What it is
Stripe hosts its MCP server at https://mcp.stripe.com. Interactive clients sign in with OAuth and can be granted specific live accounts or sandboxes, each with its own permissions. Autonomous clients use an agent API key as a bearer token. From December 2026 the server stops accepting full secret keys and restricted keys without the Agent tag; affected requests get a 401. Running npm install -g @stripe/cli and stripe agent setup configures supported agents and installs Stripe's skills.
Four API tools do most of the work: stripe_api_search and stripe_api_details find methods, and stripe_api_read and stripe_api_write call any supported GET or write method, from customers and invoices to disputes, payouts and tax. Other tools search the docs, plan integrations, query analytics (preview) and move Treasury money (public preview).
Stripe asks a human to approve some writes, such as refunds and outbound payments, through a link that expires after 24 hours. Admins can switch MCP access on or off separately for live mode and sandboxes, and revoke any user's sessions.
Install
https://mcp.stripe.comOur review
Stripe's server is a model for exposing a sensitive API to agents. OAuth consent can cover one account or several, with different permissions in live mode and sandboxes. Admins can turn MCP off for live mode while leaving sandboxes on, revoke sessions per user, and see tool calls in Workbench. Refunds and outbound payments stop for a human to approve through a link, and the approval expires after 24 hours.
The tool design is the other achievement. Rather than one tool per endpoint, stripe_api_read and stripe_api_write cover a long list of supported methods, so the model sees 15 tool definitions instead of hundreds. The list is curated, not the whole API: subscriptions, invoices, prices, disputes, payouts, tax registrations and Issuing reads are in, while each Treasury tool is still in public preview and the analytics tool's SQL builder requires Sigma.
The key deadline is close. Any client still using a full secret key or an untagged restricted key must move to an agent key or OAuth by 30 November 2026. The local npx @stripe/mcp package (0.3.3) is, per its source, a stdio proxy to mcp.stripe.com, so it is affected too. Connect platforms cannot use OAuth for connected accounts at all; they need a platform agent key and a Stripe-Account header per call.
Agent traffic shares the account's ordinary rate limits: 100 requests a second in live mode and 25 in a sandbox, with most individual endpoints capped at 25. A support agent will not approach that, but an agent running alongside a busy checkout competes for the same budget. Stripe's own docs still tell you to keep tool approval on in your client, because another server's output could inject instructions that reach stripe_api_write.
Where it earns its place
A support lead at a SaaS company handling 400 billing tickets a month
Look up a customer's invoices and issue refunds without handing out Dashboard access
Agents in Claude connect with OAuth limited to live-mode reads plus refunds. Each refund pauses for a human to approve via Stripe's link, so a misread ticket cannot move money on its own. No extra fee beyond normal Stripe pricing.
A developer adding usage-based billing to a Next.js app
Design and test the products, prices and subscriptions in a sandbox
Uses stripe_implementation_planner and search_stripe_documentation to choose the approach, then stripe_api_write in a sandbox to create test prices and subscriptions. Sandbox traffic is capped at 25 requests a second.
A Connect marketplace platform with 2,000 sellers
Let an internal support agent investigate a seller's failed payout
Authenticates with a platform agent key granted only the connected-account read permissions needed, and passes the seller's account in the Stripe-Account header. OAuth is not available for connected accounts.
Before you commit
- Setup
- Run stripe agent setup, or add https://mcp.stripe.com to Cursor, Claude Code, Codex, VS Code or ChatGPT and complete OAuth. In Claude Team and Enterprise, an owner must add the connector before members can connect.
- Integrations
- 15 named tools: stripe_api_search, stripe_api_details, stripe_api_read, stripe_api_write, get_stripe_account_info, atlas_company_formation, stripe_analytics, five Treasury tools, docs search, the implementation planner and feedback.
- Data and privacy
- Hosted by Stripe; the server can read and write whatever the OAuth grant or agent key permits, in live mode or sandboxes. Refunds and outbound payments need human approval; tool calls are logged in Workbench.
- Cost at scale
- No server fee. Agents share the account's 100 requests a second in live mode (25 in a sandbox) and a 50-request concurrency limit with your production integration; Sigma is a separate paid product.
- Limits
- Only listed API methods are reachable; Treasury tools are public preview; approvals expire after 24 hours and the agent must be told to retry; keys must be migrated by 30 November 2026.
What's good
- OAuth scoped per account and per environment
- Human approval link for refunds and outbound payments
- Four generic API tools keep context small
- Admin kill switch for live mode, session revocation, Workbench logs
What's not
- Full and untagged restricted keys rejected from December 2026
- No OAuth for Connect connected accounts
- Treasury and analytics tools still in preview; SQL needs Sigma
- Supported method list is curated, not the full API
Best for
Stripe users and integration developers who want an agent to look up payments, manage billing or plan an integration under tight controls.
Alternatives
Stripe MCP: common questions
- Is Stripe MCP worth it?
- Stripe has worked out how to let an agent near money: scoped OAuth, dedicated agent keys and a human click before refunds, all behind four compact tools. We rate it 4.6 out of 5.
- How much does Stripe MCP cost?
- No charge for the server; normal Stripe fees apply to payments and products it touches. SQL queries through stripe_analytics need Stripe Sigma.
- What are the downsides of Stripe MCP?
- Full and untagged restricted keys rejected from December 2026; no OAuth for Connect connected accounts; treasury and analytics tools still in preview; SQL needs Sigma; supported method list is curated, not the full API.
- Who is Stripe MCP best for?
- Stripe users and integration developers who want an agent to look up payments, manage billing or plan an integration under tight controls.
- How much does Stripe MCP cost for a team or in production?
- No server fee. Agents share the account's 100 requests a second in live mode (25 in a sandbox) and a 50-request concurrency limit with your production integration; Sigma is a separate paid product.
- Is Stripe MCP safe for company data?
- Hosted by Stripe; the server can read and write whatever the OAuth grant or agent key permits, in live mode or sandboxes. Refunds and outbound payments need human approval; tool calls are logged in Workbench.
- What are the best Stripe MCP alternatives?
- The closest alternatives we have reviewed are PayPal MCP Server, Square MCP Server and Shopify Dev MCP.
Answers checked Oct 22, 2026.
Make Stripe MCP? Show this rating on your site
