Apple Developer MCP by Nova (CIVAI)
REMOTE · NOVA.CIVAI.CO
Ship a new iOS app from chat. AI runs App Store Connect, builds, release, and submission through Ap…
Available components
Last scanned (7 hours ago)
Scores higher than 62% of remote servers
Reachable. Last reached 5 Nov 2026.
Category CI/CD and DevOps
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security83
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability79
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 6121 tokens (~105/item across 58 items; 55 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage80
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 39% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_bundle_id" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 56 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 +1
- Stability: unverified → 0.03 ▲ functional
- 2 Nov 26 72
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://nova.civai.co/mcp/agents/mcp-apple_developer
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=api.vearn.co | CN=YR2,O=Let's Encrypt,C=US | 18 Oct 2026 | 16 Jan 2027 | RSA 2048 | SHA256-RSA | 5989a0174450d554cb27dbfdec88b2ff58a |
| SANs: allegedly-api.crypvestai.cloud, allegedly.crypvestai.cloud, api.agi.civai.co, api.browser.civai.co, api.nova.civai.co, api.vearn.co, app.browsergpt.co, app.vearn.co, arcade-assets.civai.co, audience-resolver-api.civai.co, audience-resolver.civai.co, audience.civai.co and 11 more | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of nova.civai.co. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| co. | present | 7786 | 8 | Verified |
| civai.co. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Challenged, unverified
The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.
| Result | Challenged, unverified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
Protected resource metadata
| Retrieved | No |
|---|---|
| Problem | no_resource_metadata |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://nova.civai.co/mcp/agents/mcp-apple_developer | Verified | 400 | |
| http (plaintext) | http://nova.civai.co/mcp/agents/mcp-apple_developer | HTTPS enforced | 301 | https://nova.civai.co/mcp/agents/mcp-apple_developer |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
attach_build_and_compliance ~141
After Expo/CI has uploaded the .ipa to ASC: list builds for asc_app_id, wait until processing is VALID, attach build_id to app_store_version_id, set export compliance (uses_non_exempt_encryption usually false).
| Name | Type | Req | Description |
|---|---|---|---|
| app_store_version_id | string | – | – |
| asc_app_id | string | – | – |
| build_id | string | – | Optional; latest build from list_builds when omitted. |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| uses_non_exempt_encryption | string | – | – |
No output schema declared.
No examples provided.
attach_review_item ~72
Attach an app store version or build item to an existing review submission by review_submission_id. Use after create_review_submission when building a submission manually.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
create_app ~87
Create App Store Connect app
| Name | Type | Req | Description |
|---|---|---|---|
| app_name | string | yes | – |
| bundle_id | string | yes | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| primary_locale | string | – | – |
| sku | string | yes | – |
| version_string | string | – | – |
No output schema declared.
No examples provided.
create_app_bundle ~90
Create ASC app bundle (may 403 if tenant allows GET only).
| Name | Type | Req | Description |
|---|---|---|---|
| bundle_name | string | – | Display name for the app bundle. |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| primary_app_id | string | – | ASC apps id for the first app in the bundle. |
No output schema declared.
No examples provided.
create_asc_api_key ~115
Create an App Store Connect API team key. Optionally downloads the one-time .p8 private key PEM (treat like a password; never commit).
| Name | Type | Req | Description |
|---|---|---|---|
| api_key_nickname | string | yes | – |
| api_key_role | string | – | – |
| download_p8 | boolean | – | Fetch private key immediately after create (only chance Apple offers) |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
create_bundle_id ~106
Register a new bundle ID on developer.apple.com (requires Developer Identifiers session from start_browser_auth).
| Name | Type | Req | Description |
|---|---|---|---|
| bundle_display_name | string | – | – |
| bundle_id | string | yes | – |
| bundle_platform | string | – | – |
| developer_team_id | string | yes | Apple Developer Team ID (teamId query parameter). |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
create_review_submission ~88
Create a new, empty review submission (READY_FOR_REVIEW) for an app so a version/build can be attached before submit. Use press_submit_for_review instead if you just want to submit the current version in one step.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
delete_bundle_id ~124
Remove a bundle ID from developer.apple.com (requires Developer Identifiers session from start_browser_auth).
