The official Paddle MCP server (@paddle/paddle-mcp) that lets AI assistants work with Paddle Billing — managing the product catalog, prices, and discounts, customers and businesses, subscriptions, transactions and adjustments, and financial reports — over the Paddle API, with sandbox or production environments and a read-only / non-destructive / all tool-permission filter.
The server acts on your real Paddle Billing account via its API key; with write permissions it can create and adjust products, prices, discounts, customers, subscriptions, and transactions., Tool permissions are controlled by `--tools` / `PADDLE_MCP_TOOLS`; `non-destructive` (the default) allows reads and safe writes, `read-only` allows reads only, and `all` enables every operation — choose the narrowest mode for the task., Adjustment and transaction tools can move real money (refunds, credits, charges), so prefer `read-only` or `non-destructive` unless a destructive action is explicitly intended., Use `--environment=sandbox` with a sandbox API key while developing; point at `production` only when you intend to act on live billing data., Treat the Paddle API key as a secret with broad account access, and scope what the agent can do through the environment and tools settings rather than the tool names alone.
Privacy notes
The server sends requests to the Paddle Billing API using your API key; customer, business, subscription, transaction, and report data it returns is passed to the LLM/MCP client., Billing data can include personal and financial information (names, emails, addresses, purchase history, payment metadata), so avoid exposing production data to the model unnecessarily., Reports and customer/subscription tools can surface aggregate revenue and account details; treat that output as sensitive business data., The API key is provided via a command-line argument or the `PADDLE_API_KEY` environment variable in your MCP client config — keep that config out of version control and restrict access to it.
Author
PaddleHQ
Submitted by
davion-knight
Claim status
unclaimed
Last verified
2026-07-08
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
78
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Complete
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
Registry metadata indicates a reviewed listing.
Done
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Pending
Baseline comparison available
No baseline peer selected yet.
Pending
Diverging trust signals identified
No major trust-signal divergence found.
Pending
Adoption plan
Balanced adoption plan
Current risk score 16/100. Use staged verification before broader rollout.
Risk 16
Pre-adoption checks
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Done
Confirm metadata review state
Listing has review metadata.
Done
Verify install payload
Install/config payload exists and can be inspected.
Done
Security checks
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Done
Review privacy notesRequired
Privacy notes are present.
Done
Verify package integrity metadata
No package verification/checksum metadata.
Pending
Rollout
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Pending
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Pending
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Pending
Evidence readiness
Evidence readiness matrix · balanced
Required evidence gates are covered (5/6 signals complete).
Risk 15
Source provenance
Present
Source repository/provenance is listed.
Required in this preset
Metadata review
Present
Review metadata is present.
Required in this preset
Safety notes
Present
Safety notes are present.
Required in this preset
Privacy notes
Present
Privacy notes are present.
Optional in this preset
Package integrity
Missing
Package integrity metadata is missing.
Optional in this preset
Install payload
Present
Install payload is available.
Required in this preset
Required evidence gates are covered for this preset.
Decision timeline
Decision timeline · balanced
5/6 steps complete with no blocking gaps for this preset.
Risk 14
triage
Confirm source provenanceRequired
Source/provenance metadata is available.
Done
triage
Check metadata review statusRequired
Review metadata is available.
Done
verify
Review safety notesRequired
Safety notes are available.
Done
verify
Review privacy notes
Privacy notes are available.
Done
verify
Validate package integrity metadata
Package integrity metadata is missing.
Pending
rollout
Verify install payload and commandsRequired
Install payload is available.
Done
No required blockers for this timeline preset.
Safety notes
The server acts on your real Paddle Billing account via its API key; with write permissions it can create and adjust products, prices, discounts, customers, subscriptions, and transactions.
Tool permissions are controlled by `--tools` / `PADDLE_MCP_TOOLS`; `non-destructive` (the default) allows reads and safe writes, `read-only` allows reads only, and `all` enables every operation — choose the narrowest mode for the task.
Adjustment and transaction tools can move real money (refunds, credits, charges), so prefer `read-only` or `non-destructive` unless a destructive action is explicitly intended.
