Paybond Kit 0.12.13 → 0.12.14 — clearer CLI errors and hosted MCP (Streamable HTTP)
Paybond Kit 0.12.13 → 0.12.14 are out — TypeScript (@paybond/kit) and Python (paybond-kit).
Also shipped a new landing page on paybond.ai.
0.12.13 — CLI that helps you recover
Auth and validation failures map to stable errors with clear next steps (paybond login, paybond doctor). Optional --debug when you need a stack trace.
0.12.14 — hosted MCP over Streamable HTTP
https://mcp.paybond.ai/mcp with Authorization: Bearer <paybond_sk_...> — same contract as local MCP for hosts that can’t spawn stdio.
GET https://mcp.paybond.ai/healthz is unauthenticated for liveness.
Or self-host: paybond mcp serve --transport http
Docs: https://paybond.ai/docs/kit/mcp-server
Releases: https://github.com/nonameuserd/paybond-kit/releases · https://github.com/nonameuserd/paybond-kit-python/releases
Replies
Since this is positioned as spend controls for agents, curious how that maps onto the bearer token itself. Does the paybond_sk_ token carry its own spend limit and scope, so a leaked token is bounded no matter what calls it, or is enforcement entirely server side and the token is just an identity credential? Matters a lot for how bad a leaked token actually is, since hosted MCP means that token is sitting on infrastructure you don't control.