{ "version": 1, "generatedAt": "2026-10-14T13:29:39.392Z", "license": "CC BY 4.0", "source": "https://letsauth.eu/atlas/mcp/servers/stripe/", "spec": { "id": "mcp-authorization", "name": "MCP Authorization", "currentRevision": "2026-07-28", "revisions": [ { "id": "2025-11-25", "date": "2025-11-25", "status": "superseded", "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization", "changes": "Makes OAuth Client ID Metadata Documents the recommended client registration method and adds Enterprise-Managed Authorization (ID-JAG) as an extension.\n" }, { "id": "2026-07-28", "date": "2026-07-28", "status": "current", "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization", "supersedes": "2025-11-25", "changes": "Deprecates Dynamic Client Registration in favour of Client ID Metadata Documents, requires RFC 9207 issuer validation on authorization responses, keys stored client credentials by issuer, requires application_type on DCR requests, and removes session identifiers from the transport. Splits the authorization text into separate pages for discovery, client registration and security considerations.\n" } ] }, "server": { "id": "stripe", "name": "Stripe", "url": "https://mcp.stripe.com/", "homepage": "https://stripe.com", "transport": "streamable-http", "listed": "public-directory", "source": "https://github.com/jaw9c/awesome-remote-mcp-servers", "authClaimed": "oauth2.1", "notes": "The directory lists both OAuth2.1 & API Key for this server; the atlas records the OAuth claim.\n" }, "features": [ { "id": "mcp.as.cimd", "name": "Client ID Metadata Documents supported", "description": "The authorization server accepts an HTTPS URL as client_id and fetches the client's metadata document, advertising client_id_metadata_document_supported: true.\n", "category": "registration", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Client ID Metadata Documents", "level": "SHOULD", "levelNote": "Became the recommended registration method in this revision." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Client Registration › Client ID Metadata Documents", "level": "SHOULD" } ] }, { "id": "mcp.as.dcr", "name": "Dynamic Client Registration offered", "description": "The authorization server exposes a registration_endpoint (RFC 7591) so clients can register themselves at runtime.\n", "category": "registration", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Dynamic Client Registration", "level": "SHOULD" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Client Registration › Dynamic Client Registration", "level": "MAY", "levelNote": "Deprecated; retained for compatibility with clients that cannot use Client ID Metadata Documents." } ] }, { "id": "mcp.as.https", "name": "All endpoints served over HTTPS", "description": "Every authorization server endpoint listed in its metadata uses HTTPS.\n", "category": "transport", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Communication Security", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Communication Security", "level": "MUST" } ] }, { "id": "mcp.as.iss-param", "name": "Issuer identifier in authorization responses", "description": "The authorization server returns the iss parameter on authorization responses (RFC 9207) and advertises authorization_response_iss_parameter_supported: true.\n", "category": "authorization", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Authorization Response Validation", "level": "SHOULD" } ] }, { "id": "mcp.as.issuer-match", "name": "Metadata issuer matches the discovery URL", "description": "The issuer value inside the metadata document equals the issuer identifier used to construct the well-known URL, so clients can detect a substituted document.\n", "category": "discovery", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Authorization Server Metadata Discovery", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Authorization Server Metadata Discovery", "level": "MUST" } ] }, { "id": "mcp.as.metadata", "name": "Authorization server metadata discoverable", "description": "The authorization server publishes metadata via OAuth 2.0 Authorization Server Metadata (RFC 8414) or OpenID Connect Discovery.\n", "category": "discovery", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Authorization Server Metadata Discovery", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Authorization Server Metadata Discovery", "level": "MUST" } ] }, { "id": "mcp.as.pkce-s256", "name": "PKCE with S256 advertised", "description": "The metadata lists code_challenge_methods_supported including S256, which MCP clients require before they will start an authorization flow.\n", "category": "authorization", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Authorization Code Protection", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Authorization Code Protection", "level": "MUST" } ] }, { "id": "mcp.as.preregistration", "name": "Documented pre-registration path", "description": "The provider documents how a client developer obtains pre-registered client credentials when neither CIMD nor DCR is available.\n", "category": "registration", "party": "authorization-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Dynamic Client Registration", "level": "SHOULD", "levelNote": "Pre-registration was the fallback when DCR was unavailable." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Client Registration › Pre-registration", "level": "SHOULD", "levelNote": "Required as a fallback for clients that cannot register dynamically." } ] }, { "id": "mcp.as.refresh-rotation", "name": "Refresh token rotation for public clients", "description": "Refresh tokens issued to public clients are rotated or sender-constrained as OAuth 2.1 requires.\n", "category": "token", "party": "authorization-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Token Theft", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Token Theft", "level": "MUST" } ] }, { "id": "mcp.as.resource-indicator", "name": "Resource indicators honoured", "description": "The authorization server accepts the RFC 8707 resource parameter and binds the audience of issued tokens to the requested MCP server.\n", "category": "token", "party": "authorization-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Token Audience Binding and Validation", "level": "MUST", "levelNote": "Required for the audience binding that the MCP server must enforce." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Token Audience Binding and Validation", "level": "MUST", "levelNote": "Required for the audience binding that the MCP server must enforce." } ] }, { "id": "mcp.prm.authorization-servers", "name": "PRM lists an authorization server", "description": "The authorization_servers field of the PRM document names at least one authorization server issuer.\n", "category": "discovery", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Authorization Server Location", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Authorization Server Location", "level": "MUST" } ] }, { "id": "mcp.prm.no-offline-access", "name": "No offline_access in advertised scopes", "description": "The server does not advertise or request the offline_access scope; refresh-token issuance is left to the authorization server's own policy.\n", "category": "token", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Refresh Tokens", "level": "SHOULD" } ] }, { "id": "mcp.prm.scopes-supported", "name": "PRM lists scopes_supported", "description": "The PRM document advertises the scopes the server understands, so a client can choose an initial scope set before the first request.\n", "category": "discovery", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Flow › Scope Selection Strategy", "level": "MAY" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Scope Selection Strategy", "level": "MAY" } ] }, { "id": "mcp.prm.well-known", "name": "PRM reachable at a well-known URI", "description": "The metadata document is served at the path-aware or root well-known location derived from the MCP server URL, so a client can find it without a prior 401.