| Name | Type | Req | Description |
|---|---|---|---|
| bundle_id | string | – | Reverse-DNS id to remove (resolved via ascBundleIds if record id omitted). |
| developer_bundle_record_id | string | – | Developer portal bundleIds record id (from Identifiers edit URL). |
| developer_team_id | string | yes | Apple Developer Team ID (teamId). |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
delete_orphan_review_submissions ~125
Delete empty READY_FOR_REVIEW review submission drafts (zero items) for an app. Use dry_run=true to list orphans only. Clears slots before press_submit_for_review.
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | yes | – |
| dry_run | string | – | List would_delete only; no DELETE when true |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| review_submission_id | string | – | Optional — delete one open orphan draft by id |
No output schema declared.
No examples provided.
delete_screenshots ~139
Delete screenshots for targeted iPhone display types (e.g. APP_IPHONE_61 only). Use dry_run=true to list without DELETE. Requires localization_id from get_app_store_version.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | string | – | – |
| localization_id | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| screenshot_display_types | string | yes | Comma-separated types, e.g. APP_IPHONE_61 |
| screenshot_id | string | – | Optional — delete one screenshot when it belongs to a targeted size |
No output schema declared.
No examples provided.
distribute_build_to_testflight ~252
Add a VALID build to TestFlight internal or external beta group. For internal, also pass tester_emails (ASC team addresses) or call invite_testflight_testers testing_scope=internal — otherwise ASC shows 0 Testers and TestFlight stays empty.
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | yes | – |
| beta_app_description | string | – | – |
| beta_contact_email | string | – | – |
| beta_contact_first_name | string | – | – |
| beta_contact_last_name | string | – | – |
| beta_contact_phone | string | – | – |
| beta_feedback_email | string | – | – |
| beta_group_name | string | – | – |
| beta_privacy_policy_url | string | – | – |
| beta_what_to_test | string | – | – |
| build_id | string | – | – |
| build_number | string | – | – |
| build_selection | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| skip_beta_review | string | – | – |
| tester_emails | string | – | Comma-separated team emails to add to internal group |
| testing_scope | string | – | – |
No output schema declared.
No examples provided.
download_asc_api_key ~75
Download the one-time .p8 private key for an existing API key when canDownload is still true.
| Name | Type | Req | Description |
|---|---|---|---|
| api_key_id | string | yes | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
get_account_compliance_status ~75
Business portal links for Agreements/Tax/Banking plus price schedule hints (contracts are human-signed).
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
get_app ~72
Get one app's details (name, bundle id, SKU) by asc_app_id. Use to confirm the right app before making changes to it.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
get_app_store_version ~64
GET iOS appStoreVersions for asc_app_id
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
get_build ~68
Get one build's processing state and metadata by build_id. Use before attach_build_and_compliance to confirm the build finished processing.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
get_bundle_id ~70
Get details for one existing bundle ID by its ASC resource id. Use after list_bundle_ids to confirm platform and capabilities before create_app.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
get_pre_submit_status ~78
Read-only checklist before Submit for Review (build, privacy, category, copyright). Includes orphan_review_submission_ids for empty drafts.
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
get_review_path ~81
Get the Resolution Center and App Review URLs for an app, for messages Apple has not exposed via list_review_messages. Use when an operator needs to open the review thread directly in a browser.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
get_review_submission ~67
Get the status and attached items of one review submission by review_submission_id. Use to check progress after create_review_submission.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
get_testflight_public_link ~240
Create or reuse an external TestFlight group, attach a processed build, enable the public join link, and return https://testflight.apple.com/join/… Requires asc_session_cookie (session_status OK). First external build may need Beta App Review before the link works for everyone.
