Skip to content

ApproveKit

by approvekit.dev · remote · no sign-in to list tools · v0.1.0 · published by dev.approvekit

Audit apps against App Store, Google Play and Google OAuth review rules; get the required docs.

Final · 1Changes · 2
CompareRegistry entry

4 tools: 1 do something that can't be undone, 2 change things and 1 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http approvekit https://approvekit.dev/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Can't be undone 1Claude Code: ask
  • publish_documentSaves the final version of a document after every [CONFIRM: ...] placeholder has been resolved with the user.No findings

    Why it is in this group

    • The name "publish_document" says "publish": a word for a change that another call does not undo.
    Description, as the server wrote it
    Saves the final version of a document after every [CONFIRM: ...] placeholder has been resolved with the user. For privacy-policy and account-deletion this makes the hosted page live at its public URL; for the other kinds it just stores the final text. Call it again whenever the text needs an update (for example after the app adds a new data type).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 2Claude Code: ask
  • audit_appUse before submitting a mobile or web app to the Apple App Store, Google Play or Google OAuth verification.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Use before submitting a mobile or web app to the Apple App Store, Google Play or Google OAuth verification. Pass an inventory of what the app collects, which SDKs it uses and which Google scopes it requests (build it by reading the repo). Returns the problems reviewers are likely to reject, how to fix each one, and which paid package generates the missing documents. Free. The first call returns an app_token: save it in .approvekit.json at the project root and pass it on later calls so the app is updated instead of duplicated.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_checkoutCreates a Stripe Checkout link for one app.No findings

    Why it is in this group

    • The name "create_checkout" says "create": a word for a change.
    Description, as the server wrote it
    Creates a Stripe Checkout link for one app. Only call this after the user agreed to the purchase. Show the link to the user so they can pay; then call get_order with the returned order_id to receive the documents.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 1Claude Code: allow
  • get_orderReturns the payment status of an order.No findings

    Why it is in this group

    • The name "get_order" says "get": a word for reading.
    Description, as the server wrote it
    Returns the payment status of an order. Once paid, returns every generated document as Markdown plus the public URLs of the hosted privacy policy and account deletion pages, ready to paste into App Store Connect, Play Console or the Google OAuth consent screen.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http approvekit https://approvekit.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__approvekit__get_order"
    ],
    "ask": [
      "mcp__approvekit__audit_app",
      "mcp__approvekit__create_checkout",
      "mcp__approvekit__publish_document"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as approvekit. Review it before you use it.