ApproveKit

Official4 tools

by yateshaw

Audit apps against App Store, Google Play and Google OAuth review rules; get the required docs.

dev.approvekit/approvekit MCP Server

The dev.approvekit/approvekit Model Context Protocol (MCP) server audits apps against App Store, Google Play, and Google OAuth review rules. It helps retrieve the required documentation needed to address those review requirements, based on the server’s stated purpose and capabilities.

🛠️ Key Features

Audit apps against App Store review rules
Audit apps against Google Play review rules
Audit apps against Google OAuth review rules
Get the required documentation

🚀 Use Cases

Preparing app submissions to App Store
Preparing app submissions to Google Play
Reviewing Google OAuth-related requirements with the necessary docs

⚡ Developer Benefits

Consolidates rule coverage across App Store, Google Play, and Google OAuth
Supports documentation retrieval tied to review requirements

⚠️ Limitations

Provided details do not specify available MCP tools, auth, deployment, or configuration options.

Topics

app-storeclaude-codegoogle-playmcpoauthprivacy-policy

Captured live from the server via tools/list.

audit_app

Use before submitting a mobile or web app to the Apple App Store, Google Play or Google OAuth verification. Pass an inventory of what the app collects, which SDKs it uses and which Google scopes it requests (build it by reading the repo). Returns the problems reviewers are likely to reject, how to fix each one, and which paid package generates the missing documents. Free. The first call returns an app_token: save it in .approvekit.json at the project root and pass it on later calls so the app is updated instead of duplicated.

Parameters2

inventory	object	required
app_token	string	optional	The app_token returned by audit_app. It is stored in .approvekit.json at the project root. Omit on the first audit of an app.

Raw schema

{
  "type": "object",
  "properties": {
    "inventory": {
      "type": "object",
      "properties": {
        "app_name": {
          "type": "string",
          "minLength": 1,
          "maxLength": 100
        },
        "developer_name": {
          "type": "string",
          "minLength": 1,
          "maxLength": 200,
          "description": "Legal name that appears in the policies, usually the company or the individual developer."
        },
        "support_email": {
          "type": "string",
          "format": "email",
          "pattern": "^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$",
          "description": "Public contact address for privacy and deletion requests."
        },
        "platforms": {
          "minItems": 1,
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "ios",
              "android",
              "web"
            ]
          }
        },
        "has_user_accounts": {
          "type": "boolean",
          "description": "True if users can sign up or log in."
        },
        "account_deletion_in_app": {
          "description": "True if the app already lets users delete their account from inside the app.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "data_collected": {
          "default": [],
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "type": {
                "type": "string",
                "description": "Kind of data, e.g. \"email\", \"precise location\", \"photos\", \"purchase history\"."
              },
              "purpose": {
                "type": "string",
                "description": "Why it is collected, e.g. \"account login\", \"analytics\"."
              },
              "shared_with": {
                "description": "Third parties that receive this data.",
                "anyOf": [
                  {
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  },
                  {
                    "type": "null"
                  }
                ]
              }
            },
            "required": [
              "type",
              "purpose"
            ]
          }
        },
        "third_party_sdks": {
          "default": [],
          "description": "SDKs found in the dependencies, e.g. \"Firebase Analytics\", \"RevenueCat\", \"Sentry\".",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "google_oauth_scopes": {
          "default": [],
          "description": "Full Google OAuth scope URLs the app requests, if it uses Sign in with Google or Google APIs.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "privacy_policy_url": {
          "description": "Existing privacy policy URL, if any.",
          "anyOf": [
            {
              "type": "string",
              "format": "uri"
            },
            {
              "type": "null"
            }
          ]
        },
        "account_deletion_url": {
          "description": "Existing public page where users can request account deletion, if any.",
          "anyOf": [
            {
              "type": "string",
              "format": "uri"
            },
            {
              "type": "null"
            }
          ]
        },
        "takes_payments": {
          "type": [
            "boolean",
            "null"
          ]
        },
        "auth_providers": {
          "default": [],
          "description": "How users sign in, e.g. \"Sign in with Apple\", \"Google\", \"email and password\", \"Supabase Auth\".",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "permissions": {
          "default": [],
          "description": "iOS usage-description keys and Android permissions the app declares, e.g. NSCameraUsageDescription, android.permission.READ_CONTACTS.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "bundle_ids": {
          "description": "iOS bundle identifier and Android application id.",
          "anyOf": [
            {
              "type": "object",
              "properties": {
                "ios": {
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "android": {
                  "type": [
                    "string",
                    "null"
                  ]
                }
              }
            },
            {
              "type": "null"
            }
          ]
        },
        "stack": {
          "description": "How the app is built. Expo config plugins add permission strings automatically, so some checks differ.",
          "anyOf": [
            {
              "type": "string",
              "enum": [
                "expo",
                "react-native",
                "flutter",
                "ios",
                "android",
                "web"
              ]
            },
            {
              "type": "null"
            }
          ]
        },
        "android_target_sdk": {
          "description": "targetSdkVersion from build.gradle, if known.",
          "anyOf": [
            {
              "type": "integer",
              "minimum": -9007199254740991,
              "maximum": 9007199254740991
            },
            {
              "type": "null"
            }
          ]
        },
        "play_developer_account": {
          "description": "Google Play account type: personal created after 2023-11-13 (closed-testing requirement applies), personal created before, or organization. Ask the user.",
          "anyOf": [
            {
              "type": "string",
              "enum": [
                "personal-new",
                "personal-old",
                "organization"
              ]
            },
            {
              "type": "null"
            }
          ]
        }
      },
      "required": [
        "app_name",
        "developer_name",
        "support_email",
        "platforms",
        "has_user_accounts"
      ]
    },
    "app_token": {
      "description": "The app_token returned by audit_app. It is stored in .approvekit.json at the project root. Omit on the first audit of an app.",
      "type": "string"
    }
  },
  "required": [
    "inventory"
  ],
  "$schema": "http://json-schema.org/draft-07/schema#"
}