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | yes | – |
| beta_app_description | string | – | – |
| beta_contact_email | string | – | – |
| beta_contact_first_name | string | – | – |
| beta_contact_last_name | string | – | – |
| beta_contact_phone | string | – | – |
| beta_feedback_email | string | – | – |
| beta_group_name | string | – | – |
| beta_marketing_url | string | – | – |
| beta_privacy_policy_url | string | – | – |
| beta_what_to_test | string | – | – |
| build_id | string | – | – |
| build_number | string | – | – |
| build_selection | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| skip_beta_review | string | – | – |
No output schema declared.
No examples provided.
invite_asc_team_member ~171
Invite a user to your App Store Connect team (email invitation, 3-day expiry). Required for internal TestFlight when they are not already a team user. Does not replace invite_testflight_testers (external beta emails).
| Name | Type | Req | Description |
|---|---|---|---|
| asc_roles | string | – | Comma-separated roles, e.g. DEVELOPER or APP_MANAGER,DEVELOPER |
| confirm_invite_team_member | string | yes | – |
| invite_email | string | yes | – |
| invite_first_name | string | yes | – |
| invite_last_name | string | yes | – |
| limit_visible_apps | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| visible_app_ids | string | – | – |
No output schema declared.
No examples provided.
invite_testflight_testers ~146
Add testers to a TestFlight beta group by email. testing_scope=internal: ASC team emails for Internal Testing group (required before TestFlight app shows the build). testing_scope=external: external group email invites.
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | – | – |
| beta_group_id | string | – | – |
| beta_group_name | string | – | Default Internal Testing or Public Link Testers by scope |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| tester_emails | string | yes | Comma-separated emails |
| testing_scope | string | – | – |
No output schema declared.
No examples provided.
list_app_bundles ~56
List ASC app bundles (iris GET /appBundles).
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
list_app_media_sets ~75
List existing screenshot and app preview sets for an app store version localization (read-only). Use before upload_screenshot to see which display sizes already have assets.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
list_apps ~70
List apps visible to the current App Store Connect session. Use to find an existing asc_app_id before create_app or any per-app tool.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
list_asc_api_keys ~70
List App Store Connect API team keys and the team issuer id (for EAS / CI). Does not return private keys.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
list_asc_team_members ~92
List active App Store Connect team members and pending email invitations, returning only each person's identifier (email/username) and roles. Use before internal TestFlight distribution to confirm someone is on the team and has a TestFlight-eligible role.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
list_builds ~74
List ASC builds for asc_app_id (newest first). Use before attach if operator names a build number.
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
list_bundle_ids ~72
List bundle IDs registered on developer.apple.com for the current team. Use to find an existing bundle_id before create_bundle_id or get_bundle_id.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
list_review_messages ~84
Resolution Center threads and App Review messages for asc_app_id. Empty threads until Apple opens a rejection/message thread.
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | yes | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| resolution_center_thread_id | string | – | – |
No output schema declared.
No examples provided.
login ~60
After operator completes Apple IDMSA in a browser, verify Developer portal session (checkPermissions).
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
press_submit_for_review ~93
Build already on version: create review submission and PATCH submitted=true. Requires confirm_submit_for_review=true.
| Name | Type | Req | Description |
|---|---|---|---|
| app_store_version_id | string | – | – |
| asc_app_id | string | – | – |
| confirm_submit_for_review | string | yes | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
probe_update_version_localization ~79
PATCH app store version localization promotional text (requires asc_app_id / localization_id on tenant).
| Name | Type | Req | Description |
|---|---|---|---|
| localization_id | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| promotional_text | string | – | – |
No output schema declared.
