Stripe MCP server, with a policy gate.
Give AI agents Stripe access without handing over a restricted key. Gentkey proxies the official Stripe MCP server behind one OAuth-protected URL, gates every write behind an explicit grant, and records every call — allowed or denied — in an audit log.
https://app.gentkey.com/mcpclaude.ai (web & mobile) · Claude Code · Cursor · any MCP clientWhat’s free, what needs a grant.
Reads: Stripe's tools aren't curated into a free-read set yet — with your money on the line, Gentkey doesn't take read/write labels on a vendor's word.
Writes: One explicit grant (mcp-stripe.write) is the switch for the whole connector. It can carry a max-writes-per-hour bound, and revoking it means the next call is denied.
Gentkey proxies the official Stripe MCP server (https://mcp.stripe.com) — you get the vendor’s own tools, with custody, gating, and audit added in front.
| Grant | What it governs |
|---|---|
mcp-stripe.write | Every tool the official Stripe server exposes — refunds, payment links, customer updates, and reads too, until a curated read set lands |
Connect once, use everywhere.
Sign in at gentkey.com, add Stripe (oauth), then point each client at your endpoint. Every client completes a standard OAuth flow and lands in your Gentkey — your connections, nobody else’s.
claude.ai (web & mobile)
- Settings → Connectors
- Add custom connector
- Paste
https://app.gentkey.com/mcpand finish the OAuth prompt
Claude Code
claude mcp add --transport http \
gentkey https://app.gentkey.com/mcpCursor
// .cursor/mcp.json
{
"mcpServers": {
"gentkey": { "url": "https://app.gentkey.com/mcp" }
}
}Things agents do with Stripe here.
- What's my available balance right now?
- Find the customer with email jane@example.com and list their recent charges.
- Create a $49 payment link for the Pro plan.
- Refund the last charge from customer cus_ABC123.
- How much revenue did we process this week?
Custody, gating, and audit — built in.
The model never sees a credential
Your Stripe token is encrypted at rest and injected server-side at call time. Your stored credential never enters a context window.
Writes need a grant
Anything that changes state needs a capability you granted explicitly — revoke it and the next call is denied.
A trail you can act on
Every decision is attributed to the agent that made it — allowed, denied, or denied by constraint.
Fair questions.
Why not just use a Stripe restricted key in each agent?
Restricted keys still sit in plaintext config files on every machine that runs an agent, and Stripe can't tell your agents apart in its logs. Gentkey holds one credential server-side, lets each agent authenticate with OAuth, and attributes every call — so revoking one agent doesn't mean rotating a key everywhere.
What happens when an agent calls a Stripe write tool it hasn't been granted?
The call is denied at the gateway — nothing reaches Stripe — and the denial is recorded in the audit log along with the grant that would have authorized it, so you can decide deliberately instead of finding out later.
Where are my credentials stored?
Encrypted at rest (AES-256-GCM) on Gentkey's server and injected server-side at call time. No credential you store with Gentkey ever enters a model's context window or an agent's config file.
Can I use this from claude.ai's free plan?
Yes — and it's the strongest case for a gateway: free claude.ai accounts currently get a single custom connector, so pointing that one slot at Gentkey puts every connector you've linked behind it.
How do I revoke an agent's access?
Revoke the grant (the next write is denied) or revoke the agent's tokens entirely in one click. Other agents and their grants are untouched — no shared key to rotate.
Is Gentkey affiliated with Stripe?
No. Gentkey is an independent MCP gateway. Trademarks belong to their owners; where an official Stripe MCP server exists, Gentkey proxies it and adds custody, gating, and audit on top.
Often connected together.
Cut Stripe a smaller key.
Sign in, connect Stripe, and grant your first scoped capability in under a minute.