# stripe probes, 2026-09-17T18:06Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.stripe.com/
$ curl -sS -i -m 25 -X POST https://mcp.stripe.com/ -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
server: nginx
date: Thu, 17 Sep 2026 18:06:18 GMT
content-type: application/json
content-length: 81
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-security-policy: base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'; worker-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=oNvkE9DWSqO12WtDiXelPrzdfB6glHmRhqVyVw12EkxSpOAf-GwrnyaKDZPhdARzrEdmsZkY; report-to csp
cross-origin-opener-policy: same-origin; report-to="wsp_coop"
expires: 0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report"}],"include_subdomains":true}, {"group":"wsp_coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report?s=oNvkE9DWSqO12WtDiXelPrzdfB6glHmRhqVyVw12EkxSpOAf-GwrnyaKDZPhdARzrEdmsZkY"}],"include_subdomains":true}, {"group":"wsp_coep","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coep-report?s=oNvkE9DWSqO12WtDiXelPrzdfB6glHmRhqVyVw12EkxSpOAf-GwrnyaKDZPhdARzrEdmsZkY"}],"include_subdomains":true}, {"group":"csp","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/csp-report-v2?q=oNvkE9DWSqO12WtDiXelPrzdfB6glHmRhqVyVw12EkxSpOAf-GwrnyaKDZPhdARzrEdmsZkY&t=1"}],"include_subdomains":true}
reporting-endpoints: coop="https://q.stripe.com/coop-report", wsp_coop="https://q.stripe.com/coop-report?s=oNvkE9DWSqO12WtDiXelPrzdfB6glHmRhqVyVw12EkxSpOAf-GwrnyaKDZPhdARzrEdmsZkY", wsp_coep="https://q.stripe.com/coep-report?s=oNvkE9DWSqO12WtDiXelPrzdfB6glHmRhqVyVw12EkxSpOAf-GwrnyaKDZPhdARzrEdmsZkY", csp="https://q.stripe.com/csp-report-v2?q=oNvkE9DWSqO12WtDiXelPrzdfB6glHmRhqVyVw12EkxSpOAf-GwrnyaKDZPhdARzrEdmsZkY&t=1"
request-id: req_dBU5GvwEPriQ3Y
www-authenticate: Bearer resource_metadata=https://mcp.stripe.com/.well-known/oauth-protected-resource
x-content-type-options: nosniff
x-robots-tag: none
x-stripe-priority-routing-enabled: true
x-stripe-proxy-response: upstream
x-stripe-routing-context-priority-tier: livemode
x-stripe-server-rpc-duration-micros: 8344
x-wc: 3ff
strict-transport-security: max-age=63072000; includeSubDomains; preload

{"error":"Unauthorized. See https://docs.stripe.com/mcp for usage instructions."}

## 2. Protected-resource metadata, GET https://mcp.stripe.com/.well-known/oauth-protected-resource (not named in the challenge; the RFC 9728 default path)
HTTP/1.1 200 Connection Established

HTTP/2 200 
server: nginx
date: Thu, 17 Sep 2026 18:06:18 GMT
content-type: application/json
content-length: 95
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 300
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-security-policy: base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'; worker-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=JX1JtnVim34IHv0s81KwtBx2XxkaIrEs6UKlRrFJlxXICPIdFg7OoUERKYDEcoVDy0oHc1xr; report-to csp
cross-origin-opener-policy: same-origin; report-to="wsp_coop"
expires: 0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report"}],"include_subdomains":true}, {"group":"wsp_coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report?s=JX1JtnVim34IHv0s81KwtBx2XxkaIrEs6UKlRrFJlxXICPIdFg7OoUERKYDEcoVDy0oHc1xr"}],"include_subdomains":true}, {"group":"wsp_coep","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coep-report?s=JX1JtnVim34IHv0s81KwtBx2XxkaIrEs6UKlRrFJlxXICPIdFg7OoUERKYDEcoVDy0oHc1xr"}],"include_subdomains":true}, {"group":"csp","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/csp-report-v2?q=JX1JtnVim34IHv0s81KwtBx2XxkaIrEs6UKlRrFJlxXICPIdFg7OoUERKYDEcoVDy0oHc1xr&t=1"}],"include_subdomains":true}
reporting-endpoints: coop="https://q.stripe.com/coop-report", wsp_coop="https://q.stripe.com/coop-report?s=JX1JtnVim34IHv0s81KwtBx2XxkaIrEs6UKlRrFJlxXICPIdFg7OoUERKYDEcoVDy0oHc1xr", wsp_coep="https://q.stripe.com/coep-report?s=JX1JtnVim34IHv0s81KwtBx2XxkaIrEs6UKlRrFJlxXICPIdFg7OoUERKYDEcoVDy0oHc1xr", csp="https://q.stripe.com/csp-report-v2?q=JX1JtnVim34IHv0s81KwtBx2XxkaIrEs6UKlRrFJlxXICPIdFg7OoUERKYDEcoVDy0oHc1xr&t=1"
request-id: req_6BB3Yr0c3KTusW
vary: Origin
x-content-type-options: nosniff
x-robots-tag: none
x-stripe-priority-routing-enabled: true
x-stripe-proxy-response: upstream
x-stripe-routing-context-priority-tier: livemode
x-stripe-server-rpc-duration-micros: 7709
x-wc: 3ff
strict-transport-security: max-age=63072000; includeSubDomains; preload

