Is the stripe.com MCP server safe?

anlyon.dev has not been able to list its tools, so it has no classes or findings for it yet. It asks for sign-in before listing them. Paste its tools/list output into https://anlyon.dev/scan to check it yourself.

Who publishes the stripe.com MCP server?

stripe.com (domain verified by the MCP Registry).

stripe.com MCP server

com.stripe/mcpstripe.comremotev0.2.4

MCP server integrating with Stripe - tools for customers, products, payments, and more.

No tools shown: it asks for sign-in first

This server lists its tools only to a signed-in client (OAuth). anlyon.dev never signs in or sends credentials, so it cannot read them, and nothing here is a judgement of the server. Already use it? Copy its tools/list from your client and check it here: the same labels, worked out in your browser.

Sign-in required, OAuth metadata published. Remote posture

With Anlyon

Decide which of this server's tools your agent can use.

Anlyon lists the tools and adopts none.
Each tool you adopt gets approvals and receipts.
Your agent never holds the key.

Govern this server →

A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.

Anlyon alternative

Everything your agent needs in Stripe. None of the key.

Anlyon has its own Stripe integration. Every write runs under a limit you set and comes back with a receipt read from the provider.

anlyon.dev does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

See the Stripe integration →

What the stripe.com MCP server can do

The stripe.com MCP server is published by stripe.com, a domain the MCP Registry verified. It asks for sign-in (OAuth) before it lists its tools, and anlyon.dev never signs in, so its tools are not shown.

Scan status: sign-in required

Scopes it asks for: mcp

Last attempt Nov 9, 2026, 19:17 UTC.

Have its tools/list output? Check it yourself.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Sign-in required, OAuth metadata published

Looked at Nov 13, 2026, 11:46 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 401
tools/list served without credentials: no
Tools that change things, listed without credentials: 0
Protocol version: not observed
WWW-Authenticate on 401: yes
resource_metadata in WWW-Authenticate: https://mcp.stripe.com/.well-known/oauth-protected-resource
RFC 9728 protected resource metadata: https://mcp.stripe.com/.well-known/oauth-protected-resource
Authorization servers: https://access.stripe.com/mcp
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: no

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.2.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http stripe https://mcp.stripe.com

claude mcp add --transport http stripe https://mcp.stripe.com

Run in a terminal.

Badge

A badge for your README that links back to this page.

Badge

[![anlyon.dev](https://anlyon.dev/badge/com.stripe/mcp.svg)](https://anlyon.dev/servers/com.stripe/mcp)

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:05 UTC.