Stripe MCP

The 78/100 score is weighted around the failure that matters most for this server: an agent performs a financial action the user did not intend, or repeats an intended operation as a new action. Stripe has unusually strong mitigations, but the remaining failure modes are too consequential to average away.

Stripe MCP is Stripe’s first-party Model Context Protocol server for giving compatible AI agents structured access to Stripe documentation, account data and supported Stripe API operations.

The main hosted endpoint is https://mcp.stripe.com. Stripe also maintains the @stripe/mcp local package as an alternate stdio path.

The central architectural change is that the hosted server no longer needs one MCP tool for every Stripe operation. Instead, the agent can search the Stripe API, fetch a method’s exact parameters, then invoke a general read or write tool.

The current hosted documentation uses a compact high-level tool set. Exact preview availability can change, but the architecture centers on generalized API discovery and execution instead of dozens of endpoint-specific MCP schemas.

Stripe MCP can search Stripe’s API and documentation, retrieve financial and billing objects, create or modify supported resources, analyze Stripe data and help an agent plan Stripe implementations.

The safest high-value workflow is development and support: let the agent search current Stripe documentation, inspect account state and explain what is happening. Write workflows add value when they are permission-scoped and operationally reviewed.

Stripe MCP has strong first-party security controls, but live write access remains consequential. OAuth, Agent API Keys, sandbox separation, revocable sessions, Workbench auditing and human confirmation reduce risk. They do not turn a broad financial write surface into a low-risk capability.

Stripe documents human confirmation for certain sensitive stripe_api_write operations, including refunds and outbound payments. The agent receives an approval URL, the user reviews the action, Stripe issues an approval token, and the agent retries the approved operation. Approval expires after 24 hours.

The important wording is “certain.” Human confirmation is not documented as a universal gate for every state-changing API operation.

OAuth for interactive use

OAuth is the preferred path for interactive clients. The authorization flow can scope access to Stripe accounts and environments, while sessions can be inspected or revoked by users or administrators.

Agent API Keys for autonomous clients

Stripe now directs non-interactive clients toward Agent API Keys. The key should grant only the permissions the agent actually needs and should be stored in an environment variable rather than hard-coded into client configuration.

Connected accounts use a different path

When acting on behalf of a Stripe Connect account, Stripe documents a restricted credential plus the Stripe-Account header rather than ordinary OAuth delegation. The target account therefore becomes an explicit operational boundary.

Broad generic write authority

stripe_api_write is efficient because the model does not need every Stripe write schema in context. The same abstraction means one tool can potentially represent refunds, subscription changes, invoice mutations, Checkout operations, tax updates and other supported modifications.

Permission is not the same as policy

A credential can say an agent may perform refunds. That does not inherently express a business policy such as “one refund, for this exact payment, below $100, once today.” The scan did not find a universal per-agent action-envelope system documented across all writes.

Agent-level retries can duplicate financial work

Stripe API idempotency protects correctly identified retries. An orchestration layer can still create a new logical operation if it loses the original business identity after a timeout and invokes the tool again as a fresh action.

Prompt injection matters more when multiple tools are connected

Stripe objects can contain customer-controlled names, metadata and descriptions. An agent that simultaneously has Stripe write access plus browser, email, Slack or filesystem tools can expose a larger cross-tool attack surface. Stripe explicitly recommends human confirmation and caution when combining MCP servers.

Incomplete data can be dangerous

2026 issue evidence included pagination problems where list calls returned only the first page or ignored pagination parameters. A visibly failed query is easier to detect than a partial result that looks complete, especially in billing audits or financial analysis.

Stripe currently documents direct setup paths for major MCP clients and provides the hosted endpoint for other compatible clients.

