Stripe Agent Toolkit

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (default row; tiers are minimums Stripe may exceed) │ $25,000 │ $26,000 High │ $7,500 │ $8,500 Medium │ $2,500 │ $3,125 Low │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 35 % Injection 25 % Code execution 20 % Info disclosure 15 % Latest advisories Loading the feed Overview The Stripe Agent Toolkit is the sanctioned way to give an LLM agent the ability to move money through Stripe, and it ships adapters for LangChain, CrewAI, the Vercel AI SDK, the OpenAI Agents SDK and MCP. Its 1.7k GitHub stars badly understate what it is: every deployment is by definition an agent holding payment credentials, so the blast radius of a tool-authorisation or parameter-confusion bug here is financial rather than informational. No CVE has been published against either the npm or the PyPI package, which on a component this young means unexamined rather than clean. Stripe pays it on HackerOne, where the toolkit is named by repository URL inside the Stripe SDKs scope and covered again by the broader Stripe Open Source scope; both sit on the program's default bounty row, $500 for a low up to $25,000 for a critical, and the published top bounty of $25,000 confirms that row is genuinely paid rather than aspirational. sorona.xyz adds 1.25× on top of whatever Stripe awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~2 hours First response ~6 days Triage ~10 days Bounty In scope Two structured scopes carry this. The Stripe SDKs asset names the Agent Toolkit outright and gives github.com/stripe/ai as its source, and the separate Stripe Open Source asset covers the open source projects Stripe authors or maintains under github.com/stripe , restricted to non-archived, non-demo and non-sample projects. Both are bounty-eligible at maximum severity critical and both sit on the program's default row stripe/ai in full: the tool definitions and parameter schemas, the authorisation surface that decides which Stripe operations a model may call, credential handling, and the Node and Python packages published from the repository The adapters it ships for LangChain, CrewAI, the Vercel AI SDK, the OpenAI Agents SDK and MCP The Stripe language SDKs generally, covered by the same Stripe SDKs asset and the place the toolkit's calls ultimately land Every other non-archived, non-sample repository Stripe authors or maintains under github.com/stripe , at the same critical maximum severity mcp.stripe.com , Stripe's hosted remote MCP server, a separate URL asset on the same default row and the service form of the toolkit's threat model Out of scope Demo and sample repositories, including the stripe-samples org content that the product scopes link out to Archived repositories, which the Stripe Open Source scope excludes explicitly Forks of upstream projects, unless the reported functionality is one Stripe itself uses Connector state-desync reports that presuppose the attacker already holds a secret key: "Reports that require a secret key as a prerequisite to desynchronize state between a cart/payment and the connector will be closed as Informative" Privy findings, which route to a separate program rather than this one Infrastructure projects such as smokescreen and munkisrv , whose threat model Stripe assesses against its own internal usage rather than against yours Anyone Stripe's sanctions and jurisdiction screening excludes, which is applied before a bounty can be paid Most-valued findings Tool-authorisation bypass where an agent invokes a Stripe operation the integrating application never granted it, the largest bug class here and the one that carries the $25,000 critical row Parameter confusion driven by model-controlled input that changes the amount, currency, destination or customer of a money movement without the caller's intent Code execution in the toolkit or in its MCP transport reachable from data the model can influence, which turns an agent prompt into an execution primitive Credential handling that exposes the Stripe API key to the model, to logs, or to another tenant sharing the same agent process An authorisation decision that survives inside one adapter and is lost in another, since the same tool set is translated into LangChain, CrewAI, the Vercel AI SDK, the OpenAI Agents SDK and MCP Any of the above demonstrated against the toolkit as documented in Stripe's quickstart, rather than against a configuration the reporter had to weaken first Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Stripe's disclosure clause bars private as well as public disclosure to any third party, carries no time limit, and ends "There are no exceptions", so nothing about the report leaves the program without Stripe's prior written approval Only non-archived, non-demo and non-sample repositories under github.com/stripe are eligible, and forks of upstream projects count only where Stripe itself uses the affected functionality Severity is assessed with CVSS 3.0, and Stripe may adjust it up or down based on business impact; the published tiers are minimums that awards can exceed at the team's discretion Reports that require the attacker to already hold a secret key in order to desynchronize state between a cart or payment and the connector are closed as Informative Sanctions and jurisdiction screening applies before Stripe can pay a bounty Program stats 543 Reports resolved $962k Bounties paid 88% Response efficiency Disclosure Coordinated through Stripe on HackerOne, and effectively closed unless Stripe opens it. The program's terms bar disclosing the submission, the findings, the communications with Stripe or anything learned about Stripe to any third party without prior written approval, with no time limit and no exceptions, so there is no clock after which publication becomes safe. sorona.xyz holds your finding until Stripe has resolved it and agreed to any disclosure. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability