Connects AI agents to the Stripe payment API for querying customers, subscriptions, and payment data. Requires extreme caution due to financial data sensitivity.
Security Rating
69 / 100
Vendor Type
Official (Stripe)
Risk Category
High Risk
Exposed Tools & Function Calls
- create_customer
- list_customers
- create_subscription
- list_subscriptions
- create_refund
- retrieve_balance
- list_charges
Required Permission Scopes
- stripe:read
- stripe:write (for mutations)
- stripe:refunds:write
Vulnerability & Risk Analysis
Unauthorized refund issuance (Critical)
An agent with create_refund access and write permissions can issue refunds to any customer, causing direct financial loss.
Fix: Use Stripe Restricted Keys that explicitly exclude refund capabilities. Require human approval for all financial mutations.
Payment data exfiltration (High)
list_customers and list_charges expose customer PII and payment metadata that could be exfiltrated via prompt injection.
Fix: Use read-only restricted API keys. Implement response filtering to redact PII before returning data to the agent context.