Stripe MCP server and Dome

1. 01

   Add live and sandbox connections

   Stripe fixes the mode by the key, so each environment gets its own connection. Use an agent API key with only the permissions the agents need.

   $ dome tools add --name stripe-live \
     --url https://mcp.stripe.com \
     --auth-method api-key --credential-type shared \
     --authorization "Bearer $STRIPE_LIVE_AGENT_KEY" \
     --gateway finance-gateway
    
   $ dome tools add --name stripe-sandbox \
     --url https://mcp.stripe.com \
     --auth-method api-key --credential-type shared \
     --authorization "Bearer $STRIPE_SANDBOX_AGENT_KEY" \
     --gateway finance-gateway

2. 02

   Sync the catalog

   Dome calls Stripe's tools/list with the stored key. A key Stripe rejects fails here, before any agent traffic.

   $ dome tools catalog sync stripe-live

3. 03

   Apply the rule

   Scope it to one agent while you try it. Simulate before you deploy.

   $ dome rules apply stripe-live-read-only.cedar \
     --agent invoice-assistant --name stripe-live-read-only

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Stripe itself, see Stripe's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "stripe-live" ||
  resource.connection_name == "stripe-sandbox"
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "stripe-live" &&
  resource.tool_name == "stripe_api_write"
};