@stripe/link-cli 0.5.0 → 0.7.0

package/README.md

@@ -58,6 +58,17 @@ Link CLI can run as a local MCP server. Add the following to your MCP client con
 }
 ```
 
+#### HTTP MCP Server
+
+Use `serve` to expose link-cli as an MCP endpoint over HTTP. This is useful for remote or containerised agents that can't launch a local subprocess.
+
+```bash
+link-cli serve            # listens on port 54321 by default
+link-cli serve --port 8080
+```
+
+The MCP endpoint is available at `/mcp` on the chosen port.
+
 ## Quickstart
 
 Run a guided onboarding and demo flow:
@@ -173,12 +184,15 @@ link-cli mpp pay https://climate.stripe.dev/api/contribute \
 
 ```bash
 link-cli auth login --client-name "Claude Code"   # identify the connecting agent
+link-cli auth login --client-name "Claude Code" --interval 5 --timeout 300  # login + poll in one call
 link-cli auth status                               # check auth status
 link-cli auth logout                               # disconnect
 ```
 
 When you provide `--client-name`, the Link app displays it when you approve the connection — for example, `Claude Code on my-macbook` instead of `link-cli on my-macbook`.
 
+With `--interval`, the login command yields the verification code immediately and then polls inline until authenticated or timed out — no separate `auth status` call needed. This is recommended for agents that cannot relay the code while a separate polling command blocks their I/O channel.
+
 `auth status` includes an `update` field when a newer version is available:
 
 ```json
@@ -202,7 +216,7 @@ A spend request moves through: **create** → **request approval** → **approve
 
 **Required fields for create:** `payment_method_id`, `merchant_name`, `merchant_url`, `context`, `amount`
 
-**Constraints:** `context` must be at least 100 characters; `amount` must not exceed 50000 (cents); `currency` must be a 3-letter ISO code.
+**Constraints:** `context` must be at least 100 characters; `amount` must not exceed 50000 (cents); `currency` must be a 3-letter ISO code. The user has 10 minutes from when approval is requested to approve. Approved credentials (card or SPT) are valid for 12 hours from spend request creation.
 **Test mode:** Pass `--test` to create testmode credentials (uses test card `4242424242424242`), useful for development and integration testing without real payment methods.
 
 ```bash
@@ -220,6 +234,19 @@ link-cli spend-request retrieve lsrq_001
 link-cli spend-request cancel lsrq_001
 ```
 
+### Limits
+
+| Limit | Value |
+|-------|-------|
+| Max amount per spend request | $500 (50,000 cents) |
+| Approval window | 10 minutes — user must approve within 10 min of `request-approval` |
+| Card / SPT validity | 12 hours from spend request creation |
+| Daily spend | $500 |
+| Concurrent active requests (created + approved) | 30 |
+| Concurrent approved requests | 10 |
+| Hourly creation rate | 50 per hour |
+| Rolling creation rate | 200 per 60 days |
+
 ### MPP
 
 Use `mpp pay` to complete purchases on merchants that use the [Machine Payments Protocol](https://mpp.dev). The spend request must use `credential_type: "shared_payment_token"` and you must approve it before paying. The SPT is one-time-use — if payment fails, create a new spend request.
@@ -244,6 +271,9 @@ link-cli mpp decode \
 | Variable | Effect |
 |----------|--------|
 | `LINK_AUTH_FILE` | Same as `--auth` — override the auth credential file path (flag takes precedence) |
+| `LINK_ACCESS_TOKEN` | Use this access token directly, bypassing auth storage |
+| `LINK_REFRESH_TOKEN` | Refresh token to use when `LINK_ACCESS_TOKEN` is expired |
+| `LINK_NO_REFRESH` | When set, never auto-refresh the access token — error instead |
 | `LINK_API_BASE_URL` | Override the API base URL |
 | `LINK_AUTH_BASE_URL` | Override the auth base URL |
 | `LINK_HTTP_PROXY` | Route all requests through an HTTP proxy (requires `undici`) |