No examples provided.
revoke_asc_api_key ~85
Permanently revoke an App Store Connect API team key (cannot be undone).
| Name | Type | Req | Description |
|---|---|---|---|
| api_key_id | string | yes | – |
| confirm_revoke_api_key | boolean | yes | Must be true to proceed |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
session_status ~46
ASC session check
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
set_age_rating ~70
Set the app's age rating questionnaire answers (content descriptors) required before submit. Use once per app, or when content descriptors change.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
set_app_privacy ~225
Set App Privacy data-collection declarations (iris appDataUsages): pass app_privacy_profile=contact or analytics for the built-in presets, or app_privacy_profile=custom with an inline declarations JSON array when the presets don't match what the app actually collects. See SKILLS.md App Privacy section for the preset definitions.
| Name | Type | Req | Description |
|---|---|---|---|
| app_privacy_declarations_json | string | – | Required when app_privacy_profile=custom. Inline JSON: {"declarations":[{"category":"USER_ID","purpose":"APP_FUNCTIONALITY","dataProtection":"DATA_LINKED_TO_YOU"},...]} or same array without wrapper.… |
| app_privacy_profile | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| publish_app_privacy | string | – | – |
| replace_app_privacy | string | – | – |
No output schema declared.
No examples provided.
set_app_store_metadata ~86
Set primary App Store category, version copyright, and third-party content rights declaration.
| Name | Type | Req | Description |
|---|---|---|---|
| content_rights_declaration | string | – | – |
| copyright | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| primary_category | string | – | – |
No output schema declared.
No examples provided.
set_export_compliance ~70
PATCH build export encryption flag
| Name | Type | Req | Description |
|---|---|---|---|
| build_id | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| uses_non_exempt_encryption | string | – | – |
No output schema declared.
No examples provided.
set_pricing_and_availability ~104
Set or read USA base price tier (0 free, 1+ paid). Paid apps still need Agreements/Tax/Banking in ASC Business.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| price_base_territory | string | – | – |
| price_tier | string | – | – |
| pricing_mode | string | – | – |
No output schema declared.
No examples provided.
set_version_build ~98
Set which build is attached to an app store version without also running export-compliance or wait-for-processing steps. Use attach_build_and_compliance instead when the build may still be processing.
| Name | Type | Req | Description |
|---|---|---|---|
| app_store_version_id | string | – | – |
| build_id | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
start_browser_auth ~116
Open App Store Connect sign-in only when needed. If the saved session is still valid, this tool returns success immediately and does not open the viewer. Call session_status first. Use force_reconnect only when the user explicitly wants to wipe the saved cookie and sign in again (destructive).
| Name | Type | Req | Description |
|---|---|---|---|
| force_reconnect | boolean | – | DESTRUCTIVE: delete the saved session cookie for this tenant, then open the viewer for a fresh sign-in. Do not set true unless the user explicitly asks to sign out / reconnect / clear session. |
No output schema declared.
No examples provided.
submit_build_and_press_submit ~123
Upload done: attach latest/build number/build_id to current version, then press Submit for Review in ASC via API.
| Name | Type | Req | Description |
|---|---|---|---|
| app_store_version_id | string | – | – |
| asc_app_id | string | – | – |
| build_id | string | – | – |
| build_number | string | – | – |
| build_selection | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| uses_non_exempt_encryption | string | – | – |
No output schema declared.
No examples provided.
submit_build_for_review ~183
Operator uploaded a new build: attach latest, build_number (ASC build version), or build_id to the current store version; optionally submit for review when confirm_submit_for_review=true.
| Name | Type | Req | Description |
|---|---|---|---|
| app_store_version_id | string | – | – |
| asc_app_id | string | – | – |
| attach_only | string | – | true = attach only, do not submit |
| build_id | string | – | – |
| build_number | string | – | e.g. 21 — matches builds.attributes.version |
| build_selection | string | – | – |
| confirm_submit_for_review | string | – | true = after attach, create review submission and PATCH submitted=true |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| uses_non_exempt_encryption | string | – | – |
No output schema declared.
No examples provided.
submit_for_review ~128
Press Submit for Review, restricted to apps on the probe/disposable allowlist (checked server-side) and gated behind confirm_probe_submit=true. For regular apps use press_submit_for_review or submit_build_and_press_submit instead; this tool exists only for automated testing against throwaway apps.
| Name | Type | Req | Description |
|---|---|---|---|
| app_store_version_id | string | – | – |
| asc_app_id | string | – | – |
| confirm_submit_for_review | string | yes | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
submit_testflight_beta_review ~239
Submit a processed build for TestFlight external Beta App Review (iris betaAppReviewSubmissions). Not App Store press_submit_for_review. Fills beta app description, what to test, contact, and privacy URL when provided. Poll get_testflight_public_link until accepting_public_testers is true before sharing the join URL.