Stripe recommends its agent setup flow where supported because it can configure MCP together with Stripe’s agent skills.

npm install -g @stripe/cli@latest
stripe agent setup

Cursor

{
  "mcpServers": {
    "stripe": {
      "url": "https://mcp.stripe.com"
    }
  }
}

Claude Code

claude mcp add --transport http stripe https://mcp.stripe.com/

Codex

codex mcp add stripe --url https://mcp.stripe.com

Other compatible clients

Use the hosted endpoint https://mcp.stripe.com and complete OAuth when the client supports it. For non-interactive clients, store the Agent API Key in an environment variable and keep permissions as narrow as possible.

Verify before live mode

1. Connect to a Stripe sandbox first.
2. Confirm the authenticated account/environment.
3. Run a read-only customer or payment lookup.
4. Verify pagination on a result set large enough to require it.
5. Create a harmless sandbox resource.
6. Test one sensitive action and confirm the external approval flow.
7. Deliberately retry a write and inspect idempotency behavior.
8. Confirm the MCP request and user attribution in Workbench.
9. Only then consider a narrowly scoped live credential.

No. Stripe MCP gives an AI agent access to Stripe APIs, Stripe account resources and Stripe knowledge. Stripe’s Agentic Commerce products solve the separate problem of letting agents participate in commerce using scoped payment credentials and checkout infrastructure.

Shared Payment Tokens can be scoped by seller, time and amount. That makes them more directly aligned with delegated purchasing authority than MCP itself. Stripe MCP can participate in agent-driven financial workflows, but it is not the payment credential or agentic-commerce protocol.

MCPVerdict estimates the current Stripe MCP tool-schema overhead at approximately 3,000–6,000 input tokens per initialized session. The figure is an estimate until a current authenticated tools/list payload is captured and tokenized with the exact target model.

The larger variable is returned data. Customer lists, subscription objects, invoices, documentation results and analytics can add many more tokens than the static tool definitions.

The efficient sequence is:

stripe_api_search → stripe_api_details → stripe_api_read/write

The agent retrieves the operation schema only when it needs it instead of carrying dozens or hundreds of Stripe operation definitions in every request. This is the main reason Stripe MCP scores 90/100 for efficiency.

The table separates two things: the cost of loading an estimated 3K–6K Stripe MCP schema and the cost of a more realistic 40K input + 10K output multi-step sandbox evaluation.

Prices below use standard uncached API rates available on September 27, 2026. They exclude caching, batch discounts, regional uplifts, tool-specific fees, long-context premiums and normal Stripe product/transaction fees.

How the calculation works

Schema load: 3,000–6,000 × model input rate.

Evaluation run: 40,000 × input rate + 10,000 × output rate.

The model bill is usually small compared with the potential operational cost of a bad live action. A mistaken refund, duplicate payment or wrong connected-account mutation can dominate the economic risk even when the AI call costs only cents.

OpenAI GPT-6 rates above use the short-context Standard prices shown on OpenAI’s current API pricing page. GPT-5.6 Sol/Terra/Luna use their current standard rates. Gemini 3.8 Flash uses Google’s introductory rate through December 31, 2026. Provider links are listed in External Sources.

These direct sources support the findings below. Documentation describes supported behavior; issue reports describe individual observations. Neither establishes a universal success rate.

1. Authentication and account scope: Stripe’s MCP documentation covers setup and connected-account access. Connected-account calls require a restricted API key and the Stripe-Account header; OAuth is not supported for that path. Read source ↗
2. Operational audit trail: Stripe’s MCP guide links to Workbench documentation for inspecting MCP tool-call logs. Review the logs alongside the action taken and account used. Read source ↗
3. Official project reference: The former agent-toolkit repository now redirects to Stripe’s ai repository. Use the current official project and MCP documentation when evaluating implementation details. Read source ↗

Historical incident summaries without a verified original source are omitted from this evidence list. Scores and token estimates elsewhere in this profile remain the supplied editorial assessment, not independently reproduced benchmarks.

These are the primary external references used to verify the current Stripe MCP architecture, authentication, client setup, agentic-commerce distinction and model-pricing calculations. Links open in a new tab.