What MCP payments are
MCP payments are payments an AI agent makes by calling a payment tool that a server exposes over the Model Context Protocol. It helps to be precise about what MCP is and is not. MCP is the standard Anthropic introduced in 2024 for connecting a model to tools and data. It is a discovery and invocation layer, not a payment rail. As the practitioners building on it put it, MCP carries discovery and invocation while the payment protocols carry settlement, authorization and identity. So when someone searches for a payment MCP server, what they actually want is a server that publishes payment actions (charge a card, send a stablecoin, issue a refund) as MCP tools an agent can call, with a real settlement protocol doing the money movement behind the tool.
How do AI agents pay through MCP
The flow is the same across every MCP payment server, and it is worth knowing because it shows exactly where control is missing. First, discovery: the agent calls tools/list on the MCP server to see the payment tools available. Second, invocation: the agent calls tools/call with the tool name and arguments, for example a charge amount and a customer. Third, authorization: the settlement protocol takes over, whether that is an EIP-3009 signature for a stablecoin transfer, a scoped card token, or a user-signed mandate. Fourth, settlement: the money moves on the designated rail, on-chain or over card networks, and the tool returns a result. The important thing to notice is that steps one through four verify that a call is well-formed and a credential is valid. Not one of them checks whether this agent, at this moment, was allowed to spend this much.
The production MCP payment servers
Several payment companies now run official MCP servers. Stripe operates a remote MCP server at mcp.stripe.com, which we walk through end to end in our Stripe MCP server guide. Its own docs list 14 MCP tools, including create_refund, get_stripe_account_info, get_balance_summary and documentation search, plus generic stripe_api_read and stripe_api_write tools that reach 60-plus supported API methods across customers, charges, payment intents, invoices, subscriptions, disputes, payouts, Issuing and Treasury. Coinbase ships an x402 MCP example that paywalls a tool by returning HTTP 402: the agent wallet signs a stablecoin authorization and retries the call, and settlement confirms on-chain before the tool result comes back. Coinbase also publishes a Payments MCP installer and an AgentKit MCP extension that turn on-chain actions like USDC transfers and swaps into discoverable tools. PayPal and Shopify both publish official servers as well, with Shopify spanning storefront, admin and agent surfaces. There is also a provider-agnostic open-source layer, PayMCP, for adding a per-call price or a subscription gate to any MCP tool, now with a native x402 mode. We probed all of them in September 2026 and put the endpoints, OAuth scopes and write surface side by side in our comparison of payment MCP servers. The accounting systems shipped servers of their own on the same timeline, and we measured the QuickBooks, NetSuite and Xero MCP servers the same way. The point of listing them is not to recommend one; it is that each one answers how an agent pays, and none answers how much an agent should be trusted to pay.
How payment protocols compose on top of MCP
Because MCP only carries the tool call, a settlement protocol has to ride on top. Four patterns dominate in 2026. With x402, the server returns a 402 inside the tool call and the agent wallet signs a stablecoin transfer to unlock the result, which suits high-frequency machine payments for APIs and compute (a natural fit for metered API access, and the model behind paying per tool call). x402 is no longer a single-vendor experiment either: it now sits under the Linux Foundation, with Coinbase, Cloudflare, Stripe, AWS, Google, Shopify, Visa and Mastercard behind the x402 Foundation. With the Agentic Commerce Protocol, a shared payment token is passed as a tool argument and a card processor authorizes it. With the Universal Commerce Protocol, MCP discovers a capability profile and the checkout journey happens separately. With AP2, a user-signed mandate is attached to the tool arguments for non-repudiation. Stripe and Tempo also shipped the Machine Payments Protocol, whose session model lets an agent pre-authorize a spending limit and stream micropayments. These are complements to MCP, not replacements for it.
The spend-control gap MCP payments leave open
Here is the gap every published MCP payments guide skips. None of them meaningfully address spend limits, approval workflows, per-agent budgets, velocity caps or what happens when a wallet or key is compromised. The best current advice is to hand agents a restricted API key rather than a full one, and that advice is correct. Stripe says as much in its own MCP docs: use restricted API keys to limit an agent to exactly the functionality it requires, keep those keys in a secrets vault rather than in code, and enable human confirmation of tools, because chaining several MCP servers together opens the door to prompt injection. A restricted key does limit which tools an agent can call and which resources it can touch. But scope is not a budget. A restricted key that can create charges can create a charge for one dollar or ten thousand dollars, and can do it once or five hundred times in a loop. The MCP server will faithfully execute every well-formed call. So a protocol-compliant, correctly authorized MCP payment can still be a purchase you never wanted, made by an agent that retried a failed call, misread a quantity, or was steered by prompt injection.
As of August 2026 the same gap is visible inside a hyperscaler product, which makes it easier to point at. Amazon Bedrock AgentCore Payments went generally available on 18 August and settles x402 and MPP charges from a stablecoin wallet, and its entire spend policy is one optional per-session amount in USD that resets every time a session is opened. Our page on AWS AgentCore spend controls measures that surface property by property.
How Agentspay governs MCP agent spend
Agentspay is the rail-neutral control plane that sits in front of whichever MCP payment server and settlement protocol moves the money. Instead of handing an agent a restricted key that can spend without a ceiling, you give each agent its own funded wallet with hard limits. Every intended payment is checked against policy before a credential exists: per-transaction ceiling, budget over a window, merchant or counterparty allowlist, velocity rules. Spend above your threshold pauses for a human approval instead of going through. What the agent receives is a scoped virtual card or delegated credential valid for that one purchase, and every call lands in an immutable audit trail tied to the agent, its human owner, the intent and the policy that allowed it. Keep Stripe, x402 or a card token for settlement, and add one place that never lets a tool call move money without policy.