From an empty folder to Submit for review.

2 · No avoidable rejections

You won't get rejected for the avoidable things.

storebound scan reads your project offline and read-only: Xcode and Gradle files, Info.plist, manifests, entitlements, lockfiles and engine settings, plus your config and listings. It works out the stack and the SDKs, then reports every rejection risk it can prove, each with the guideline, the evidence as file:line, the fix, a severity and the skill to open.

$ storebound scan
Rejection risks: 2 blocker, 3 high, 0 medium, 0 low
  1. BLOCKER 2.1(a) · App Store · Sign-in is required but there is no demo account for App Review
       at storebound.config.ts:12  reviewAccess: { signInRequired: true, instructions: 'Sign in with the demo account.' },
       at storebound.config.ts:11  accounts: { enabled: true },
       at Podfile.lock:3  Google Sign-In: GoogleSignIn 7.1.0
       fix: Create a demo account that sees every feature (not a sign-up the reviewer must do), put it in .storebound/credentials.json as reviewDemoAccount (never in the repo), then `storebound apple review-details`.
       skill: review-access · https://developer.apple.com/app-store/review/guidelines/
  2. BLOCKER 5.1.1(v) · App Store · Accounts can be created but no in-app account deletion was found
       at storebound.config.ts:11  accounts: { enabled: true },
       at Planner/LoginView.swift:11  Button("Create account") { Task { try await AccountApi.signUp() } }
       at Planner/LoginView.swift:17  static func signUp() async throws {
       fix: Add "Delete account" in the app (it deletes the account and its data, not only signs out; with Sign in with Apple also revoke the token), then set accounts.inApp to where it starts, e.g. "Settings > Account > Delete account".
… 3 more findings (4.8, 3.1.1, 5.1.2(i)), then the Data safety / App Privacy proposal

What it proves, on both stores

• 2.1(a)App access

  A sign-in with no demo account for the reviewer.

• 5.1.1(v)Account deletion

  Sign-up or social login without an in-app deletion path or a deletion URL.

• 4.8

  Google or Facebook login without Sign in with Apple or another equivalent option.

• 3.1.1, 3.1.2Payments

  No Restore Purchases path, card SDKs next to in-app products, missing subscription terms.

• 5.1.2Data safety

  Tracking SDKs without ATT; SDK data types missing from App Privacy or Data safety.

• 5.1.1, ITMS-91053

  Permissions without purpose strings; a missing or incomplete privacy manifest.

• Restricted permissions

  Background location, photos, all files, accessibility, exact alarms, foreground services, and the Console declaration each one needs.

• 1.3Families

  Ad or analytics SDKs in a Kids Category or child-directed app.

• Target API, 16 KB pages

  targetSdk below 36; Unity, React Native, NDK or AGP versions without 16 KB page support.

• 2.3.7, 2.3.10Metadata

  Other apps' names, "best / #1", keyword lists, other stores in App Store text, placeholder text.

• 2.2

  "Beta", "demo" or "test" wording in the app name and the listing.

• 4.3Repetitive content

  scan --originality --against <folders> adds the near-duplicate check against your other apps.

• 4.8 App Store guideline
• Families Google Play policy

Below the risks comes a proposal for Data safety, App Privacy, ATT and the privacy manifest from the detected SDKs, each answer marked detected or ask owner. Nothing is written unless you run scan --write. validate includes the open findings, and the desktop app shows them on its Checks tab.

4 · Works with your AI

Your AI coding agent drives it. Safely.

Skills, an MCP server and the CLI: the same tools for every agent. The skills are plain Markdown and the CLI is a normal command, so nothing requires a particular tool, or any agent at all.

• Claude Code
• OpenAI Codex
• Cursor
• GitHub Copilot
• Gemini CLI
• Windsurf
• OpenCode
• anything that reads AGENTS.md

/plugin marketplace add https://git.crt.fyi/CRT/storebound.git
/plugin install storebound@crtkafa

npx storebound install --agent codex

gemini extensions install https://git.crt.fyi/CRT/storebound.git

npx storebound install --agent cursor

npx storebound install --agent copilot

npx storebound install --agent windsurf

npx storebound install --agent opencode

$ storebound play products --dry
[play] 1/2 com.example.app.no_ads: would create · 174 regions · 2 listings (dry)
[play] 2/2 com.example.app.gems_100: would create · 174 regions · 2 listings (dry)
dry run: play products: 2 change(s); nothing written
item                      action  detail
------------------------  ------  ---------------------------------
com.example.app.no_ads    create  174 regions, 2 listings, USD 2.99
com.example.app.gems_100  create  174 regions, 2 listings, USD 0.99
[play] not on Google Play: com.example.app.no_ads, com.example.app.gems_100. If you created them in the last minutes, the store's list can lag a minute after creating; re-run before acting on this plan
[play] products checked (dry run, nothing written)

• Dry run everywhere

  Every write command takes --dry; every MCP write tool has dry_run, default true.

• The owner's buttons stay yours

  Submitting, releasing, completing a rollout, canceling a submission, deleting and creating offer codes are not MCP tools; the terminal commands ask first.

• Credentials stay local

  Store accounts once per machine in ~/.storebound/credentials (files only you can read, shared by the CLI and the desktop app), the rest in the project's gitignored .storebound/. Official store APIs only, with keys you create and can revoke, never your password.

