Stripe

What the Stripe connector does

The Stripe MCP server connects a Stripe account to Claude, ChatGPT and any MCP-compatible agent. It reads customers, invoices, subscriptions, payments and disputes, creates products, prices and payment links, and issues refunds. Sign-in is OAuth. This connector writes, and one of the things it writes takes money out of your balance.

Stripe tools (23)

• search_documentation
• get_stripe_account_info
• create_customer
• list_customers
• create_product
• list_products
• create_price
• list_prices
• create_payment_link
• create_invoice
• list_invoices
• create_invoice_item
• finalize_invoice
• retrieve_balance
• create_refund
• list_payment_intents
• list_subscriptions
• update_subscription
• cancel_subscription
• list_coupons
• create_coupon
• list_disputes
• update_dispute

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

• The connector is in public preview. Stripe badges its MCP documentation page Public preview. That badge appears in the rendered page and is dropped from the Markdown version, so a machine-read of the docs alone would miss it.
• Anthropic's tool list is stale, not merely incomplete. Its 23 names match a version: 0.1.0 manifest in Stripe's repository whose tool array has not been edited since October 2025. Stripe's current documentation lists 11 tools, and only two names appear on both lists. Check your own client's tool list rather than either published one.
• Counting tools does not measure capability. Four of the 11 documented tools are dispatchers. stripe_api_write reaches any POST, PATCH, PUT or DELETE method on Stripe's published allowlist, of which 27 write.
• Stripe's own two descriptions of that allowlist are not identical. The tool table says stripe_api_write writes with any method of those verbs, while the section below it enumerates 115 specific methods. We treated the enumerated list as the boundary, because it is the specific claim, but a reader depending on an endpoint's absence should verify it in their own client.
• A refund cannot be reversed through the connector. Stripe states that only Dashboard cancellations are currently supported for card refunds, and that a refund must not have been processed as a charge reversal to be cancellable at all. The cancel-refund API method is not on the connector's allowlist.
• Refunds are not free and not always immediate. Stripe's processing fees from the original transaction are not returned. If your available balance is short, Stripe holds a card refund as pending and refunds for other payment method types fail.
• finalize_invoice is not a bookkeeping step. Stripe's invoice object defaults collection_method to charging automatically, which Stripe describes as attempting to pay the invoice using the customer's default source. The invoice pay and send endpoints are both absent from the connector's allowlist, but finalising a draft against a customer with a stored payment method can still start a charge.
• create_refund can email your customer. Stripe sends a refund notification when the charge was created on a customer record with a stored email address and refund emails are enabled in the Dashboard.
• One endpoint serves both environments. Test and live share https://mcp.stripe.com. Stripe isolates the objects and gates access per environment, which Razorpay does not document, but two configured connectors still look identical in a client's UI.
• There is no read-only OAuth grant. The authorization server advertises one scope, mcp. Read-only is reachable only by using a restricted API key with per-resource permissions instead of OAuth, which trades a revocable session for a long-lived secret.
• The tool list depends on your credential. Stripe's agent toolkit documents that restricted API key permissions now control which tools are available, so this page's tables cannot predict what your client will show.
• Tool parameters and safety annotations were not readable. The endpoint returned HTTP 401 to an anonymous initialize on 2026-08-18. We read no readOnlyHint or destructiveHint off the wire and make no claim about them. No tool was called and no OAuth flow was started.
• Stripe recommends human confirmation. Its MCP page advises enabling human confirmation of tools and warns about prompt injection when combining the Stripe server with others.
• get_balance_summary is itself a preview. Stripe marks that tool's Treasury row public preview in its own table.

