[External Plugin]: Stripe

[johno-stripe]

Plugin name

stripe

Short description

Accept payments and grow your business. Stripe's agent plugin includes best practices, upgrade guidance, and our MCP server.

GitHub repository

stripe/ai

Plugin path inside the repository

providers/agent-plugins/plugin

Ref to review

No response

Commit SHA to review

e8f9aee6f9a34a633243e632e650401a76c36c41

Version

0.1.2

License identifier

MIT

Author name

Stripe

Author URL

https://stripe.com

Homepage URL

No response

Keywords

stripe
payments
webhooks
api
security

Additional notes for reviewers

We just set up our plugin following the Agent Plugins standard and would love to get it into Copilot's listing! This covers our MCP server and skills.

• The repo includes plugins for various providers that are all at different versions, so we'll always pin to a SHA rather than a repo-wide release.
• The skills are updated regularly (multiple times per week) through automation, so we'll set up a similar workflow to push updated SHAs and versions.

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

🛑 External plugin intake failed (submitter fixes required)

This submission passed metadata validation, but quality gates found issues that must be fixed before it can move to maintainer review. Update the issue details or source plugin and then comment /rerun-intake.

• Plugin: stripe

• Repository: https://github.com/stripe/ai

• SHA: e8f9aee6f9a34a633243e632e650401a76c36c41

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	647 day(s)
Repository activity	no configured signal
Repository counts	1753 stars · 20 watchers · 324 forks · 78 open issues/PRs

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	🛑 fail
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	⚪ not_run
canvas structure	⚪ not_run

• spec compliance: pass
• vally lint: fail
• install smoke test: pass
• version match: pass
• ref/sha consistency: not_run
• canvas structure: not_run
• overall: fail

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (🛑 fail)

✅ connect-recommend (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ connect-required-verification-information (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ stripe-apps (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ stripe-best-practices (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
❌ stripe-directory (1/2 checks passed, 1 failed)
    ✗ [spec-compliance] 1 of 1 skill(s) have spec violations.
        ✗ spec-compliance: Spec checks failed.
            ✗ Allowed-tools field must be a space-delimited string, got object.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
❌ stripe-docs (1/2 checks passed, 1 failed)
    ✗ [spec-compliance] 1 of 1 skill(s) have spec violations.
        ✗ spec-compliance: Spec checks failed.
            ✗ Allowed-tools field must be a space-delimited string, got object.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
❌ stripe-projects (1/2 checks passed, 1 failed)
    ✗ [spec-compliance] 1 of 1 skill(s) have spec violations.
        ✗ spec-compliance: Spec checks failed.
            ✗ Allowed-tools field must be a space-delimited string, got object.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.
✅ upgrade-stripe (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

8 skill(s) linted, 5 passed, 3 failed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-BRBAN2/copilot-home/.copilot/installed-plugins/external-plugin-intake/stripe/plugin.json.

Version match output

- e8f9aee6f9a34a633243e632e650401a76c36c41: matched version "0.1.2" at "providers/agent-plugins/plugin/plugin.json".

Ref/SHA consistency output

Ref/SHA consistency gate skipped because one of source.ref or source.sha was not provided.

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "stripe",
  "description": "Accept payments and grow your business. Stripe's agent plugin includes best practices, upgrade guidance, and our MCP server.",
  "version": "0.1.2",
  "author": {
    "name": "Stripe",
    "url": "https://stripe.com"
  },
  "repository": "https://github.com/stripe/ai",
  "license": "MIT",
  "keywords": [
    "stripe",
    "payments",
    "webhooks",
    "api",
    "security"
  ],
  "source": {
    "source": "github",
    "repo": "stripe/ai",
    "path": "providers/agent-plugins/plugin",
    "sha": "e8f9aee6f9a34a633243e632e650401a76c36c41"
  }
}

View workflow run

[johno-stripe]

Hello -- the specific failure here is flagging skills for having allowed-tools: formatted as a YAML list, rather than a space-delimited string. GitHub's copilot-cli-reference calls out that this field may be supplied as a YAML array, following the same pattern adopted as most harnesses, I imagine because the frontmatter is already YAML and it's a more ergonomic and legible way to specify multiple commands.

Agents suggest escaping spaces with quotes or parentheses (eg Bash(stripe listen)), but the official spec doesn't explicitly support this carve-out either. The underlying @microsoft/vally package isn't available on GitHub, but digging through the Code tab on npm, I found that /dist/skill/graders/spec-compliance.js implements this check with the following logic:

        // "allowed-tools" must be a string (space-delimited list) if provided
        const toolsRaw = skill.frontmatter["allowed-tools"];
        if (toolsRaw !== undefined) {
            const toolsIsString = typeof toolsRaw === "string";
            details.push({
                name: "allowed-tools-type",
                kind: "code",
                passed: toolsIsString,
                score: toolsIsString ? 1 : 0,
                evidence: toolsIsString
                    ? "Allowed-tools field is a string."
                    : `Allowed-tools field must be a space-delimited string, got ${typeof toolsRaw}.`,
            });
        }

Given that the check here isn't actually verifying anything about being space delimited, can we instead broaden it to also allow a string array? I'm starting a discussion in the agentskills repo about this, but in the meantime, it seems that the GitHub Copilot marketplace should allow skills following the format supported by the Copilot CLI.

[johno-stripe]

H @aaronpowell & @jennyf19 -- you two seem to be the top contributors here, I hope you don't mind me getting your eyes on the proposed changes above. I've started a discussion here, but in the meantime, any chance we could make the above check a little more permissive? I can rewrite our Skill files with a script to support this constraint, but it seems like the Right Answer ™️ would be to bring the check in line with currently accepted practices.