inflow

InFlow is the command-line client for agentic discovery, onboarding, and payments.

Agents discover Services and Offerings through ODP, establish Service access through AEP, and pay protected endpoints through MPP or x402. Humans can use the same workflows from MCP-integrated assistants or the InFlow CLI.

New here? Start with the command reference in packages/cli/README.md — it covers auth, ODP discovery, the x402 and mpp command groups, the global flags, and the agent (--format) renderings.

Installing into an agent host? Use the per-surface guide: docs/development/surfaces-and-testing.md.

Install

InFlow is distributed as a signed native application. The npm package is a compatibility notice and does not run commands, start MCP, or manage credentials.

Public installation supports Apple Silicon and Intel Macs, Windows x64 and ARM64, and Linux ARM64 and AMD64. Homebrew, the hosted installers, WinGet, and direct GitHub Release downloads install the signed native application for each platform.

Homebrew Cask

brew tap inflowpayai/tap
brew install --cask inflow
inflow --version

Upgrade or uninstall through Homebrew:

brew upgrade --cask inflow
brew uninstall --cask inflow

Hosted installers

On macOS, Debian/Ubuntu, and Fedora/RHEL:

curl -fsSL https://inflowcli.ai/install.sh | bash

On macOS, the installer selects the current architecture, verifies the checksum plus code-signing and Gatekeeper checks, installs InFlow.app into ~/.local/share/inflow, and links inflow into ~/.local/bin. On Linux, it verifies the OpenPGP-signed release manifest and package checksum before installing the matching Debian or RPM system package.

Run the installer again to upgrade to the latest GitHub Release. Uninstall with:

curl -fsSL https://inflowcli.ai/install.sh | bash -s -- --uninstall

On Windows, run PowerShell as a user who can approve the Windows Installer elevation prompt:

irm https://inflowcli.ai/install.ps1 | iex

The PowerShell installer selects x64 or ARM64, verifies the MSI checksum, Authenticode status, and publisher, and then installs the package through Windows Installer. Run it again to upgrade. To uninstall while preserving encrypted vault data:

$env:INFLOW_UNINSTALL = '1'
try { irm https://inflowcli.ai/install.ps1 | iex } finally { Remove-Item Env:INFLOW_UNINSTALL }

The compatibility shell endpoint delegates to the platform installer on macOS, Linux, and Git Bash-like Windows environments:

curl -fsSL https://inflowcli.ai/cli | bash

WinGet

winget install --id InFlowPayAI.InFlow --exact

Upgrade or uninstall through WinGet:

winget upgrade --id InFlowPayAI.InFlow --exact
winget uninstall --id InFlowPayAI.InFlow --exact

Direct download

Download the matching artifact from the inflowpayai/inflow-cli GitHub Release for the package version:

• inflow-<version>-darwin-arm64.zip for Apple Silicon Macs
• inflow-<version>-darwin-x64.zip for Intel Macs
• inflow-<version>-windows-arm64.msi for Windows ARM64
• inflow-<version>-windows-x64.msi for Windows x64

The zip contains InFlow.app; the executable is inside the app bundle at InFlow.app/Contents/MacOS/inflow.

Linux releases include ARM64 and AMD64 Debian packages, RPM packages, and standalone archives. Debian and RPM packages install the system vault service required by the Linux security model.

Windows MSI packages install the command-line application and its on-demand vault service. Windows verifies the Authenticode signature and publisher before installation.

Initialize the credential vault

Credential-bearing commands use the encrypted local InFlow vault. Initialize or unlock it in a human-controlled terminal:

inflow vault unlock

The PIN or passphrase is read only from the terminal. It is not an MCP argument, command-line flag, environment variable, or structured agent input. inflow vault status, inflow vault lock, and inflow vault policy do not require the unlock factor.

Agent Skills

The repository publishes three installable agent skills:

| Skill | Use it to | | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- | | agentic-discovery | Find Services and Offerings, browse Collections, and resolve Actions through ODP. | | agentic-enrollment | Enroll with AEP Services and manage Service credentials. | | agentic-payments | Inspect and pay MPP- or x402-protected endpoints. |

Install all three through the Skills CLI:

npx skills add inflowpayai/inflow-cli

The InFlow binary embeds the same playbooks. --skill prints a playbook for an agent host that cannot install skills directly; it does not install the skill:

inflow --skill agentic-discovery
inflow --skill agentic-enrollment
inflow --skill agentic-payments

The repo also ships as an installable plugin (skill + MCP server bundled) for plugin-aware hosts:

• Claude Code — add the marketplace, then install the plugin:

  /plugin marketplace add inflowpayai/inflow-cli
  /plugin install inflow@inflow
  

  Here inflowpayai/inflow-cli is the GitHub repo slug; the marketplace, plugin, and binary are all named inflow, so the install target is inflow@inflow.

