Stripe published link-cli on GitHub to let AI agents spend on behalf of a Link wallet without storing real card details. The tool affects Link wallets and any checkout where an agent pastes credentials, and it requires explicit user approval for each purchase. An attacker would need local network access to abuse the local MCP server, not remote code execution.
The CLI produces three credential types. A virtual card PAN works at any web checkout, not only Stripe merchants. A Link Pay Token works on supported Stripe payment surfaces via WebMCP. A Shared Payment Token works where sellers accept Machine Payment Protocols.
The spend request lifecycle is gated by design. The user creates a request with merchant name, URL, context, amount and line items, then passes --request-approval to trigger a push notification in the Link app. Stripe says approval policies can pre-authorize autonomous spend, but the API returns an error when no policy is configured. That leaves most users in manual-approval mode.
Credential exposure is contained but not eliminated. By default link-cli spend-request retrieve hides card data. Passing --include card shows number, CVC, expiry and billing address, so Stripe adds --output-file to write the full card to a 0600-permission file while stdout shows only brand, last4 and expiry.
The local automation surface is narrow. link-cli can run as an MCP server with npx @stripe/link-cli --mcp or link-cli serve on 127.0.0.1:54321. The server exposes POST /mcp and skill discovery at /.well-known/skills and binds to loopback only. Stripe warns anyone who can reach the port can use the authenticated Link session, so --host 0.0.0.0 should run only on a trusted isolated network.
