# Check CLI

The @mybestie/check CLI is the executable wrapper around the Check contract. It is not a separate SDK.

`@mybestie/check` is available from source in the repository (`packages/bestie-check`) as a bundled CLI and stdio MCP adapter that invoke the Check API directly.

## Available Command Surface

- `packs` / `verify` — discover admitted packs and run verification on a staged deliverable.
- `mcp` — stdio MCP adapter for local agent toolchains and host processes.
- `doctor` — validate the active Bestie credential source and diagnose authentication configuration.
- Headless lifecycle commands: `upload`, `quote`, `create`, `status`, `findings`, `receipt`.

## Quote-bound Approval

Spend approval is strictly quote-bound. Required invocation shape:

```
--approve-quote <quoteId>
--approve-up-to 792
```

Approval must bind quote hash, pack stack, budget ceiling, tenant ID, and expiry timestamp. A bare `--approve` flag is rejected by policy.

## Authentication & Credential State

During current pilot operation, authentication uses operator-provisioned tokens configured via `BESTIE_API_KEY` or bearer credentials. Automatic browser device login is currently dormant (`CHECK_DISTRIBUTION_MODE=disabled`).

Canonical remote MCP resource: [https://www.hirebestie.com/api/check/mcp](https://www.hirebestie.com/api/check/mcp). See [MCP Documentation](/docs/mcp).