Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/paypal/ai-toolkit/setupgit clone --depth 1 https://github.com/paypal/AI-ToolkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00017 | $0.02766 |
| Opus 5 | $0.00009 | $0.01383 |
| Sonnet 5 | $0.00003 | $0.00553 |
| Haiku 4.5 | $0.00002 | $0.00277 |
Grade C, and why
setup scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Strips warnings and disclaimersmediumAnti-refusal
Omitting safety caveats hides risk from the user and is a common jailbreak preamble.
- If a sandbox user is seeing exactly 4 tools, they're on OAuth — gently suggest setting the token in `settings.json` to unlock the full toolkit. Do not lecture about scopes; just say "to get the full 31-tool surface, se Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
2. **Is the sandbox token in `~/.claude/settings.json`?** Read the file and check whether the `"env"` block has a non-empty `"PAYPAL_SANDBOX_ACCESS_TOKEN"`. Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -X POST https://api-m.sandbox.paypal.com/v1/oauth2/token \ How it starts
The opening of the file, as written. The whole thing — 249 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PayPal Setup
Walk the user through PayPal plugin configuration for Claude Code. Verify everything works before they use other commands.
Workflow
Step 1: Check MCP Connection
Two checks, sandbox-first:
- Is the sandbox MCP connected? Count tools whose name matches
mcp__paypal-sandbox__*in this session. If any are present, run one lightweight probe (mcp__paypal-sandbox__list_invoiceswithpage_size: 1). Report the tool count from the session. - Is the sandbox token in
~/.claude/settings.json? Read the file and check whether the"env"block has a non-empty"PAYPAL_SANDBOX_ACCESS_TOKEN".
Report
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PayPal Plugin Setup
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[✓] Sandbox MCP — connected (31 tools)
[✓] Sandbox token in settings — set
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
If the MCP isn't connected OR the probe returns an error (401, SSE header invalid, etc.), report needs setup and go to Step 2. If the MCP is connected but tool count looks low (less than 10), note it briefly and proceed to Step 2 to help the user upgrade.
[!] Sandbox MCP — needs setup
[!] Sandbox token in settings — not set
If MCP tools aren't loaded at all (no mcp__paypal-sandbox__* tools in the session and /mcp doesn't list paypal-sandbox): the plugin isn't installed correctly. Fix:
- Marketplace:
/plugin marketplace add paypal/AI-Toolkitthen/plugin install paypal@paypal-ai-toolkit - Local:
claude --plugin-dir /path/to/AI-Toolkit
Internal knowledge for the LLM (do not surface unless asked)
Two auth paths reach the same PayPal hosted gateway, and they produce different tool counts. Keep this in mind when interpreting results, but don't lead with it:
| Server | Auth path | Tools |
|---|---|---|
paypal-sandbox |
Bearer (env var from settings.json) |
31 |
paypal-sandbox |
OAuth (browser flow via /mcp) |
4 (PayPal sandbox scope is intentionally limited) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 249 lines · 17 tokens per session scan C c427b0f4c179
setup is a command published in the GitHub repository paypal/AI-Toolkit (12 stars, last pushed 12d ago), licensed Apache-2.0. It adds 17 tokens to every session and 2,766 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 3 findings (strips warnings and disclaimers, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
group-chat
Create a multi-agent group chat with AG2 using configurable speaker selection patterns.
new-a2a-agent
Scaffold an A2A-compliant AG2 agent with server wiring, card settings, and skill definitions.
workflow-from-spec
Design a complete multi-agent workflow from a natural language description, selecting the right orchestration pattern.
new-tool
Create a tool function for an AG2 agent with type annotations, docstrings, and JSON return contracts.
new-agent
Scaffold a new AG2 ConversableAgent with tool functions, system prompt, and LLM config.
run-plan
Execute a PLAN.md file directly without loading planning skill context.