
Company News
AWS Security Hub Adds Socket for Supply Chain Security
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.
The create-next-app of Stripe. Declarative catalog reconciliation into your own Stripe account, plus correct-by-construction billing code you own.
The create-next-app of Stripe. Declare your product catalog in a config file, and stripekit reconciles your own Stripe account to match it — creating and updating products, prices, the webhook endpoint, and the customer portal. No hosted service, no revenue share, no runtime dependency. Plain Stripe underneath, code you own on top.
Status: early. Ships
init,plan,push,pull,dev(local webhook forwarding), andcheck(a config/account doctor).
The painful parts of Stripe aren't the API calls — they're the dashboard ceremony, the test/live drift, and getting webhooks + state sync correct. Existing tools either replace your Stripe account (merchants of record) or put your billing state on their servers (hosted control planes). stripekit does neither: it's a dev tool that leaves you with a declarative catalog and correct-by-construction code in your repo.
npm install -D stripekit # or pnpm add -D / yarn add -D
Create stripe.config.ts in your project root (or run stripekit pull to generate one from an existing account):
import { defineConfig } from 'stripekit'
export default defineConfig({
products: {
pro: {
name: 'Pro',
prices: {
monthly: { amount: 2000, currency: 'usd', interval: 'month' },
yearly: { amount: 19200, currency: 'usd', interval: 'year' },
},
features: { seats: 5, projects: 'unlimited' },
},
},
portal: { cancellations: true, planSwitching: true },
webhooks: { path: '/api/stripe/webhook' },
})
Point stripekit at your account by setting STRIPE_SECRET_KEY (test key while developing) in your environment or .env.local.
| Command | What it does |
|---|---|
stripekit init | Scaffold stripe.config.ts and correct-by-construction billing code into a Next.js (App Router) app. |
stripekit plan | Preview the changes push would make. Never mutates anything. |
stripekit push | Reconcile your Stripe account to match stripe.config.ts. Test mode by default; live mode requires --live. |
stripekit pull | Generate stripe.config.ts from your existing catalog (read-only). |
stripekit dev | Forward Stripe webhooks to your local app and capture the signing secret (wraps stripe listen). |
stripekit check | Doctor: verify keys, config, config-vs-account drift, and webhook/portal wiring. |
stripekit mcp | Run as an MCP server (stdio) so AI agents can call plan/push/pull/check directly. |
Common flags: --json (machine-readable output for agents/CI), --yes (skip confirmation — required to apply to live mode non-interactively), --url <url> (base URL for webhook registration).
stripekit plan # dry run against test mode
stripekit push # apply to test mode
stripekit push --live --yes # promote the same catalog to live mode
lookup_key + stripekit_key metadata). stripekit only ever reads and mutates objects it created — anything you made by hand in the dashboard is invisible to it and never touched.active: false); existing subscriptions are never disrupted.push --live is how catalog changes are promoted, which kills test/live drift.When stripekit creates the webhook endpoint, Stripe returns the signing secret exactly once. stripekit captures it and writes STRIPE_WEBHOOK_SECRET to your env file immediately — it is not retrievable via the API afterward.
Point your coding agent at SKILL.md and it can set stripekit up for you. The docs are also available as llms.txt / llms-full.txt, and every command accepts --json and --yes. Or run stripekit mcp to expose plan/push/pull/check to an agent as MCP tools.
Install the MCP server one-click in Cursor:
…or in Claude Code: /plugin marketplace add rafaelcg/stripekit then /plugin install stripekit@stripekit-marketplace. See the MCP docs for every client.
MIT
FAQs
The create-next-app of Stripe. Declarative catalog reconciliation into your own Stripe account, plus correct-by-construction billing code you own.
We found that stripekit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.