Stripe and AI: Is there an MCP server for Stripe?

Stripe is a payment provider. Companies use it to accept card and other payments, issue invoices and manage subscriptions. If you want an AI assistant such as Claude or ChatGPT to work with payment data, the first questions are: is there an MCP server, and what may it do?

In short

Yes. Stripe runs an official MCP server at https://mcp.stripe.com. It reads and writes. With write access, an assistant can trigger refunds in a live account and, through the Treasury tools in public preview, send money. For some of these actions, Stripe can require confirmation in the Dashboard. Start with a sandbox and read-only permissions.

What Stripe offers itself

The hosted MCP server. According to Stripe, it offers tools for the Stripe API and for searching documentation and support articles. Stripe gives setup steps for Claude Code, Claude Desktop, ChatGPT, Codex, Cursor and VS Code. For Claude, Stripe names an “official Stripe connector”; for ChatGPT, an “official Stripe plugin”. On Claude Team and Enterprise accounts, according to Stripe, an owner must first add the connector to the workspace. We found no plan restriction in the MCP documentation. Stripe labels the MCP page as public preview. Some tools also carry a preview label. According to the Stripe newsroom, Anthropic integrated the Stripe MCP server into Claude Duet on 21 October 2026 (research preview).

The tools. Four general API tools search, describe, read (GET) and write (POST, PATCH, PUT, DELETE). Others cover account info, documentation search, an implementation planner, Atlas (preparing an application for a Delaware company; you review, pay and submit in the Dashboard) and stripe_analytics (preview). The list of supported API methods includes customers, payments, invoices, subscriptions, coupons, payment links, webhooks, tax settings and disputes.

Two ways to sign in. With OAuth, the client acts for a Stripe user. With an agent API key, an AI application gets its own, persistent access. The server publishes its OAuth metadata under /.well-known. Stripe writes: from December 2026, the MCP server no longer accepts full-access secret keys or restricted API keys without the Agent tag. Replace them with agent API keys or use OAuth by 30 November 2026.

A local server. The @stripe/mcp package in the Stripe repository starts locally with npx. It needs a Stripe key. According to the README, a Restricted API Key controls the tool permissions. The code forwards all requests to https://mcp.stripe.com and sends the key as a bearer token. It checks only for the prefix sk_ or rk_. In our reading, Stripe’s change in December therefore applies to it too; Stripe does not say so explicitly. The same repository holds the Agent Toolkit (@stripe/agent-toolkit) for agent frameworks such as LangChain and the Vercel AI SDK. According to its README, it also supports MCP.

AI in the product. According to Stripe, the Dashboard assistant answers questions about documentation and payment performance and acts in the Dashboard on your behalf; you confirm the action. According to Stripe, the Radar Assistant builds fraud rules from a text prompt. If you use it, you agree that Stripe may log your entries and use them for training. According to Stripe, custom rules exist only if your Radar plan supports them. According to Stripe, the Sigma Assistant builds reports from a question. In its notice on AI, Stripe writes: you are responsible for all actions you instruct or permit the AI service to take.

What the community and platforms offer

The Insightful Pipe server is hosted by InsightfulPipe, according to its README, and you sign in there. The repository contains only a README. According to the README, it only reads (41 read actions, 0 write). In our assessment, your Stripe data then passes through InsightfulPipe; the README does not say so explicitly. Zapier offers its own Stripe MCP endpoint with actions such as “Create Payment”. Other providers list their own Stripe connections: Composio says it supports Stripe MCP and direct API integrations. Lemonado offers its own MCP server, where you sign in to Lemonado with OAuth. n8n offers Stripe actions in workflows and names no MCP server there. None of these pages shows how the provider handles your data.

Permissions, approvals and test mode

• Refunds and money movement. According to Stripe, “Create refund” appears in the method list with the label “Human confirmation”. The Treasury tools send_money, transfer_money and convert_currency carry it too. Stripe writes: confirmation depends on the action, not the tool name, and your account’s rules can cover more actions. You confirm through a link in the Dashboard. The request expires after 24 hours. For the Treasury tools, Stripe writes: by default, you must approve any action that moves live money. Where Treasury is available is listed on a separate Stripe page. According to the Stripe newsroom (21 October 2026), Fifth Third Bank provides the checking accounts. We found no statement on whether Treasury for agents is available in Austria.
• Two-party approval. According to Stripe, agent-tagged keys get default rules for refunds, subscription cancellations, payouts, outbound payments and transfers, and currency conversions. You can change or delete these rules.
• Live and sandbox. With OAuth, you choose live accounts and sandboxes and set permissions for each environment. Administrators switch MCP access on or off separately for live and sandbox. According to Stripe, card networks and payment providers do not process sandbox payments.
• Sessions. You revoke OAuth sessions in your user settings. Administrators can view and revoke other users’ sessions.

What this means for your company

A payment account is a risky place for write access. This is our assessment, based on Stripe’s documentation:

• Through stripe_api_write, the server creates and changes invoices, subscriptions, prices and payment links. It cancels subscriptions, deletes coupons and creates webhook endpoints. A mistake by the assistant takes effect at once for customers and bookkeeping.
• A webhook endpoint forwards event data to an address. An assistant with write access can create a new endpoint and send that data to the wrong recipient.
• Stripe warns about prompt injection when you use the server together with other MCP servers. Text in an email or web page can push the assistant into actions.
• Stripe advises turning on tool-call approval in your MCP client. Do so, and read each call before you confirm it.
• Start with a sandbox. In live mode, grant read permissions only until you have set up approval rules in Stripe.
• Give keys only the permissions the assistant needs, and rotate them. According to Stripe, you can see tool calls in Workbench under “MCP tool calls”.
• According to the Stripe Services Agreement (section 1.7), you are solely responsible for each action an AI agent starts in your Stripe account, and those actions legally bind you.
• What reaches the AI assistant falls under its terms, no longer under Stripe’s.