Use `--environment=sandbox` with a sandbox API key while developing; point at `production` only when you intend to act on live billing data.
Treat the Paddle API key as a secret with broad account access, and scope what the agent can do through the environment and tools settings rather than the tool names alone.
Privacy notes
The server sends requests to the Paddle Billing API using your API key; customer, business, subscription, transaction, and report data it returns is passed to the LLM/MCP client.
Billing data can include personal and financial information (names, emails, addresses, purchase history, payment metadata), so avoid exposing production data to the model unnecessarily.
Reports and customer/subscription tools can surface aggregate revenue and account details; treat that output as sensitive business data.
The API key is provided via a command-line argument or the `PADDLE_API_KEY` environment variable in your MCP client config — keep that config out of version control and restrict access to it.
Prerequisites
Node.js and npm (the server runs via `npx -y @paddle/paddle-mcp`)
A Paddle Billing account (this server does not support Paddle Classic)
A Paddle API key created under Paddle > Developer tools > Authentication (use a sandbox key to start)
A choice of environment (`sandbox` or `production`) and tool-permission mode (`read-only`, `non-destructive`, or `all`)
An MCP-compatible client (Claude Desktop, Cursor, VS Code, Windsurf, etc.)
The Paddle MCP Server is the official Model Context Protocol server maintained by
Paddle. It gives LLMs and agentic clients near-parity access to the
Paddle Billing API — Paddle is a developer-first merchant of
record that handles payments, tax, and subscriptions — so an agent can manage the product
catalog, view customers and purchases, handle subscription, payment, and refund workflows,
create and adjust transactions, and generate financial reports.
The project is written in TypeScript, distributed as the npm package
@paddle/paddle-mcp (v0.1.6), and licensed under
Apache 2.0. It runs over stdio via npx, authenticates with a Paddle API key, targets either the
sandbox or production environment, and exposes a tool-permission filter
(read-only, non-destructive, or all) so you can bound what the agent may do. It supports Paddle
Billing (not Paddle Classic).
Source Review
The following real repository and package sources were fetched and reviewed for this entry:
README.md — install methods (command-line args and environment variables), the config blocks, the --tools/PADDLE_MCP_TOOLS permission modes, environment settings, and the full tool catalog.
npm: @paddle/paddle-mcp — package name and version (0.1.6), Apache-2.0 license, and the paddle bin entry.
Repository facts confirmed at review time: official PaddleHQ organization, default branch main,
not archived, and released as @paddle/paddle-mcp v0.1.6 on npm.
Features
Catalog management — create and update products, prices, and discounts (e.g. create_product, create_price, create_discount).
Customers & businesses — view and manage customers, businesses, and addresses (e.g. create_customer, get_customer, create_business).
Create and manage API keys in Paddle > Developer tools > Authentication (sandbox and live are
separate). Accepted --tools / PADDLE_MCP_TOOLS values are all, read-only, non-destructive
(default), or a comma-separated list of specific tool names.
Use Cases
Conversational billing ops — inspect customers, subscriptions, and transactions and make changes in natural language.
Catalog authoring — create and adjust products, prices, and discounts from an agentic workflow.
Refunds and adjustments — issue credits or refunds through adjustment tools (with appropriate permissions).
Financial reporting — generate revenue and operational reports for analysis.
Integration testing — run simulations against the sandbox environment while building a Paddle integration.
Safety and Privacy
Acts on real billing data. With write permissions the server can create and modify products, customers, subscriptions, and transactions; adjustment/transaction tools can move real money.
Permission filter is a first-class control. Use --tools=read-only or the default non-destructive unless a destructive action is intended; all enables every operation.
Sandbox first. Develop with --environment=sandbox and a sandbox key; switch to production only deliberately.
API key is sensitive. It grants broad account access — keep client config out of version control and restrict access.
Data flows to the model. Customer, business, subscription, transaction, and report data (including personal and financial details) is returned to the LLM/MCP client, so avoid exposing production data unnecessarily.