create_checkout

Creates a Stripe Checkout link for one app. Only call this after the user agreed to the purchase. Show the link to the user so they can pay; then call get_order with the returned order_id to receive the documents.

Parameters2

app_token	string	required	The app_token returned by audit_app. It is stored in .approvekit.json at the project root.
product	string	required	launch_pass (US$49) or oauth_pack (US$249).

Raw schema

{
  "type": "object",
  "properties": {
    "app_token": {
      "type": "string",
      "description": "The app_token returned by audit_app. It is stored in .approvekit.json at the project root."
    },
    "product": {
      "type": "string",
      "enum": [
        "launch_pass",
        "oauth_pack"
      ],
      "description": "launch_pass (US$49) or oauth_pack (US$249)."
    }
  },
  "required": [
    "app_token",
    "product"
  ],
  "$schema": "http://json-schema.org/draft-07/schema#"
}

get_order

Returns the payment status of an order. Once paid, returns every generated document as Markdown plus the public URLs of the hosted privacy policy and account deletion pages, ready to paste into App Store Connect, Play Console or the Google OAuth consent screen.

Parameters2

app_token	string	required	The app_token returned by audit_app. It is stored in .approvekit.json at the project root.
order_id	string	required	The order_id returned by create_checkout.

Raw schema

{
  "type": "object",
  "properties": {
    "app_token": {
      "type": "string",
      "description": "The app_token returned by audit_app. It is stored in .approvekit.json at the project root."
    },
    "order_id": {
      "type": "string",
      "description": "The order_id returned by create_checkout."
    }
  },
  "required": [
    "app_token",
    "order_id"
  ],
  "$schema": "http://json-schema.org/draft-07/schema#"
}

publish_document

Saves the final version of a document after every [CONFIRM: ...] placeholder has been resolved with the user. For privacy-policy and account-deletion this makes the hosted page live at its public URL; for the other kinds it just stores the final text. Call it again whenever the text needs an update (for example after the app adds a new data type).

Parameters3

app_token	string	required	The app_token returned by audit_app. It is stored in .approvekit.json at the project root.
kind	string	required
markdown	string	required	The complete final document in Markdown (headings, lists, bold and links only).

