Guardrails for money movement: Integrating Stripe MCP with Portia AI

Summary

Portia AI presents a customer-refund agent that combines its guardrails with Stripe’s official Model Context Protocol server. The agent reads a refund request, compares it with a policy file, identifies the relevant Stripe customer and payment intent, and evaluates whether the request should be approved. Portia’s planner produces a multi-agent plan, while execution agents run it and persist outputs in plan state; an execution hook pauses before the Stripe create-refund call. A clarification presents the request and the agent’s rationale to a human, who can approve it in the CLI; approval allows the refund to proceed, while rejection exits without creating one. The example also handles Gmail OAuth and can send the customer an email describing the outcome.

Context

The example addresses the risks of allowing AI agents to handle high-stakes actions involving Stripe APIs and money movement. It is motivated by the need for human control during planning and execution, with intervention defined for refund operations.

Approach / What changed

The implementation combines Portia’s planning and execution agents with its tool registry, Stripe’s MCP server, a custom RefundReviewerTool, and an execution hook that invokes clarify_on_tool_calls before mcp:stripe:create_refund. The workflow reads the customer request and refund policy, uses Stripe tools to locate the customer and payment intent, requests human approval through a clarification, and then creates the refund only if approved.

Takeaways

• Portia’s DefaultToolRegistry can add Stripe’s official MCP server over a streamable HTTP connection, while Portia stores authentication credentials using production-grade encryption.
• The planned Stripe sequence is to find a customer by email, find that customer’s payment intent, and create a refund against the payment intent; the example then sends the customer an outcome email.
• An execution hook pauses before the create_refund tool call and requests clarification. Typing “y” continues the workflow; another response exits without creating the refund.

Related reading