Duplicate Check
No existing entry in the directory matches this server. A search of all directory entries for
"paddle" across slugs, titles, repository URLs, and install commands returned no results, and there
is no prior entry pointing at github.com/PaddleHQ/paddle-mcp-server or the npm package
@paddle/paddle-mcp. This is therefore a net-new, non-duplicate entry.
Show that Paddle MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/paddle-mcp-server)
How it compares
Paddle MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
The official Paddle MCP server (@paddle/paddle-mcp) that lets AI assistants work with Paddle Billing — managing the product catalog, prices, and discounts, customers and businesses, subscriptions, transactions and adjustments, and financial reports — over the Paddle API, with sandbox or production environments and a read-only / non-destructive / all tool-permission filter.
The official Mux MCP server (@mux/mcp) that gives AI agents access to the Mux API for video and analytics. It uses a "Code Mode" scheme — exposing a documentation-search tool and a code tool that runs agent-written TypeScript against the Mux SDK in an isolated sandbox — to work with Mux Video (assets, live streams, playback IDs, uploads) and Mux Data (viewer metrics and monitoring).
The official Telnyx MCP server (@telnyx/mcp) that lets AI assistants use Telnyx's communications APIs through function calling — messaging (SMS/MMS), voice and call control, phone-number management, SIP connections, verification, and wireless. The npx package proxies to Telnyx's hosted MCP server over HTTPS and authenticates with a Telnyx API key.
The official Xero MCP server (@xeroapi/xero-mcp-server) that lets AI assistants work with a Xero accounting organisation — managing contacts, chart of accounts, invoices, credit notes, payments, bank transactions, manual journals, quotes, items, and payroll, and reading financial reports — using Xero OAuth2 custom connections or a bearer token.
✓The server acts on your real Paddle Billing account via its API key; with write permissions it can create and adjust products, prices, discounts, customers, subscriptions, and transactions.
Tool permissions are controlled by `--tools` / `PADDLE_MCP_TOOLS`; `non-destructive` (the default) allows reads and safe writes, `read-only` allows reads only, and `all` enables every operation — choose the narrowest mode for the task.
Adjustment and transaction tools can move real money (refunds, credits, charges), so prefer `read-only` or `non-destructive` unless a destructive action is explicitly intended.
Use `--environment=sandbox` with a sandbox API key while developing; point at `production` only when you intend to act on live billing data.
Treat the Paddle API key as a secret with broad account access, and scope what the agent can do through the environment and tools settings rather than the tool names alone.
✓This server uses a Code Mode scheme — the agent writes TypeScript against the Mux SDK and the server runs it in an isolated sandbox that has no web or filesystem access, then returns what the code prints or returns.
The sandboxed code runs with your Mux access token, so it can create, modify, and delete real Mux resources (assets, live streams, playback IDs, uploads) within that token's permissions.
Access is bounded by the Mux token's permissions, not by tool naming — scope the token to least privilege and prefer a non-production environment when an agent acts autonomously.
Optional Mux signing and private keys enable signed playback URLs and JWTs; treat `MUX_SIGNING_KEY` and `MUX_PRIVATE_KEY` as secrets.
Launching the client with the remote HTTP transport opens a network listener, so secure and authenticate it before exposing it beyond localhost.
✓The Telnyx API key grants access to your account's communications APIs, so tools can take real actions — sending SMS/MMS, placing or controlling calls, and managing phone numbers, SIP connections, and messaging profiles.
Messaging and voice operations reach real recipients and incur usage charges, so use a limited or test key and review actions before running against a production account.
Access is bounded by the API key's permissions, not by tool naming; scope the key to the minimum needed and treat it as a secret.
The package proxies your requests to Telnyx's hosted MCP server over HTTPS and sends the API key to authenticate against the Telnyx API.
Prefer a dedicated or restricted key for autonomous agents rather than a full-access production key.
✓Write-capable tools create and update real accounting records — invoices, contacts, credit notes, payments, bank transactions, manual journals, quotes, items, tracking categories, and payroll timesheets in the connected organisation.
Creating payments, invoices, credit notes, and manual journals affects real financial data and ledgers, so start with a Demo Company and review actions before connecting a production organisation.
