QAmcp

Copied. Paste it into Claude Code, Cursor or Codex:Fetch and follow the instructions at https://qamcp.dev/setup.md to test my MCP server.

Your AI finds your server in your project, tests it with QAmcp, explains what's wrong in plain words, fixes it with your OK, and tests again. Read the instructions

SoonYour score can change any day. QAmcp Monitor tests your server every hour and emails you when it breaks.See what Monitor does →

Directory / Apple Developer MCP by Nova (CIVAI)

Apple Developer MCP by Nova (CIVAI)

Q: Is Apple Developer MCP by Nova (CIVAI) server safe?

QAmcp's test on 2 Nov 2026: None of the hidden-instruction wordings we know were found in its tool descriptions. 0 of its 55 tools are labeled read-only; the others may change or send things. Overall it scored 74/100 on 2 Nov 2026. A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

by nova.civai.co · https://nova.civai.co/mcp/agents/mcp-apple_developer

Ship a new iOS app from chat. AI runs App Store Connect, builds, release, and submission through Ap…

55 tools✓ no account neededPricing: not listed

Visit website

74 /100

PASS · WITH NOTES

Partial: 9 of 12 checks · 2 Nov 2026

Is Apple Developer MCP by Nova (CIVAI) server safe?

None of the hidden-instruction wordings we know were found in its tool descriptions.
0 of its 55 tools are labeled read-only; the others may change or send things.
Overall it scored 74/100 on 2 Nov 2026.

A test can only see what the server shows from outside, not what it does with your data behind the scenes. Connect servers from makers you trust.

What it can do

55 tools, in the server's own words.

login

After operator completes Apple IDMSA in a browser, verify Developer portal session (checkPermissions).

session_status

ASC session check

list_bundle_ids

List bundle IDs registered on developer.apple.com for the current team.

create_bundle_id

delete_bundle_id

Remove a bundle ID from developer.apple.com (requires Developer Identifiers session from start_browser_auth).

list_asc_api_keys

List App Store Connect API team keys and the team issuer id (for EAS / CI).

create_asc_api_key

Create an App Store Connect API team key.

download_asc_api_key

Download the one-time .p8 private key for an existing API key when canDownload is still true.

revoke_asc_api_key

Permanently revoke an App Store Connect API team key (cannot be undone).

get_bundle_id

Get details for one existing bundle ID by its ASC resource id.

list_apps

List apps visible to the current App Store Connect session.

list_app_bundles

List ASC app bundles (iris GET /appBundles).

create_app_bundle

Create ASC app bundle (may 403 if tenant allows GET only).

create_app

Create App Store Connect app

get_app

Get one app's details (name, bundle id, SKU) by asc_app_id.

update_app

Update an existing app's name, primary locale, or bundle id (PATCH apps).

probe_update_version_localization

PATCH app store version localization promotional text (requires asc_app_id / localization_id on tenant).

update_version_localization

Update the current app store version's description, keywords, promotional text, what's new, support URL, or marketing URL for one localization (PATCH app store…

get_testflight_public_link

Create or reuse an external TestFlight group, attach a processed build, enable the public join link, and return https://testflight.apple.com/join/… Requires as…

submit_testflight_beta_review

Submit a processed build for TestFlight external Beta App Review (iris betaAppReviewSubmissions).

list_builds

List ASC builds for asc_app_id (newest first).

submit_build_for_review

Operator uploaded a new build: attach latest, build_number (ASC build version), or build_id to the current store version; optionally submit for review when con…

upload_build

Upload a .ipa to App Store Connect via Transporter on the replay host.

set_version_build

Set which build is attached to an app store version without also running export-compliance or wait-for-processing steps.

