# mcp.paypal.com: agentic web grade B

Score 41 (coverage 30 + breadth 6 + conformance 5); 4 standards observed across 3 of 9 steps; checked 2026-10-25T22:07:24Z. This grades the agent-facing files published at mcp.paypal.com, not the organisation's products.

## Manifests

| Manifest | Path | Result | Errors | Warnings |
| --- | --- | --- | --- | --- |
| Agentic Resource Discovery | /.well-known/ard.json | absent HTTP 404 |  |  |
| AI Catalog well-known file | /.well-known/ai-catalog.json | absent HTTP 404 |  |  |
| MCP Server Cards (SEP-2127) | /.well-known/mcp.json | errors | $schema missing (required: https://static.modelcontextprotocol.io/schemas/v1/server-card.schema.json); name must be reverse-DNS with exactly one slash, e.g. com.example/weather; version missing | Content-Type is application/json; SEP-2127 says serve application/mcp-server-card+json; pre-final card shape (url/transport/tools); the final SEP-2127 card uses name, version, description and remotes[]; remotes missing: a card with no remotes gives clients nothing to connect to; tools/resources/prompts listed in the card; SEP-2127 excludes primitives (list them live, or under a namespaced _meta key); no Access-Control-Allow-Origin: * (required for browser clients); no ETag; declared MCP endpoint https://mcp.paypal.com/store/{store_id}/rpc is not live (endpoint URL contains unexpanded template variable) |
| Agent2Agent Protocol | /.well-known/agent-card.json | absent HTTP 404 |  |  |
| llms.txt | /llms.txt | absent HTTP 404 |  |  |
| AGENTS.md | /AGENTS.md | absent HTTP 404 |  |  |
| Agent Skills | /.well-known/agent-skills/index.json | absent HTTP 404 |  |  |
| api-catalog: A Well-Known URI and Link Relation to Help Discovery of APIs | /.well-known/api-catalog | absent HTTP 404 |  |  |
| AI Crawler User-Agent Tokens in robots.txt | /robots.txt | absent HTTP 404 |  |  |
| security.txt (RFC 9116) | /.well-known/security.txt | absent HTTP 404 |  |  |
| auth.md | /auth.md | absent HTTP 404 |  |  |
| Open Knowledge Format | /okf/index.md | absent HTTP 404 |  |  |

## Standards observed

- OAuth Protected Resource and Authorization Server Metadata (as used for agent authorization): https://mcp.paypal.com/.well-known/oauth-protected-resource (https://agenticweb.wiki/protocols/oauth-metadata-for-agents/)
- OAuth Client ID Metadata Document: https://mcp.paypal.com/.well-known/oauth-authorization-server (https://agenticweb.wiki/protocols/oauth-cimd/)
- MCP Server Cards (SEP-2127): undefined (https://agenticweb.wiki/protocols/mcp-server-cards/)
- Model Context Protocol: undefined (https://agenticweb.wiki/protocols/mcp/)

## Cheapest next steps

1. llms.txt: one Markdown index file; the most widely read agent-facing file (https://agenticweb.wiki/protocols/llms-txt/)
2. AI Crawler User-Agent Tokens in robots.txt: state what AI crawlers may do in robots.txt you already serve (https://agenticweb.wiki/protocols/ai-crawler-tokens-robots/)
3. Agentic Resource Discovery: a catalog at /.well-known/ard.json lets agents discover your APIs, MCP servers and data in one fetch (https://agenticweb.wiki/protocols/ard/)

Published a manifest or spotted a path we missed? Submit at https://agenticweb.wiki/submit/ or email mailto:info@belgravialabs.com?subject=Manifest%20or%20correction%20for%20mcp.paypal.com.

## Agent pre-flight & practical readiness

Preferred mode: `mcp`. Call the MCP endpoint at https://mcp.paypal.com first. Do not scrape the HTML when a tool can answer.

Fetch: `POST https://mcp.paypal.com` POST a JSON-RPC tools/list, or server/discover on the 2026-07-28 revision, before reading HTML.

Practical readability: exa_parsable no, markdown negotiation no, render `none`, HTML quality `none`.

AI crawler posture: `unspecified` · Assistant access: OpenAI `unspecified`, Anthropic `unspecified`, Google `unspecified`, Perplexity `unspecified`, Exa `unspecified`.

Readiness subscores: reach 0/20, readability 0/30, capabilities 14/35, conformance 5/15, total 19/100, grade D.

## Rubric

+10 per lifecycle step with a standard observed, counting manifests that validate or that the probe rule for the standard recognises (a valid MCP server card counts for MCP; max 90); +3 per observed standard beyond the first two (max 15); conformance +15 (+10 with one manifest) minus 5 per agent-facing manifest with errors, never below 0 (security.txt is reported, not scored). Lifecycle grade: A+ >= 60, A >= 45, B >= 30, C >= 20, D >= 10. Strict 100-point composite (subscores.total_100 / subscores.grade_100): reach_and_policy (20) + readability (30) + capabilities (35) + conformance (15), where A+ >= 80, A >= 65, B >= 45, C >= 28, D >= 15.

JSON: https://agenticweb.wiki/check/mcp.paypal.com/index.json · badge: https://agenticweb.wiki/badge/mcp.paypal.com.svg