• Cursor / Codex — point the host at this repo; it discovers .cursor-plugin/marketplace.json, .agents/plugins/marketplace.json, and .codex-plugin/plugin.json respectively.

In every case the plugin bundles the skill and the inflow MCP server (.mcp.json). The default MCP entry runs inflow --mcp; install the signed native binary before using the MCP server.

First Agentic Commerce Flow

Use a standard InFlow account for buyer-side CLI workflows. A Service operator accepting payments needs a separate Seller account and the corresponding Node.js seller SDK.

# Human-controlled setup
inflow vault unlock
inflow auth login

# Discover Services and Collections, then inspect a Service
inflow directory search plants --source odp
inflow inspect https://service.example

# Establish access when the Service requires enrollment
inflow aep enroll https://service.example

# Inspect and pay the protected endpoint selected from an ODP Action
inflow mpp inspect https://service.example/actions/purchase
inflow mpp pay https://service.example/actions/purchase

The three protocol layers are composable rather than mandatory on every request. ODP identifies Services, Offerings, and executable Actions. AEP establishes Service access when required. MPP or x402 completes payment when the selected endpoint returns a payment challenge. Start with inflow inspect when the required layers are not yet known.

For public OpenAPI discovery, no login is needed:

inflow directory search --source openapi
inflow openapi operations list https://parallelmpp.dev/openapi.json
inflow openapi operations get https://parallelmpp.dev/openapi.json --method POST --path /api/search

Pass the Directory result's service.source.url to OpenAPI commands. Reading operation details does not invoke the operation or make a payment; Directory Collection selections do not restrict the document's operation list.

Use inflow openapi operations prepare with the same operation selector and --data or --parameters to preview a request without sending it. Multiple advertised servers require explicit selection. Recognized credentials are redacted, but ordinary request data remains visible; see the preparation reference.

Security and local data

• OAuth tokens, API keys, and Agent Enrollment Protocol credentials are encrypted in the local SQLite vault.
• The vault daemon accepts only authenticated local InFlow clients and exposes exact-reference secret operations, not payment, network, signing, or command-execution operations.
• The daemon authenticates clients, and clients authenticate the daemon before transmitting requests.
• Vault unlock factors are entered only in a human terminal. Agent and MCP executions fail closed while the vault is locked.
• macOS uses the signed application identity. Windows uses Authenticode-signed application and Windows service identities. Linux packages install a system service and enforce executable, socket, peer, tenant, and package identity checks.
• inflow auth logout and inflow vault reset remove local credentials and vault state. Package uninstall preserves encrypted vault data unless the platform-specific purge operation is requested.

InFlow sends authenticated API requests, seller-resource requests requested by the user, and an advisory GitHub Release version check. Set NO_UPDATE_NOTIFIER=1 to disable the version check. The check has a two-second deadline and does not send credentials.

Upgrade and troubleshooting

Upgrade a Homebrew installation with brew upgrade --cask inflow, a WinGet installation with winget upgrade --id InFlowPayAI.InFlow --exact, or a hosted installation by rerunning its platform installer. The CLI may report a newer signed release, but continues unless the API returns VERSION_UNSUPPORTED.

If an agent or MCP tool reports that the vault is locked, run inflow vault unlock yourself in a terminal and retry the operation. Never paste the PIN or passphrase into a prompt or MCP tool input.

Use inflow auth status --format json to check authentication and environment state, and inflow vault status to check the local vault and daemon. See the surface install and testing guide for host-specific MCP troubleshooting.

Development

This is a pnpm + Turborepo monorepo. Node >= 24.15.0 required.

pnpm install
pnpm build
pnpm test

Other useful tasks:

pnpm typecheck
pnpm lint
pnpm typedoc
pnpm changeset

Release automation

Production releases use one atomic native workflow that signs and verifies the macOS, Windows, and Linux artifacts before publishing an immutable GitHub Release, updating Homebrew, and producing the WinGet submission manifests. See the native release guide for workflow modes, platform credentials, signing order, and recovery procedures.

Packages

• @inflowpayai/inflow (`package