Stripe

The material states that no keys or environment variables are required, and it does not explicitly ask the user for additional API keys or local credentials; based on the provided facts, the explicit credential exposure surface is limited. However, because it handles payment and financial operations, account-level authorization should still be reviewed if managed through other mechanisms.

The tool connects to the declared remote endpoint mcp.stripe.com, and its purpose is to call Stripe payment, order, and financial APIs, which implies relevant business data and action requests may be sent to Stripe's official service. There is no evidence here of egress to unknown or unrelated domains.

The system checks indicate that this tool executes code or starts a local process, which is a normal characteristic of MCP tools. The material does not show requests for unusual system privileges or describe dangerous execution behavior beyond its stated function.

The description indicates access primarily to Stripe payment, order, and financial resources, which are typically sensitive business data. The material does not state that it reads or writes local files or accesses unrelated data sources, so there is no clear sign of overbroad access from the provided facts, but Stripe resource scope should still be limited by least privilege.

It comes from a curated platform listing and has an official source, an open-source repository, and about 1.6k community stars, giving it relatively good auditability and trustworthiness; these factors materially reduce supply-chain risk. The license and maintenance status are not clearly stated in the material and should be verified before deployment.