# Stripe hides your card from agents, keeps approval _Stripe's link-cli lets agents request one-time virtual cards and tokens, but every spend still needs a push approval and the MCP server stays loopback-only._ **Published:** 2026-10-18 **Source:** https://www.startuphub.ai/ai-news/artificial-intelligence/2026/stripe-hides-your-card-from-agents-keeps-approval --- [Stripe](https://github.com/stripe/link-cli) published link-cli on GitHub to let AI agents spend on behalf of a Link wallet without storing real card details. The tool affects Link wallets and any checkout where an agent pastes credentials, and it requires explicit user approval for each purchase. An attacker would need local network access to abuse the local MCP server, not remote code execution. The CLI produces three credential types. A virtual card PAN works at any web checkout, not only [Stripe](https://www.startuphub.ai/ai-news/startup-news/2026/stripe-buys-openrouter-for-7b-groq-raises-350m) merchants. A Link Pay Token works on supported Stripe payment surfaces via WebMCP. A Shared Payment Token works where sellers accept Machine Payment Protocols. The spend request lifecycle is gated by design. The user creates a request with merchant name, URL, context, amount and line items, then passes --request-approval to trigger a push notification in the Link app. Stripe says approval policies can pre-authorize autonomous spend, but the API returns an error when no policy is configured. That leaves most users in manual-approval mode. Credential exposure is contained but not eliminated. By default link-cli spend-request retrieve hides card data. Passing --include card shows number, CVC, expiry and billing address, so Stripe adds --output-file to write the full card to a 0600-permission file while stdout shows only brand, last4 and expiry. The local automation surface is narrow. link-cli can run as an MCP server with npx @stripe/link-cli --mcp or link-cli serve on 127.0.0.1:54321. The server exposes POST /mcp and skill discovery at /.well-known/skills and binds to loopback only. Stripe warns anyone who can reach the port can use the authenticated Link session, so --host 0.0.0.0 should run only on a trusted isolated network. Limits remain tight and geographic. Stripe says the wallet is only available to US and Canadian Link accounts as of this publication, with per-transaction, daily and 30-day limits returned in cents via user-info retrieve. Financial Insights, which can pull transactions and balances from 12,000+ US institutions via Financial Connections, needs extra scopes like read_link_transactions and read_balances beyond userinfo:read. Identity commands also carry a version gate not detailed in the README: they require Link Agent Wallet v0.27.0 or later and remain excluded from MCP even though they appear in --help, per [GitHub](https://www.startuphub.ai/ai-news/technology/2026/github-outage-capacity-failures-hit-devs). Stripe points developers to link.com/agents for onboarding. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory. © StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.