agent-stripe

Both account namespaces — Connect v1 accounts and Accounts v2 / UA2, including v2 configurations, capabilities, requirement entries, persons and v2 core events

The /v2 transport handled for you — Bearer auth, its own API version, indexed array parameters and token pagination

Scenario investigations, not just endpoints — invoice payment evidence, checkout completion, card-last4 lookup, renewal summaries, collection risk, refund, dispute and fraud triage, ledger reconciliation, Connect money-movement failures and connected-account health

Redacted by default — sensitive values become [REDACTED] and the object carries an @redacted list naming each path and how to expose it

--expose is deliberate and scoped — comma-separated or repeated, applies to responses and debug bodies, and never reveals a stored profile key

Stripe context aware — Stripe-Context for organization keys and related-account requests, stored on the profile

Keychain-first credentials — API keys live in the keychain, never in config.json, and are never printed back

Only the credential type is stored as metadata — rk_test or sk_live, so auth list can tell you what a profile is without touching the secret

Bounded retries — 429s retry with exponential backoff and jitter, then return fixable_by: retry with Stripe's own rate-limit reason header

Debug without leaks — --debug emits client setup, credential source, request URLs, status codes, request IDs and redacted bodies, but never a raw key

Multi-profile — sandbox, live, organization and holding-account workflows side by side, selected with -p

GET-only raw API escape hatch for anything not yet wrapped