and 31 more

Test results

Safe mode: only tools labeled read-only were run. How the test works

!
Ready for the newest MCP version
1 warning
- !Uses an older MCP version (2025-11-25). It works today, but it isn't on the July 2026 version (2026-07-28) yet.
note
!
Every tool is described
35 warnings
- !session_status: Description is very short (17 characters)
- !create_bundle_id: Inputs with no description: bundle_id, bundle_display_name, bundle_platform
- !create_asc_api_key: Inputs with no description: api_key_nickname, api_key_role
- !download_asc_api_key: Inputs with no description: api_key_id
- !revoke_asc_api_key: Inputs with no description: api_key_id
- !create_app: Inputs with no description: bundle_id, app_name, sku, primary_locale, version_string
- !probe_update_version_localization: Inputs with no description: promotional_text, localization_id
- !update_version_localization: Inputs with no description: localization_id, description, keywords, promotional_text, whats_new, support_url, marketing_url
- and 27 more
note
!
Tools are labeled safe or dangerous
5 warnings
- !55 of 55 tools have no safety label (read-only or dangerous): login, session_status, list_bundle_ids, create_bundle_id, delete_bundle_id, list_asc_api_keys, create_asc_api_key, download_asc_api_key, revoke_asc_api_key, get_bundle_id, list_a
- !delete_bundle_id: Name sounds like it deletes something, but it is not labeled dangerous
- !revoke_asc_api_key: Name sounds like it deletes something, but it is not labeled dangerous
- !delete_orphan_review_submissions: Name sounds like it deletes something, but it is not labeled dangerous
- !delete_screenshots: Name sounds like it deletes something, but it is not labeled dangerous
note
!
Follows MCP best practices (not scored yet)
2 tips (not scored)
- !55 tools not labeled read-only don't say whether running them twice is safe (idempotentHint): login, session_status, list_bundle_ids, create_bundle_id, delete_bundle_id, list_asc_api_keys and 49 more
- !55 tools don't say whether they reach outside services like the web (openWorldHint): login, session_status, list_bundle_ids, create_bundle_id, delete_bundle_id, list_asc_api_keys and 49 more
note
!
Resources and prompts work
1 warning (3 resources)
- !civai-secops://apple_developer/@public/CAPTCHA_AGENT.md: The content contains "don't tell the user". If an AI reads this, it may follow it. Check where this text comes from.
- and 2 more
note
✓
ConnectsConnected in 226 ms
pass
✓
Lists its toolsFound 55 tools
pass
✓
No known hidden instructionsNone of the hidden-instruction wordings we know were found in tool descriptions. New wordings can get past this check.
pass
✓
Fast enough
All good
- ✓Connecting took 226 ms
- ✓Listing tools took 175 ms
pass
–
Tools work with good inputs
Not tested
- –login: Not run: no safety label (if you own this server, test again in owner mode)
- –session_status: Not run: no safety label (if you own this server, test again in owner mode)
- –list_bundle_ids: Not run: no safety label (if you own this server, test again in owner mode)
- –create_bundle_id: Not run: no safety label (if you own this server, test again in owner mode)
- –delete_bundle_id: Not run: name sounds like it deletes something
- –list_asc_api_keys: Not run: no safety label (if you own this server, test again in owner mode)
- –create_asc_api_key: Not run: no safety label (if you own this server, test again in owner mode)
- –download_asc_api_key: Not run: no safety label (if you own this server, test again in owner mode)
- and 32 more
not tested
–
Bad inputs give a clean errorNot tested
not tested
–
Tools work togetherNo safe tool returned data to start a chain from, so chains were not tested (not counted either way)
not tested
–
No secrets leakedNo error messages to check
not tested

Test it yourself

Free and open source. Same checks, same score.

npx qamcp-cli https://nova.civai.co/mcp/agents/mcp-apple_developer

Show this score on GitHub

Free for every server in the directory. Paste this into your README: the badge shows the score from our latest test.

[![QAmcp score](https://qamcp.dev/s/co-civai-nova-mcp-apple-developer.svg)](https://qamcp.dev/s/co-civai-nova-mcp-apple-developer.html)

Score over time

2 Nov 202674

One test so far. New tests will show here.

Reviews

Coming soon: reviews from people who use Apple Developer MCP by Nova (CIVAI), signed in with GitHub, one per person. Reviews never change the score.

Is this your server? Get an alert the moment it breaks.

QAmcp Monitor (coming soon) tests it every hour and emails you when it goes down, the score drops, a tool changes or a secret leaks. You'll also be able to claim this page and get a verified owner mark. Founding price: $19/month for life for the first 50 teams.

Have a concern, or want it removed? Ask us and we'll take it off the list. How the directory works