Access is bounded by the custom connection's OAuth2 scopes (optionally `XERO_SCOPES`); grant only the scopes the workflow needs rather than the full set.
Payroll timesheet tools can create, update, approve, revert, and delete timesheets (NZ/UK regions), which affect real payroll data.
Xero credentials (`XERO_CLIENT_ID`/`XERO_CLIENT_SECRET` or `XERO_CLIENT_BEARER_TOKEN`) grant API access to the organisation and must be treated as secrets.
Privacy notes
✓The server sends requests to the Paddle Billing API using your API key; customer, business, subscription, transaction, and report data it returns is passed to the LLM/MCP client.
Billing data can include personal and financial information (names, emails, addresses, purchase history, payment metadata), so avoid exposing production data to the model unnecessarily.
Reports and customer/subscription tools can surface aggregate revenue and account details; treat that output as sensitive business data.
The API key is provided via a command-line argument or the `PADDLE_API_KEY` environment variable in your MCP client config — keep that config out of version control and restrict access to it.
✓The server calls the Mux API with your credentials; asset metadata, live-stream details, and Mux Data results it returns are passed to the LLM/MCP client.
Mux Data covers viewer and playback analytics (video views, errors, quality-of-experience metrics), which can include viewer and session information.
Credentials (`MUX_TOKEN_ID`, `MUX_TOKEN_SECRET`, and any signing/webhook secrets) are provided via environment variables in your MCP client config — keep that config out of version control and restrict access to it.
Video assets and analytics can reference real customer-facing content and usage, so avoid exposing a production account's data to the model unnecessarily.
✓The server calls Telnyx APIs with your key; account, phone-number, messaging, and call data it returns is passed to the LLM/MCP client.
Communications data can include phone numbers, message content, and call metadata, which are personal data, so avoid exposing production data to the model unnecessarily.
Requests and the API key are sent to Telnyx's hosted MCP server; review Telnyx's data-handling terms before using real customer data.
The API key lives in your MCP client config (argument or `TELNYX_API_KEY` env var) — keep that config out of version control and restrict access to it.
✓The server calls the Xero API with your credentials; contact, invoice, payment, bank transaction, payroll, and report data it returns is passed to the LLM/MCP client.
Accounting and payroll data includes personal and financial information (customer and employee details, amounts, bank and tax data), so avoid exposing a production organisation's data to the model unnecessarily.
Financial reports (profit and loss, balance sheet, aged payables/receivables, trial balance) reveal aggregate business financials; treat that output as sensitive.
Credentials live in your MCP client config's `env` block — keep that config out of version control and restrict access to it.
Prerequisites
Node.js and npm (the server runs via `npx -y @paddle/paddle-mcp`)
A Paddle Billing account (this server does not support Paddle Classic)
A Paddle API key created under Paddle > Developer tools > Authentication (use a sandbox key to start)
A choice of environment (`sandbox` or `production`) and tool-permission mode (`read-only`, `non-destructive`, or `all`)
Node.js and npm (the server runs via `npx -y @mux/mcp@latest`)
A Mux account and an access token (token ID and secret) from the Mux dashboard
Optional Mux signing/private keys or webhook secret if you use signed playback or webhook features
An MCP-compatible client (Claude Desktop, Cursor, VS Code, Windsurf, etc.)
Node.js and npm (the server runs via `npx -y @telnyx/mcp`)
A Telnyx account and an API key (create one in the Telnyx portal under API Keys)
Outbound HTTPS access, since the package proxies to Telnyx's hosted MCP server at api.telnyx.com
An MCP-compatible client (Claude Desktop, Cursor, VS Code, etc.)
Node.js 18 or newer and npm or pnpm (the server runs via `npx -y @xeroapi/xero-mcp-server@latest`)
A Xero account and organisation (a Demo Company is recommended to start; free trial available)
A Xero developer account with API credentials — a custom connection (client ID/secret) or a bearer token
The OAuth2 scopes your workflow needs (optionally set via `XERO_SCOPES`); Payroll queries require an NZ or UK region