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | yes | – |
| beta_app_description | string | – | – |
| beta_contact_email | string | – | – |
| beta_contact_first_name | string | – | – |
| beta_contact_last_name | string | – | – |
| beta_contact_phone | string | – | – |
| beta_feedback_email | string | – | – |
| beta_group_name | string | – | – |
| beta_marketing_url | string | – | – |
| beta_privacy_policy_url | string | – | – |
| beta_what_to_test | string | – | – |
| build_id | string | – | – |
| build_number | string | – | – |
| build_selection | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
update_app ~69
Update an existing app's name, primary locale, or bundle id (PATCH apps). Use when correcting app-level metadata after create_app.
| Name | Type | Req | Description |
|---|---|---|---|
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
No output schema declared.
No examples provided.
update_app_info_localization ~115
Update the localized app name, subtitle, and privacy policy URL for one locale (PATCH app info localization). Use for text shown on the App Store listing page, not screenshots.
| Name | Type | Req | Description |
|---|---|---|---|
| app_info_localization_id | string | – | – |
| app_name | string | – | – |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| privacy_policy_url | string | – | – |
| subtitle | string | – | – |
No output schema declared.
No examples provided.
update_app_review_information ~202
Create or update App Store review contact and demo sign-in for the current version (iris appStoreReviewDetail). Required before press_submit_for_review for login apps.
| Name | Type | Req | Description |
|---|---|---|---|
| asc_app_id | string | – | – |
| demo_account_name | string | – | Required when the app has sign-in (default). Omit only if requires_demo_account is false. |
| demo_account_password | string | – | Demo password for App Review. Pair with demo_account_name. |
| notification_message | string | – | Short user-facing sentence for this action if the follow-up reply fails. Plain text only; do not mention template syntax or variable names. |
| requires_demo_account | boolean | – | Default true. Set false only when the app has no user sign-in. |
| review_contact_email | string | yes | – |
| review_contact_first_name | string | yes | – |
| review_contact_last_name | string | yes | – |
| review_contact_phone | string | yes | – |
| review_notes | string | yes | – |
No output schema declared.
No examples provided.
How do I install the Apple Developer MCP by Nova (CIVAI) server?
Apple Developer MCP by Nova (CIVAI) is a hosted endpoint at https://nova.civai.co/mcp/agents/mcp-apple_developer, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · nova.civai.co
claude mcp add --transport http co-civai-nova-mcp-apple-developer 'https://nova.civai.co/mcp/agents/mcp-apple_developer'
What is the Apple Developer MCP by Nova (CIVAI) server?
Apple Developer MCP by Nova (CIVAI) is listed in the public MCP registry as co.civai.nova/mcp-apple_developer. Ship a new iOS app from chat. AI runs App Store Connect, builds, release, and submission through Ap… This page covers its hosted endpoint (https://nova.civai.co/mcp/agents/mcp-apple_developer).
Is the Apple Developer MCP by Nova (CIVAI) server safe to use?
Apple Developer MCP by Nova (CIVAI) scores 74 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Apple Developer MCP by Nova (CIVAI) server expose?
Apple Developer MCP by Nova (CIVAI) exposes 55 tools: login, session_status, list_bundle_ids, create_bundle_id, delete_bundle_id, and 50 more. Their descriptions and schemas cost roughly 6,055 tokens of context every time the server is loaded.
Does the Apple Developer MCP by Nova (CIVAI) server require authentication?
Yes. Apple Developer MCP by Nova (CIVAI) asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Apple Developer MCP by Nova (CIVAI) server still maintained?
Apple Developer MCP by Nova (CIVAI) is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.