Meow CLI

Requires Node.js 24 or later.

For an existing account:

meow login
meow list-my-entities
meow list-bank-accounts --entity-id <entity-id>
meow logout

meow login opens your browser. Sign in, complete MFA, and select the permissions on the Meow consent screen. Account commands use the same OAuth server and tools as Customer MCP. A command can also start sign-in when no valid session exists. Email codes cannot authorize account commands.

The client refreshes saved sessions automatically. Credentials use macOS Keychain, Windows Credential Manager, or Linux Secret Service. Unlock your OS credential store before signing in. Linux requires a running Secret Service, such as GNOME Keyring or KWallet. The CLI does not fall back to plaintext files.

Local index files contain opaque credential references, not tokens. Preserve these files with the OS credential store; they track replacement and cleanup.

meow logout revokes the server session before clearing the saved credentials. If revocation fails, retry the command. You can also revoke Meow CLI in MCP Sessions.

If the saved client registration is missing or expired, or the local record is damaged, revoke Meow CLI in MCP Sessions, then run meow logout --local. This removes local credentials without contacting the server. It does not revoke server access.

For a new account:

meow onboarding start
meow onboarding --help

Email codes and onboarding keys work only with onboarding tools. An onboarding key never gains account permissions when the business is approved. Existing scripts must move onboarding commands under meow onboarding and use browser OAuth for account commands.

The callback listens on an ephemeral 127.0.0.1 port. The browser must reach the machine running the CLI. This release does not add a device-code or unattended client-credentials flow.

Build

From src/, run uv sync --locked. Then, from packages/cli:

pnpm install --ignore-workspace --frozen-lockfile
pnpm dist          # dev
pnpm dist:prod     # production
pnpm test

The build exports the tool catalogs from the checked-out backend. It does not log in to a deployed account. mcporter is pinned because the offline generator and revocation helper use its internal modules. Upgrade it with the protocol checks in tests/cli.test.mjs and tests/installed-cli.test.mjs and a fresh build. The build embeds the OAuth consent stylesheet and wordmarks in the callback pages. The pnpm patch accepts these pages, keeps runtime credential names separate from command display names, and exposes the credential-persistence factory. It also adds exports subpaths for the internal modules that the CLI imports. Review these changes when upgrading mcporter.

CI builds from a frozen installation, then installs the packed package with only production dependencies on macOS, Windows, and Linux. The installed CLI checks browser callbacks, PKCE, native storage, refresh, commands, and logout against a simulated server. Publishing uses that same package only after all checks pass. These checks do not replace runtime QA against the deployed Customer MCP.

See the OAuth decision for the provider comparison.