Paddle cut its MCP server to three tools

Here is a sentence I did not expect to write this year: a payments company decided that eighty tools was too many, and deleted them. Paddle — the London merchant of record that acts as the legal reseller for software sold in more than 300 markets — launched its AI Toolkit last Monday, 20 October. The headline is that developers can now set up, test and manage billing from Claude Code, Codex, Cursor and Gemini CLI. The story is in the architecture.

Paddle has run an MCP server since last year, and the 2025 version did what everyone did: one tool per API operation, more than eighty of them, gated by a `tools` flag that defaulted to non-destructive operations. The hosted server Paddle now ships takes a different bet. It exposes exactly three tools — `search`, which looks up API methods by name or description; `execute`, which runs a JavaScript function that chains as many Paddle API calls as the job needs in a single invocation; and `report_missing_tool`, which does not touch your account at all, it tells Paddle what the agent could not do. The documentation calls the pattern codemode and cites the reasoning plainly: agents write code to call APIs better than they call tools, and the cited numbers — 60% faster execution, 68% fewer tokens, 88% fewer round trips — are about token spend, not vibes.

The trust model moved too

When the tool list was the gate, safety was a flag: load only the non-destructive tools and the agent literally cannot break anything. With three tools that reach the whole API, that gate is gone, so Paddle moved the guardrail down a layer — and was unusually honest about how thin it is. Connect to the live endpoint (mcp.paddle.com, OAuth or a live API key) and the agent starts with read access matched to your own role; write access is granted per connection in the dashboard under Connectors > MCPs. Sandbox lives on a separate host, sandbox-mcp.paddle.com, and takes only `pdl_sdbx_` keys, so a live key cannot accidentally fire against test data. Destructive operations carry a `destructiveHint` annotation and the server attaches a warning to the response — and the docs say, in writing, that there is no guarantee an agent will respect it. Their advice is to run your client in ask-permission mode and review every `execute` before it runs. An agent in auto mode, they note, makes its own judgement call.

What the agent can actually do is more than a demo: build a pricing model including regional pricing, investigate a failed payment, process an upgrade, pause or cancellation, configure webhooks and simulate events for testing, and — the one I find quietly remarkable — port a catalogue you verified in sandbox into the live account. Paddle's customer quote is from quso.ai, an AI video platform, which says it ran 150-plus localised pricing experiments with a single Claude prompt and shipped a one-time purchase priced locally in 170 countries in a day. Whether or not you like the unit economics of AI pricing experiments, that is a real workflow, not a keynote slide. Native usage-based billing is the other announcement: prepaid and included usage alongside subscriptions, in private preview early 2027, waitlist open now — the merchant of record chasing the AI companies' billing model rather than the other way round.

What three tools is saying

I have been counting MCP in this notebook. Three directory submissions in a week shipped their own servers — a solo Dane's crypto terminal, a Bulgarian astrology service, a nineteen-tool sales agent — and I assumed MCP was a feature checkbox spreading upward from indie makers. Paddle inverts that reading. A regulated payments company looked at the same protocol, ran it for a year as an eighty-tool mirror of its API, and concluded the right interface is smaller: a search box, a code runtime, and a suggestion box. If codemode holds up, the product surface an agent consumes stops being the API and becomes whatever JavaScript the model writes against it — and the vendor's real job becomes permissions, environments and honest warnings, which is exactly where Paddle put its documentation effort. Watch who else quietly deletes their tool list.