Stripe MCP Server: Setup and Security (Oct 2026)

The Stripe MCP server is Stripe's official hosted server at https://mcp.stripe.com. It signs in with OAuth by default. It lets an agent read and write Stripe data (customers, payments, invoices, subscriptions, refunds) and search Stripe's docs. TrustedMCP grades it A.

Because it touches money, it has the highest blast radius of any server in the payments category. The setup is short. The security part is worth reading twice.

What it connects

• API tools: stripe_api_search and stripe_api_details find API methods. stripe_api_read runs any supported GET call. stripe_api_write runs POST, PATCH, PUT and DELETE calls, so it can create customers, invoices, subscriptions, coupons and refunds.
• Treasury tools (public preview): send_money, transfer_money, convert_currency, setup_recipient and get_balance_summary.
• Other tools: account info, analytics, documentation search, and an implementation planner.
• It runs remotely over HTTPS. There is nothing to install and no local process.

Setup

Stripe's recommended path is its CLI, which detects your agents and configures them for you: npm install -g @stripe/cli@latest, then stripe agent setup. To set it up by hand, use the snippets below. They are copied from Stripe's MCP docs.

Claude Code:

claude mcp add --transport http stripe https://mcp.stripe.com/

Then start Claude Code and run /mcp to sign in with OAuth.

Cursor, in ~/.cursor/mcp.json:

{ "mcpServers": { "stripe": { "url": "https://mcp.stripe.com" } } }

VS Code, in .vscode/mcp.json:

{ "servers": { "stripe": { "type": "http", "url": "https://mcp.stripe.com" } } }

On first use, the client opens Stripe's consent page. You pick one or more live accounts or sandboxes and set permissions for each one. No key goes in the config file.

Headless agents. If a client can't do OAuth, use an agent API key with only the permissions it needs. Keep it in an environment variable, not in the file. For Claude Code, Stripe's example for a project .mcp.json is:

{
  "mcpServers": {
    "stripe": {
      "type": "http",
      "url": "https://mcp.stripe.com",
      "headers": { "Authorization": "Bearer ${AGENT_API_KEY}" }
    }
  }
}

AGENT_API_KEY is a placeholder for the name of your own variable. Set it in your shell before you start Claude Code.

Security notes

A payments server can lose real money in one bad call. Stripe has built in more guard rails than most servers. You still need to use them.

• Start in a sandbox. OAuth lets you grant a sandbox and leave live mode out. Try your workflows there first.
• Give each environment its own permissions. You set them per account or sandbox on the consent page. Grant the least the agent needs.
• Revoke what you don't use. Your connected clients are listed under OAuth sessions in your Stripe user settings. Admins can revoke other users' sessions under Team and security.
• Admins can turn MCP off. A Dashboard setting enables or disables MCP access for the whole team, separately for live mode and sandboxes. If you don't want agents in live mode, switch it off there.
• Know what needs a human. Stripe asks for human confirmation before "certain" stripe_api_write actions, such as refunds and outbound payments. The agent gives you a link. You review and approve, then tell the agent to retry. Unapproved requests expire after 24 hours. Stripe does not list every action that is covered, so don't treat this as a full safety net.
• The write tool is wide. One generic stripe_api_write tool reaches much of the API, and the Treasury preview tools can send and transfer money. Scope permissions so they can't be used where you don't need them.
• Keep tool approval on. Stripe tells you to turn on your client's tool-approval setting so you see each call before it runs.
• Watch for prompt injection. Stripe warns about using its server next to other MCP servers. A web page, email or ticket read by another tool can carry instructions aimed at your Stripe tools.

Key change on 30 November 2026. From December, mcp.stripe.com will stop accepting full-access secret keys and restricted keys without the Agent tag. Those requests will get a 401. If you use a key today, create a new agent API key or switch to OAuth before the deadline. Test the new setup in a sandbox, then expire the old key.

For a general checklist, see is this MCP server safe? and MCP security best practices.

Why it grades A

TrustedMCP scores four things (how we score):

• Authentication: 30 of 30. OAuth is the default. Sessions are scoped per environment and you can revoke them.
• Known CVEs: 25 of 25. No reported vulnerabilities.
• Transport: 20 of 20. Hosted over HTTPS, with no local command to run.
• Maintenance: 18 of 25. This is the only deduction. The hosted server is closed source, so we can't see how often it changes. The public package was last changed in April 2026.

Full breakdown on the Stripe MCP listing.

Frequently asked questions

How do I set up the Stripe MCP server?

Run stripe agent setup from the Stripe CLI, or add https://mcp.stripe.com to your client with one of the snippets above. Then sign in through Stripe's OAuth page and pick the accounts or sandboxes to allow.

Should I use OAuth or a restricted key?

Use OAuth for any client you use yourself. It needs no key and you can revoke it from the Dashboard. Use an agent API key only for headless agents that can't do OAuth. Older full-access secret keys and untagged restricted keys stop working after 30 November 2026.

Can I use it in test mode?

Yes. On the consent page, grant a sandbox instead of a live account. Admins can also disable live-mode MCP access for the whole team.

Why do I get a 401 or a permission error?

A 401 usually means the key isn't accepted. From December 2026 that includes full-access secret keys and restricted keys without the Agent tag. Reconnect with OAuth or use a new agent API key. A permission error means the session or key wasn't granted that action. Add only the permission you need. On a managed work network, IT may also need to allow mcp.stripe.com.

Can the Stripe MCP refund or move money?

Yes. stripe_api_write can create refunds, and the Treasury preview tools can send and transfer money. Stripe asks a human to approve some writes, like refunds and outbound payments, but limit permissions too.

How much context does it use?

Less than you might expect. Stripe routes most of the API through a few generic tools instead of one tool per endpoint, to keep the context window small. See why MCP servers eat your context window to measure it in your own client.