Frequently asked questions

Sources

• Stripe Model Context Protocol documentation, for the endpoint, the 11-row tool table, the 115-method allowlist, the dispatcher rationale, the OAuth flow, session management, the administrator gate, the restricted-key path, the connected-account guidance and the human-confirmation advice (HTTP 200, retrieved 2026-08-18; clean Markdown at , HTTP 200, 20 KB). The "Public preview" badge appears in the HTML rendering only — the Markdown version omits it, so both were read. · retrieved 2026-08-18
• Stripe API keys documentation, for the sandbox-versus-live-mode split, the object isolation between modes and the pk_test_ / rk_test_ / sk_test_ and pk_live_ / rk_live_ / sk_live_ prefixes (HTTP 200, retrieved 2026-08-18) · retrieved 2026-08-18
• Stripe restricted API keys documentation, for the per-resource Read / Write / None permission model, the rk_live_ and rk_test_ prefixes and Stripe's recommendation to prefer restricted keys when giving a key to an AI agent (HTTP 200, retrieved 2026-08-18) · retrieved 2026-08-18
• Stripe sandboxes documentation, for the isolated-test-environment definition and the statement that sandbox payments are not processed by card networks (HTTP 200, retrieved 2026-08-18) · retrieved 2026-08-18
• Stripe refunds documentation, for refunds drawing on the available balance, the unreturned processing fees, the pending-refund behaviour on an insufficient balance, the customer email conditions and the statement that only Dashboard cancellations are currently supported for card refunds (HTTP 200, retrieved 2026-08-18) · retrieved 2026-08-18
• Stripe dispute-update API reference, for the evidence-submission framing (HTTP 200, retrieved 2026-08-18) · retrieved 2026-08-18
• Stripe invoice-creation API reference, for the draft status on creation and the collection_method default of charging automatically using the customer's default source (HTTP 200, retrieved 2026-08-18). The invoice pay and send endpoints were checked against the connector's allowlist and neither appears. · retrieved 2026-08-18
• Stripe rate limits documentation, for 100 req/s live, 25 req/s sandbox, the per-endpoint cap and HTTP 429 (HTTP 200, retrieved 2026-08-18) · retrieved 2026-08-18
• Stripe team roles reference, checked for an MCP-specific permission row. There is none — the MCP gate is a separate Dashboard setting, not a role capability (HTTP 200, retrieved 2026-08-18) · retrieved 2026-08-18
• Stripe API endpoint existence check, for the ten money-moving and destructive methods absent from the connector's allowlist. All ten returned HTTP 200 on 2026-08-18: api/payouts/create, api/transfers/create, api/topups/create, api/charges/create, api/payment_intents/capture, api/payment_intents/cancel, api/disputes/close, api/refunds/cancel, plus customer deletion and payment-intent creation. The absence is a contrast between two lists Stripe publishes, not an inference from tool names. · retrieved 2026-08-18
• Stripe's open-source AI repository, for the stale manifest.json (version: 0.1.0, 23 tools, 22 matching Anthropic's list and one differing by the truncation typo get_stripe_account_in), the proxy implementation of @stripe/mcp 0.3.3 declaring https://mcp.stripe.com and registering no tools, the agent-toolkit migration guide stating that initialisation now connects to the hosted server with no fallback and that restricted-key permissions replaced client-side tool filtering, and the shipped Claude, Cursor and Grok MCP configuration files all naming the bare host (main branch, retrieved 2026-08-18). Reached by following the repository field in the package's own npm registry metadata at , not a guessed repository URL. · retrieved 2026-08-18
• Stripe agents overview and agent skills documentation, used to separate the MCP server from Stripe's separate skills product — and (both HTTP 200, retrieved 2026-08-18) · retrieved 2026-08-18
• Live auth-posture check against https://mcp.stripe.com — an anonymous initialize returned
• RFC 9728 protected-resource descriptor (HTTP 200, 2026-08-18). Names resource: https://mcp.stripe.com and authorization_servers: ["https://access.stripe.com/mcp"]. · retrieved 2026-08-18
• RFC 8414 authorization server metadata (HTTP 200, 2026-08-18). Because the issuer is path-bearing, this RFC-correct path-insert form is the one that resolves; the host-root form and the path-suffix form both returned HTTP 404. It advertises scopes_supported: ["mcp"] — one coarse scope — plus a registration_endpoint, the authorization_code and refresh-token grants, and PKCE. · retrieved 2026-08-18
• docs.stripe.com/robots.txt allows every path used here and carries
• Anthropic Connectors Directory entry, for the 23 tool names, the partner tier, the endpoint, the "Read and write" permission label, the three example prompts and the categories (snapshot dated 2026-08-16) · retrieved 2026-08-16
• Stripe privacy policy — · Support — mcp@stripe.com