Stripe in Claude Code: the official plugin, the MCP server and the CLI

If you build on Stripe in Claude Code, Stripe now ships three official pieces for it, and they overlap enough to be confusing: a Claude Code plugin, the remote MCP server, and a Stripe CLI that has grown agent-specific commands. This guide sorts out which does what, the setup Stripe itself recommends, and the guardrails worth having before an agent touches a live account.

Everything here was checked against Stripe's agent docs on October 13, 2026. One date matters more than the rest: from October 31, 2026, Stripe's MCP server only accepts OAuth or agent keys. More on that below.

Three pieces, three jobs

The plugin includes the server, so most people want the plugin plus the CLI, and nothing else.

Setup

claude plugin install stripe@claude-plugins-official

npm install -g @stripe/cli@latest
stripe agent setup --client claude-code

claude mcp add --transport http stripe https://mcp.stripe.com/

{
  "mcpServers": {
    "stripe": {
      "type": "http",
      "url": "https://mcp.stripe.com",
      "headers": { "Authorization": "Bearer ${AGENT_API_KEY}" }
    }
  }
}

The plugin is the one Stripe labels as recommended, and it sits in Anthropic's official marketplace with over 60,000 installs as of this writing. Two things it does that are worth knowing before you install it, both visible in its source:

• A session-start hook checks your Stripe CLI (installed, logged in, up to date) and tells Claude how to fix it if not.
• Other hooks report skill usage back to Stripe through the CLI. The CLI's own telemetry also records which coding agent is calling it. Set STRIPE_CLI_TELEMETRY_OPTOUT=1 if you would rather it did not.

Neither is sinister, both are disclosed, and both are the kind of thing you should know about anything that runs on every session.

What changes day to day

The skills are the quiet win. stripe-best-practices tells the agent the current API version (2026-09-30.endive today) and SDK versions, so Claude writes code against the API as it is rather than as it was in its training data. upgrade-stripe walks a version bump, stripe-docs pulls the live reference, and the two commands, /stripe:explain-error and /stripe:test-cards, cover the two things everyone looks up mid-build. A working session looks like this:

• Create a sandbox with stripe sandbox create and put its test keys in .env.local.
• Run stripe listen forwarding to localhost:3000/api/webhooks/stripe and wire the signing secret into the handler.
• Review our webhook handler against Stripe’s best practices and list what you would change.
• Upgrade us to the latest Stripe API version and show me every breaking change that touches our code.
• /stripe:test-cards

Stripe's docs also read well to an agent without any of this: append .md to any docs.stripe.com URL for markdown, and there is an llms.txt for the whole site.

Sandboxes first

The CLI's best agent feature is stripe sandbox create: a sandbox with working test keys, no account needed, expiring after seven days unless you claim it. That is the right default for an agent writing integration code, and Stripe's own skill tells agents to use separate sandboxes for local work and CI rather than the shared test mode.

Two CLI behaviors to keep in mind while the agent drives:

• stripe listen runs against a sandbox by default and needs --live to see live events. Good default; do not let an agent add the flag casually.
• stripe trigger fires real API calls to produce its event, so it creates customers, payments and the rest in whatever environment it points at. In a sandbox, that is the point.

Keys, and October 31

For interactive use, sign in with OAuth (the /mcp step) and grant the environments you want on Stripe's consent screen: live and sandboxes are granted separately, with separate permissions.

For headless runs (CI, scheduled agents) the server takes a key in the Authorization header, read from an environment variable as in the Agent key tab. And here is the change: from October 31, 2026, Stripe's MCP server rejects full secret keys and restricted keys created without the Agent tag. Anything passing one today gets a 401 that day. Create an agent key with only the permissions the job needs, test it in a sandbox, then expire the old key.

Agent keys come with a second benefit: they fall under Stripe's approval rules, which by default hold refunds and subscription cancellations for a person to approve. Combined with the server's own approval step for refunds and outbound payments, an agent can propose moving money but cannot do it alone.

If you still run the old local package, npx @stripe/mcp, know that it is now a thin proxy to the same remote server and its --tools flag is gone. Stripe does not say so outright, but since it forwards to mcp.stripe.com, plan on the same key rule applying to it.

Guardrails worth keeping

• Tool approval on for every Stripe write. Stripe's docs ask for it, and warn that running its server beside others opens the door to prompt injection from one tool's output into another's call.
• Sandbox while building, live only when the task is operational and you are watching.
• An admin switch exists: MCP and CLI access can be turned off for the whole team under Settings, Team and security. Worth knowing before someone asks.

The one job it does not do

Ask the Stripe server what your MRR did last quarter, split by new business, expansion, contraction and churn, and you are asking an API to do subscription analytics. It will try, and the number will be quietly wrong, for reasons we went through in the Stripe MCP server, explained. Stripe's own analytics tool is in preview and runs on Stripe's definitions, for one Stripe account.

That is the gap Kometrics fills in the same terminal: a read-only connector over a movement ledger built from your billing history, so Claude reads finished metrics instead of computing its own. One more line beside the Stripe plugin:

claude mcp add --transport http kometrics https://app.kometrics.com/mcp

codex mcp add kometrics --url https://app.kometrics.com/mcp
codex mcp login kometrics

The two do not overlap. Stripe's tools build and operate; Kometrics explains what the revenue did, and it cannot write anything, so it adds nothing to the guardrails above.

FAQ

Is there an official Stripe plugin for Claude Code?

Yes. Stripe publishes it in Anthropic's official marketplace: claude plugin install stripe@claude-plugins-official. It bundles the Stripe MCP server, ten skills, two slash commands and a research agent.

Do I need the plugin and the MCP server?

No, the plugin includes the server. Add the server alone (claude mcp add --transport http stripe https://mcp.stripe.com/) only if you want the tools without the skills and hooks.

What changes on October 31, 2026?

Stripe's MCP server stops accepting full secret keys and restricted keys without the Agent tag. OAuth sign-ins keep working. Replace any key in a config with a new agent key before then.

Can Claude Code refund a customer through Stripe?

It can prepare one. Refunds and outbound payments return an approval link, and nothing happens until a person approves it. Agent keys add Stripe's approval rules on top.

Can Claude Code tell me my MRR from Stripe?

Not reliably from raw Stripe objects. Use a subscription analytics connector alongside, such as Kometrics, so the agent reads computed metrics instead of improvising them.