Raw schema

{
  "type": "object",
  "properties": {
    "app_token": {
      "type": "string",
      "description": "The app_token returned by audit_app. It is stored in .approvekit.json at the project root."
    },
    "kind": {
      "type": "string",
      "enum": [
        "privacy-policy",
        "account-deletion",
        "reviewer-notes",
        "oauth-scope-justifications",
        "oauth-demo-script"
      ]
    },
    "markdown": {
      "type": "string",
      "minLength": 50,
      "description": "The complete final document in Markdown (headings, lists, bold and links only)."
    }
  },
  "required": [
    "app_token",
    "kind",
    "markdown"
  ],
  "$schema": "http://json-schema.org/draft-07/schema#"
}

README.md3 KBView on GitHub

ApproveKit

Get AI-built apps through App Store review, Google Play review and Google OAuth verification.

ApproveKit is a Claude Code plugin plus a remote MCP server. Your coding agent reads the repo, builds an inventory of what the app collects, and runs a free audit against the rules reviewers actually apply. If you want the documents those reviews require, the agent gets them generated and hosted for a one-time fee per app.

Install

bash

claude plugin marketplace add yateshaw/approvekit
claude plugin install approvekit@approvekit

Then, inside any app repo, tell Claude:

get my app ready for the App Store

or "prepare the Google OAuth verification", "why would Google Play reject this app", "I need a privacy policy and an account deletion page".

Any MCP-capable agent can use the server without the plugin:

bash

claude mcp add --transport http approvekit https://approvekit.dev/mcp

What it does

Inventory. The skill tells the agent how to derive platforms, sign-in methods, permissions, data collected, third-party SDKs, Google OAuth scopes and payments from the repo (Expo, React Native, Flutter, native iOS and Android, web). Your source code never leaves your machine; only the inventory is sent.
Free audit. 23 rules across Apple's App Review Guidelines, Google Play policy and Google's OAuth verification. Every finding comes with its severity, the fix, and a link to the official source.
Documents (paid, optional). A privacy policy and an account deletion page hosted at yourapp.approvekit.dev, reviewer notes for App Store Connect and Play Console, and for Google OAuth the per-scope justifications and the demo video shot list. Anything the repo cannot answer is marked [CONFIRM: ...] for you to fill in; pages go live only when the text is final.

The agent never buys on its own: it reports the findings and the price, and creates a checkout link only after you say yes.

Pricing


Audit	Free
Launch Pass (privacy policy, account deletion page, reviewer notes)	US$49 per app
Google OAuth Verification Pack (Launch Pass + scope justifications + demo video script)	US$249 per app

MCP tools

Tool	Purpose
`audit_app`	Send the inventory, get findings and offers. Returns an `app_token` to reuse.
`create_checkout`	Stripe link for a package, after the user agrees.
`get_order`	Payment status and, once paid, the documents as Markdown.
`publish_document`	Save the final text and put the hosted pages live.

Endpoint: https://approvekit.dev/mcp (Streamable HTTP, no authentication; the app token identifies the app).

Links

ApproveKit is a product of WyeTech LLC. It is a software tool, not legal advice, and it does not guarantee approval by any platform.

Install

Tools (4)

audit_appcreate_checkoutget_orderpublish_document

Remote endpoint

Streamable HTTP

Hosted server - connect over the network, no local install.

url

https://approvekit.dev/mcp

Add to VS Code Add to Cursor

claude_desktop_config.json

json

{
  "mcpServers": {
    "approvekit": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://approvekit.dev/mcp"
      ]
    }
  }
}

Desktop config is stdio-only; this bridges via mcp-remote. Native remote: Settings > Connectors.

dev.approvekit/approvekit MCP Server

🛠️ Key Features

🚀 Use Cases

⚡ Developer Benefits

⚠️ Limitations

Topics

audit_app

create_checkout

get_order

publish_document

ApproveKit

Install

What it does

Pricing

MCP tools

Links

Install

Remote endpoint

Related servers