent; the instructions do not define or enforce a verifiable manual confirmation step.

Install Mechanism

There is no install spec in the registry entry — the runtime behavior relies on using npx to download and execute an npm package. Dynamic execution of a remote package (-y makes it non-interactive) increases risk: the package could contain arbitrary code. The registry does point to an npm package and a homepage, but provenance and package contents are not verified here.

Credentials

The skill requests no pre-provisioned env vars (reasonable because it uses OAuth). However, OAuth tokens are required at runtime yet are not described in terms of scope, storage location, retention, or access controls. That lack of detail makes it hard to confirm the credential handling is proportionate and safe.

Persistence & Privilege

always:false (good), but disable-model-invocation is false (default) so the agent may autonomously invoke the skill. Given that the skill can perform real-money operations, autonomous invocation combined with dynamic remote code execution represents a meaningful risk unless strict confirmation and usage policies are enforced externally.

What to consider before installing

Before installing or enabling this skill: 1) Verify the npm package and publisher (visit the npm page and Strider Labs site, confirm package owner and recent release history). 2) Inspect the package source code (or ask the vendor for audited code) — npx will download and execute code, so you should be able to review what runs. 3) Confirm where OAuth tokens will be stored and who/what can access them; prefer storing tokens in a trusted secrets store and limit token scopes. 4) Disable autonomous invocation or require an explicit, verifiable human confirmation flow for every payment; do not rely solely on the skill's prose claim that "All payments require explicit confirmation." 5) Consider pinning to a specific package version or hosting a vetted mirror instead of running npx with a floating package name. 6) Test in a sandbox account with small amounts before using real funds. If you cannot verify package provenance and token handling, treat the skill as high-risk and do not enable it for accounts with real funds.

Strider PayPal Connector

MCP connector for online payments through PayPal — send money, request payments, manage balance, and view transaction history. Part of the Strider Labs action execution layer for AI agents.

Installation

npm install @striderlabs/mcp-paypal

MCP Configuration

Add to your MCP client configuration (Claude Desktop, Cursor, etc.):

{
  "mcpServers": {
    "paypal": {
      "command": "npx",
      "args": ["-y", "@striderlabs/mcp-paypal"]
    }
  }
}

Available Tools

paypal.send_payment

Send money to a PayPal user.

Input Schema:

{
  "recipient": "string (email or phone)",
  "amount": "number",
  "currency": "string (optional: USD, EUR, GBP, etc.)",
  "note": "string (optional: payment description)",
  "type": "string (optional: goods_services, friends_family)"
}

Output:

{
  "transaction_id": "string",
  "status": "string (pending, completed)",
  "recipient": "string",
  "amount": "number",
  "fee": "number (if applicable)"
}

paypal.request_payment

Request money from someone.

Input Schema:

{
  "from": "string (email)",
  "amount": "number",
  "currency": "string (optional)",
  "note": "string (optional)"
}

paypal.get_balance

Check PayPal balance in all currencies.

Output:

{
  "balances": [{
    "currency": "string",
    "available": "number",
    "pending": "number"
  }]
}

paypal.get_transactions

Get recent transaction history.

Output:

{
  "transactions": [{
    "id": "string",
    "type": "string (payment, refund, transfer)",
    "amount": "number",
    "currency": "string",
    "counterparty": "string",
    "date": "string (ISO date)",
    "status": "string"
  }]
}

paypal.transfer_to_bank

Transfer PayPal balance to linked bank account.

Input Schema:

{
  "amount": "number",
  "bank_account_id": "string (optional: use default if not specified)"
}

paypal.cancel_payment

Cancel a pending payment.

paypal.create_invoice

Create and send an invoice.

Authentication

First use triggers OAuth authorization flow. Supports personal and business accounts. Tokens stored encrypted per-user.

Usage Examples

Send money:

Send $50 to [e-mail] via PayPal for the concert tickets

Request payment:

Request $30 from [e-mail] on PayPal for dinner

Check balance:

What's my PayPal balance?

Transfer out:

Transfer my PayPal balance to my bank account

Error Handling

Code	Meaning	Action
AUTH_EXPIRED	Session expired	Re-authenticate
INSUFFICIENT_FUNDS	Balance too low	Add funds or use card
RECIPIENT_INVALID	Email not found	Verify recipient
LIMIT_EXCEEDED	Transaction limit	Verify identity

Security

• All payments require explicit confirmation
• Large payments may require additional verification
• 2FA supported for account protection
• Transaction history for auditing

Use Cases

• Online purchases: pay merchants securely
• International payments: send money in multiple currencies
• Freelancer payments: invoice clients and receive payments
• Personal transfers: send money to friends and family

Links

• npm: https://npmjs.com/package/@striderlabs/mcp-paypal
• Strider Labs: https://striderlabs.ai