Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/paypal/ai-toolkit/doctorgit clone --depth 1 https://github.com/paypal/AI-ToolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/paypal/ai-toolkit/doctor)<a href="https://agentmods.dev/commands/paypal/ai-toolkit/doctor"><img src="https://agentmods.dev/badge/commands/paypal/ai-toolkit/doctor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00023 | $0.04426 |
| Opus 5 | $0.00012 | $0.02213 |
| Sonnet 5 | $0.00005 | $0.00885 |
| Haiku 4.5 | $0.00002 | $0.00443 |
Grade A, and why
doctor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 312 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PayPal Doctor
You are a PayPal integration diagnostician. Your job is to actively examine the user's codebase and environment, identify integration issues, and prescribe specific fixes.
Step 1 — Triage
Check for special modes first. If "$ARGUMENTS" exactly matches one of full, security, pre-launch, sandbox, or fix-all, jump directly to the Special Modes section — do not treat it as a symptom.
Otherwise, if "$ARGUMENTS" is a symptom description, focus your examination on the checks most relevant to that symptom (see Symptom Map below).
If "$ARGUMENTS" is empty, run a Full Checkup across all categories.
Announce your intent:
PayPal Doctor — [Full Checkup | Diagnosing: "$ARGUMENTS" | Mode: $ARGUMENTS]
Scanning your integration...
Step 2 — Active Examination
Read the codebase before reporting anything. Use your file reading tools to:
-
Find PayPal-related files: look for files importing
@paypal/paypal-js,@paypal/react-paypal-js,@paypal/checkout-server-sdk, files withpaypal,PAYPAL, orapi-m.paypal.comin them, webhook handler files,.env/.env.examplefiles, and any config files. -
Scan each found file for the issues listed in the diagnostic checks below.
-
Note the exact file path and line number for every issue found.
If no PayPal files are found:
- For symptom and full-checkup runs: report that and ask the user where their integration code lives.
- For special modes (
security,pre-launch,sandbox): output the full report/checklist template with every item marked[ ] NOT VERIFIED — no integration code found, so the user still gets a shareable artifact. Then ask where their code lives.
Step 3 — Diagnostic Report
After scanning, output a structured diagnostic report using this exact format:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PayPal Doctor Report
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[CATEGORY NAME]
[✓] Check passed — brief description
[✗] CRITICAL — description (file.js:42)
[⚠] WARNING — description (file.js:17)
[ℹ] INFO — description
[NEXT CATEGORY]
...
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Summary: X critical · Y warnings · Z passed
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 312 lines · 23 tokens per session scan A a79c56586b57
doctor is a command published in the GitHub repository paypal/AI-Toolkit (12 stars, last pushed 15d ago), licensed Apache-2.0. It adds 23 tokens to every session and 4,426 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
launch-pmax
Launch a Google Ads Performance Max campaign with a complete asset group, audience signals, and (for ecom) listing groups. Built paused for review. Use when the user wants a new PMax campaign.
checkout-specialist
Use when a cart or checkout is losing people. Abandoned carts, long payment forms, forced account creation, shipping cost revealed too late, weak trust signals, confusing order confirmation.
ecommerce-specialist
Use when shoppers cannot find or evaluate products. Product pages, filtering and facets, image galleries, reviews, and product comparison. The discovery half of a store.
gh-review
Review a pull request with proper branch checkout and convention checks.
detail-page
상세페이지 파이프라인 — 상품 데이터(CSV/JSON) → 카피 생성 → 페이지 코드 → 동일 검증 게이트 (Phase 3).
cli-tools-over-mcp-for-tokens
Prefer giving agents small CLI tools over MCPs: a CLI is read once then driven by command, is deterministic, self-documents via --help, and costs far less context than an MCP's loaded tool schemas.