Polar MCP uses OAuth. When you connect a client, your browser opens so you can sign in and authorize access to your organization. You never need to copy an API key into your agent.
Connect your agent
Use the production server athttps://mcp.polar.sh/mcp/polar-mcp for your live organization. While building or testing, use the sandbox server at https://mcp.polar.sh/mcp/polar-sandbox and give it a distinct name such as polar-sandbox.
Choose your client and add the appropriate server.
- Cursor
- Claude Code
- ChatGPT
- Claude Desktop
- Codex
- OpenCode
- Other clients
Add the following to Open Cursor’s MCP settings and connect to
.cursor/mcp.json in your project, or to ~/.cursor/mcp.json to make Polar available in every project:polar to complete authorization.How the tools work
Polar exposes more than a hundred API operations. Instead of sending every operation and its input schema to your agent at the start of every conversation, the server gives it a few tools and lets it write short JavaScript snippets to find and call what it needs:1
Search
The agent calls
search to find the operations for its task, such as “find a customer and check their active subscriptions”, and their exact inputs.2
Execute
The agent calls
execute with code that makes the API calls and returns the result.Read-only mode
For agents that should look up data but never change it, add?readonly=true to the server URL, for example https://mcp.polar.sh/mcp/polar-mcp?readonly=true. Only read operations are available, and the agent asks for read-only access when you authorize it.
Telemetry
The server sends one event per tool call to help us improve it: the tool name, whether it succeeded, the error type and status code, the duration, your agent’s name and version when its client reports them, the API operations the call used (for exampleGET /v1/products/{id}) with their status codes, the names of any fields the API rejected (for example body.prices.0.price_amount), and the size of the result. Events from the same account share an identifier, a keyed one-way hash of your user or organization ID, so we can see how a session unfolds. The ID itself, access tokens, tool arguments, results, field values, request and response bodies, and IDs in URLs are never sent.
To opt out, add ?telemetry=false (or 0, no, off) to the server URL, for example https://mcp.polar.sh/mcp/polar-mcp?telemetry=false. It combines with read-only mode: ?readonly=true&telemetry=false. The server still keeps request logs to operate and secure the service, as the Polar API does.
Available operations
Available operations (103)
Available operations (103)

