Stripe MCP Server

Stripe's MCP server is the clearest case in this directory for treating tool access as a privileged operation, because the underlying system moves money. The server exposes payments primitives — customers, charges, subscriptions, refunds, products — and also documentation search, which is the genuinely low-risk half of it.

The decisive control is not the server at all; it is which API key it holds. Stripe's restricted keys allow per-resource, per-permission scoping, and test-mode keys operate against an entirely separate data set. An agent connected with a test-mode key is a development convenience with essentially no financial blast radius. The same agent connected with a live secret key is an unattended party with authority over production payments, and the model's judgement is the only thing between an injected instruction and a refund.

Read and write differ more sharply here than anywhere else in this list. Reading customer and transaction data is a privacy exposure — names, emails, partial card details, billing addresses, purchase history — and is subject to the obligations that come with payment data. Writing is a financial and legally consequential action that may be irreversible.

The injection surface is subtle but real: customer-supplied fields such as names, descriptions, and metadata are attacker-controllable text stored inside your payments system. An agent asked to summarise recent transactions reads them.