{"resource":"https://mcp.stripe.com","authorization_servers":["https://access.stripe.com/mcp"]}

## 3. Authorization-server metadata, GET https://access.stripe.com/.well-known/oauth-authorization-server/mcp
HTTP/1.1 200 Connection Established

HTTP/2 200 
server: nginx
date: Thu, 17 Sep 2026 18:06:19 GMT
content-type: application/json; charset=utf-8
content-length: 672
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 300
cache-control: max-age=0, no-cache, no-store, must-revalidate
content-security-policy: base-uri 'none'; child-src 'none'; connect-src https://r.stripe.com 'self' https://sourcemaps.corp.stripe.com https://errors.stripe.com; default-src 'none'; font-src 'self'; form-action 'none'; frame-ancestors https://dashboard.stripe.com https://access.stripe.com; frame-src 'none'; img-src https://files.stripe.com https://b.stripecdn.com 'self'; script-src https://b.stripecdn.com 'self' 'report-sample'; style-src https://b.stripecdn.com 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=d_1rLUKy9AOz6KWmX10rqj7-Pnk5U9iML_AxjVFJI4nXfzYvyNZhFqmfbHRDF6kseck%3D; report-to csp
cross-origin-embedder-policy: credentialless; report-to="wsp_coep"
cross-origin-opener-policy: same-origin; report-to="wsp_coop"
cross-origin-resource-policy: same-origin
expires: 0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report"}],"include_subdomains":true}, {"group":"wsp_coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report?s=d_1rLUKy9AOz6KWmX10rqj7-Pnk5U9iML_AxjVFJI4nXfzYvyNZhFqmfbHRDF6kseck="}],"include_subdomains":true}, {"group":"wsp_coep","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coep-report?s=d_1rLUKy9AOz6KWmX10rqj7-Pnk5U9iML_AxjVFJI4nXfzYvyNZhFqmfbHRDF6kseck="}],"include_subdomains":true}, {"group":"csp","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/csp-report-v2?q=d_1rLUKy9AOz6KWmX10rqj7-Pnk5U9iML_AxjVFJI4nXfzYvyNZhFqmfbHRDF6kseck%3D&t=1"}],"include_subdomains":true}
reporting-endpoints: coop="https://q.stripe.com/coop-report", wsp_coop="https://q.stripe.com/coop-report?s=d_1rLUKy9AOz6KWmX10rqj7-Pnk5U9iML_AxjVFJI4nXfzYvyNZhFqmfbHRDF6kseck=", wsp_coep="https://q.stripe.com/coep-report?s=d_1rLUKy9AOz6KWmX10rqj7-Pnk5U9iML_AxjVFJI4nXfzYvyNZhFqmfbHRDF6kseck=", csp="https://q.stripe.com/csp-report-v2?q=d_1rLUKy9AOz6KWmX10rqj7-Pnk5U9iML_AxjVFJI4nXfzYvyNZhFqmfbHRDF6kseck%3D&t=1"
vary: Origin
x-content-type-options: nosniff
x-robots-tag: none
x-stripe-priority-routing-enabled: true
x-stripe-proxy-response: upstream
x-stripe-routing-context-priority-tier: livemode
x-stripe-server-rpc-duration-micros: 7504
x-wc: 3ff
strict-transport-security: max-age=63072000; includeSubDomains; preload

{
  "issuer": "https://access.stripe.com/mcp",
  "authorization_endpoint": "https://access.stripe.com/mcp/oauth2/authorize",
  "token_endpoint": "https://access.stripe.com/mcp/oauth2/token",
  "registration_endpoint": "https://access.stripe.com/mcp/oauth2/register",
  "revocation_endpoint": "https://access.stripe.com/mcp/oauth2/revoke",
  "response_types_supported": [
    "code"
  ],
  "scopes_supported": [
    "mcp"
  ],
  "response_modes_supported": [
    "query"
  ],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token"
  ],
  "token_endpoint_auth_methods_supported": [
    "none"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ]
}

## 4. REST, GET https://api.stripe.com/v1/customers, no Authorization header
curl: (56) CONNECT tunnel failed, response 502
HTTP/1.1 502 proxy_upstream_refused
Connection: close