\n", "category": "discovery", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements", "level": "MUST", "levelNote": "One of two discovery mechanisms the server must offer." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements", "level": "MUST", "levelNote": "One of two discovery mechanisms the server must offer." } ] }, { "id": "mcp.prm.www-authenticate", "name": "resource_metadata in the 401 challenge", "description": "An unauthenticated request receives a 401 whose WWW-Authenticate header carries a resource_metadata parameter pointing at the PRM document.\n", "category": "discovery", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements", "level": "MUST", "levelNote": "One of two discovery mechanisms the server must offer." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements", "level": "MUST", "levelNote": "One of two discovery mechanisms the server must offer." } ] }, { "id": "mcp.prm", "name": "Protected Resource Metadata served", "description": "The MCP server publishes an OAuth 2.0 Protected Resource Metadata document (RFC 9728) that tells clients which authorization servers protect it.\n", "category": "discovery", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Authorization Server Location", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Authorization Server Location", "level": "MUST" } ] }, { "id": "mcp.proxy.consent", "name": "Per-client consent on proxy servers", "description": "An MCP server that acts as a proxy with a static upstream client id obtains the user's consent for each dynamically registered client before forwarding.\n", "category": "consent", "party": "mcp-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Confused Deputy Problem", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Confused Deputy Problem", "level": "MUST" } ] }, { "id": "mcp.rs.401-on-invalid", "name": "401 for missing or invalid tokens", "description": "Requests without a token, or with an invalid or expired one, receive HTTP 401 Unauthorized.\n", "category": "token", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Access Token Usage › Token Handling", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Token Handling", "level": "MUST" } ] }, { "id": "mcp.rs.audience-validation", "name": "Audience validation", "description": "The MCP server rejects tokens that were not issued for it, so a token obtained for another resource cannot be replayed against this server.\n", "category": "token", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Access Token Privilege Restriction", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Access Token Privilege Restriction", "level": "MUST" } ] }, { "id": "mcp.rs.bearer-header", "name": "Bearer token only in the Authorization header", "description": "The MCP server accepts access tokens only in the Authorization: Bearer header and rejects tokens passed in the query string.\n", "category": "token", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Access Token Usage › Token Requirements", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Access Token Usage", "level": "MUST" } ] }, { "id": "mcp.rs.insufficient-scope", "name": "403 insufficient_scope for step-up", "description": "When a valid token lacks a required scope the server answers 403 with error=\"insufficient_scope\" and the scopes needed, enabling step-up authorization.\n", "category": "authorization", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Flow › Scope Challenge Handling", "level": "SHOULD" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Scope Challenge Handling", "level": "SHOULD" } ] }, { "id": "mcp.rs.no-passthrough", "name": "No token passthrough to upstream APIs", "description": "The MCP server never forwards the client's access token to upstream APIs; it obtains its own credentials for downstream calls.\n", "category": "delegation", "party": "mcp-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Access Token Privilege Restriction", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Access Token Privilege Restriction", "level": "MUST" } ] }, { "id": "mcp.rs.scope-challenge", "name": "Scope in the WWW-Authenticate challenge", "description": "The 401 challenge includes a scope parameter naming the scopes a client should request.\n", "category": "authorization", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Flow › Scope Selection Strategy", "level": "SHOULD" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Scope Selection Strategy", "level": "SHOULD" } ] } ], "cells": [ { "server": "stripe", "feature": "mcp.as.issuer-match", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.metadata", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm.authorization-servers", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm.scopes-supported", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm.well-known", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm.www-authenticate", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.cimd", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.dcr", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.preregistration", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.pkce-s256", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.insufficient-scope", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.scope-challenge", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.refresh-rotation", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.resource-indicator", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.401-on-invalid", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.audience-validation", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.bearer-header", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.https", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.no-passthrough", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.proxy.consent", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.issuer-match", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.metadata", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm.authorization-servers", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm.scopes-supported", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm.well-known", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm.www-authenticate", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.cimd", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.dcr", "revision": "2026-07-28", "status": "unknown", "derived": false }, { "server": "stripe", "feature": "mcp.as.preregistration", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.iss-param", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.pkce-s256", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.insufficient-scope", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.scope-challenge", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.refresh-rotation", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.resource-indicator", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.prm.no-offline-access", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.401-on-invalid", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.audience-validation", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.bearer-header", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.as.https", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.rs.no-passthrough", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "stripe", "feature": "mcp.proxy.consent", "revision": "2026-07-28", "status": "unknown", "derived": true } ], "observations": [ { "server": "stripe", "feature": "mcp.as.dcr", "revision": "2026-07-28", "status": "unknown", "method": "vendor-claim", "observedAt": "2026-10-13T00:00:00Z", "observedBy": "jbspeakr", "evidence": "https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as OAuth 2.1 without saying whether Dynamic Client Registration is offered." } ] }