Stripe MCP Server: What It Is, Its Tools, and How to Use It Safely

Short answer: The Stripe MCP server is a remote Model Context Protocol server at mcp.stripe.com that exposes your Stripe account to an AI agent as callable tools. Stripe's docs list 14 MCP tools, including create_refund, get_stripe_account_info, get_balance_summary and documentation search, plus generic stripe_api_read and stripe_api_write tools that reach more than 60 supported API methods. You connect it in one line in Claude Code, Cursor or VS Code, and you authenticate with OAuth or a restricted API key. What it does not include is a spending limit, so an agent with write access can issue a refund for one dollar or ten thousand, and repeat.

Last updated July 2026.

What is the Stripe MCP server?

The Stripe MCP server is Stripe's official implementation of the Model Context Protocol, the standard for connecting a model to tools and data. It runs remotely at https://mcp.stripe.com, so there is nothing to host yourself. Once an MCP client is pointed at it, the model can list the tools it offers, call them with arguments, and read the results back into its context.

In practice that turns questions into API calls. Ask an agent connected to the server how much revenue came in last week, and it calls a read tool against your balance transactions instead of you opening the Dashboard. Ask it to refund an order, and it calls create_refund. That is the appeal, and also the reason it deserves care: this is a production payments account behind a natural-language interface.

Stripe MCP server tools

The toolset splits into three groups. There are four generic API tools that do most of the heavy lifting, a handful of purpose-built tools, and a set of documentation and support tools that help an agent write correct Stripe code.

The split matters more than the count. Most published tool lists fixate on the named tools, but stripe_api_write is the one that changes your risk profile: it is a general-purpose write path into the Stripe API, and the permissions on your key, not the tool name, decide how far it reaches.

How do I use the Stripe MCP server?

Connecting takes one command or a few lines of JSON, depending on the client. In Claude Code, add it over HTTP transport:

claude mcp add --transport http stripe https://mcp.stripe.com/

Then run /mcp in the session to authenticate and confirm the tools loaded. In Cursor, add the server to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "stripe": { "url": "https://mcp.stripe.com" }
  }
}

In VS Code, the same thing goes in .vscode/mcp.json with an explicit transport type:

{
  "servers": {
    "stripe": { "type": "http", "url": "https://mcp.stripe.com" }
  }
}

Sessions are scoped to one account and one environment, so a sandbox connection and a live connection are separate. Start in sandbox. An agent that has only ever been tested against test-mode data will still happily call the same write tools against live money the moment you switch the key.

OAuth or a restricted API key?

Stripe supports two ways in, and the right choice depends on whether a human is in the loop. OAuth is the recommended path for interactive clients: you consent in a browser, permissions are granular and user-based, and an admin can revoke the session from Dashboard settings later. For an autonomous agent or a custom client that cannot complete a browser consent flow, you pass a key as a bearer token instead.

If you go the key route, Stripe is direct about how: use a restricted API key that limits the agent to exactly the functionality it requires, and supply it through a secrets vault or environment variable rather than embedding it in code. A refund-only agent should hold a key that can call refunds and nothing else. Connect platforms acting as their connected accounts cannot use OAuth at all and must use restricted keys with the right Connect permissions, plus the Stripe-Account header.

One more piece of Stripe's own guidance is worth repeating because it is the failure mode people actually hit: enable human confirmation of tools, and be careful when running the Stripe MCP server alongside other MCP servers, because that combination opens the door to prompt injection. An agent reading a support ticket, a web page, or a vendor invoice is reading attacker-controllable text, and that text sits in the same context as a live refund tool. We wrote about how that plays out in prompt injection and agent spend.

Is the Stripe MCP server safe to give an AI agent?

Safe is the wrong axis. The server itself is a well-built, officially maintained piece of infrastructure with sensible auth. The question is what you have handed the model, and the answer is two things people tend to underrate.

First, read tools pull real customer data into the model's context: names, emails, transaction history, dispute details. Whatever your data-handling posture is, connecting a payments account to a model has to fit inside it. Scope the key so an agent that only needs revenue totals cannot enumerate customers.

Second, write tools move real money. create_refund and stripe_api_write are not simulations. This is the part where a restricted key stops helping, because a restricted key answers which endpoints, never how much or how often. A key scoped to refunds will approve a five-dollar refund and a fifty-thousand-dollar refund with equal enthusiasm, and will do it five hundred times if a retry loop asks it to. Bounding that is what a governed refund agent looks like.

The control the MCP layer does not give you

This gap is not specific to Stripe. It is structural to how agent payments are built right now. MCP carries discovery and invocation; a payment protocol carries settlement and authorization. Neither layer carries the spending decision. We mapped the whole stack, including Coinbase x402, PayPal, Shopify and the open-source PayMCP layer, in our guide to MCP payments and how agents pay through MCP servers, and the same hole shows up in every one of them.

What closes it is a policy layer that runs before a credential exists. Concretely, that means four things. Each agent gets its own funded wallet with a hard ceiling, so no single agent can reach past its own balance. Every intended payment is checked against spend controls at request time: a per-transaction limit, a budget over a rolling window, a counterparty allowlist, and velocity rules that catch a loop before it becomes an incident. Spend above a threshold you choose pauses for a human approval instead of going through. And every decision, allowed or blocked, lands in an audit trail tied to the agent, its human owner, the intent, and the policy that ruled on it.

That layer is deliberately rail-neutral. Keep Stripe for settlement, keep the MCP server as the interface, keep your restricted keys. If the agent is issuing scoped cards rather than charging your account, the same logic applies, which we cover in Stripe Issuing for agents. The point is that something has to answer should this payment happen, and no MCP server is built to answer it.

When the Stripe MCP server is the wrong tool

Two cases come up often enough to name. If you are metering your own API and want agents to pay per call, the Stripe MCP server is not the mechanism; you want a paywalled tool that returns HTTP 402, which is the pattern behind paying per tool call. And if what you actually want is an agent that answers questions across every internal system rather than just Stripe, connect a payments server for payments and use enterprise search across your internal tools for the answers. Pointing a write-capable payments tool at a general question-answering workflow is how accidents happen.

Frequently asked questions

Does Stripe have an MCP server?

Yes. Stripe runs an official remote MCP server at https://mcp.stripe.com. It is hosted by Stripe rather than self-hosted, and it works with any MCP client, including Claude Code, Cursor and VS Code. Authentication is over OAuth for interactive use or a restricted API key passed as a bearer token for autonomous agents.

How many tools does the Stripe MCP server have?

Stripe's documentation lists 14 MCP tools. Four of them are generic API tools (stripe_api_search, stripe_api_details, stripe_api_read, stripe_api_write) that together reach more than 60 supported Stripe API methods, so the effective surface is much larger than the tool count suggests. The rest cover refunds, account info, balance summary, resource lookup, documentation search and implementation planning.

Is the Stripe MCP server free?

There is no separate charge for the MCP server itself. You pay normal Stripe processing fees on whatever transactions happen through it, exactly as you would through the API or Dashboard. The real cost to watch is not the server, it is an agent making payments or refunds you did not intend, which is a spend-governance problem rather than a pricing one.

Can an AI agent make payments through the Stripe MCP server?

Yes, within the permissions of the key it holds. Through stripe_api_write and create_refund, an agent can create payment intents, finalize invoices and issue refunds against a live account. Nothing in the MCP layer enforces a per-agent budget, an approval step or a velocity cap, so those controls have to come from a policy layer in front of the payment call.