What's not working, this appears to be valid Mason code. Is there an error message? Mason will print a code stack identifying the component and line the error occured.

I don't want people to be able to see $card_id in the url

Is it the actual value of $card_id you don't want them to see, or the name of the parameter?

As has been suggested, a form withh a POST request is a good way to avoid ugly urls like this, but the param names and values will be available to the client.

I want to create a link to a mason script and pass it a value:

I don't know what you mean by 'Mason script', do you mean a 'component'? Does this component exist? Does it contain the <%args>$card_id</%args> declaration?

But, if you want to use a link, you have an option in Mason that may work depending on your site architecture etc.

Use a dhandler in a directory for removecard then pass the card_id on the url and get at it with $m->dhandler_arg. Giving you an url like <a href="removecard/<% $card_id %>">remove</a>

This of course still puts the value of $card_id visible to the user, in the url, but "what" that id is is not identified.