• Idempotent writes

  Re-running converges (MD5 checks for screenshots and previews, one Play edit per language), so a failed upload is fixed by running it again.

• Personal data stays local

  Tester lists, the App Review demo account, reply drafts and reports live in .storebound/, masked in every log line.

• Careful with your devices

  storebound shuts down only a simulator it booted itself, and never boots, wipes or reboots an Android emulator or device.

you: Add a yearly Pro plan with a 1-week free trial and a monthly plan, on both stores.agent: Adding both to subscriptions in storebound.config.ts (USD 29.99 / 3.99, Turkey set by hand). Dry runs first.$ bunx storebound check
09:41:02 [check] config ok: storebound.config.ts
09:41:02 [check] subscriptions: 2 in 1 group(s)
09:41:02 [check] all good
$ bunx storebound apple subscriptions --dry
09:41:05 [apple] reading subscription groups, subscriptions, ...
09:41:07 [apple] 1/9 create subscription group "Tidy Pro"
09:41:07 [apple] 3/9 create pro_yearly (ONE_YEAR, level 1)
09:41:07 [apple] 6/9 pro_yearly: introductory offer FREE_TRIAL P1W
09:41:07 [apple] subscriptions planned (dry run, nothing written; ...) (5s)
$ bunx storebound play subscriptions --dry
09:41:10 [play] 1/2 pro_yearly: create, base plan yearly (P1Y) in 173 regions · intro offer intro (free)
09:41:10 [play] 2/2 pro_monthly: create, base plan monthly (P1M) in 173 regions
09:41:10 [play] subscriptions planned (dry run, nothing written) (3s)
agent: Plan matches the config. Create them on both stores?you: yes$ bunx storebound apple subscriptions && bunx storebound play subscriptions
09:42:31 [apple] group "Tidy Pro" created
09:42:33 [apple] 1/2 pro_yearly: created
09:42:52 [apple] subscriptions done (first ones are submitted with an app version: ...) (21s)
09:43:04 [play] pro_yearly: base plan yearly activated
09:43:05 [play] pro_yearly: offer intro created and activated
09:43:07 [play] subscriptions done (25s)
$ bunx storebound validate
 1. BLOCKER [apple] pro_yearly: no review screenshot
      fix: subscriptions[].reviewScreenshot, then storebound apple subscriptions
 2. warn    [apple] description without a Terms of Use link: tr (3.1.2; ...)
09:43:20 [validate] 1 blocker(s)
agent: Left for you: a paywall screenshot for the reviewer (I'll upload it), the Terms link in the Turkish description, and in App Store Connect, adding the first subscriptions to the version's submission (no API; I'll walk you through it).Submit for review · your click

1. 1

   Start in your app repo

   Pick a profile. Adds config and store files, never overwrites.

   TerminalCopy

   $ npx storebound init --profile app
   $ npx storebound desktop          # optional: installs the app once, opens this folder

   Profiles appsubscription-appgame

   • storebound.config.tsids, languages, products, Data safety
   • store/listing text, questionnaire answers, screenshot captions
   • .storebound/this app's upload key and review contact, gitignored

   storebound is installed once per machine; each project has its storebound.config.ts and .storebound/. Needs Node 20+ (or Bun↗ (opens in a new tab) 1.1+ with bunx), plus ffmpeg for icons, screenshots and video.

2. 2

   Describe the app once

   One config for both stores, checked offline.

   storebound.config.ts

   const config: ShipConfig = {
     app: { name: 'My App', profile: 'app' },
     languages: [
       { id: 'en', play: 'en-US', apple: 'en-US' },
       { id: 'tr', play: 'tr-TR', apple: 'tr' },
     ],
     play:  { packageName: 'com.example.app' },
     apple: { bundleId: 'com.example.app' },
   };

   TerminalCopy

   $ npx storebound check

   Store text lives next to it in store/listing.md and store/appstore.md, one section per language.

3. 3

   Add your store keys

   Official API keys you create and can revoke.

   ~/.storebound/credentials/default.jsononce per machineCopy

   {
     "PLAY_SERVICE_ACCOUNT": "/keys/play.json",
     "ASC_KEY_ID": "KEY_ID",
     "ASC_ISSUER_ID": "ISSUER_ID",
     "ASC_P8": "/keys/AuthKey_KEY_ID.p8"
   }

   A Play service account and an App Store Connect API key, once for every project on this machine (the desktop app's Accounts screen writes the same file; keys already in a project: npx storebound accounts import). Env vars work too. Never your password, never committed.

4. 4

   Connect your agent, ask in plain words

   It runs dry runs first and walks you through console-only forms.

   TerminalCopy

   $ npx storebound install --agent claude

   Or codex, cursor, copilot, gemini, windsurf, opencode (per tool). No agent? Every step is a CLI command too.

   • Set up my in-app products on both storesCopy
   • Make store screenshots in 14 languagesCopy
   • What still blocks my submission?Copy
5. 5

   Zero blockers, then you submit

   A read-only check of both stores, in fix order.

   TerminalCopy

   $ npx storebound validate

   1. Blockers, per store, in fix orderbuild, encryption, metadata, screenshots, review details, prices, products
   2. Fix, run again, until zeroread-only, so it is safe to run as often as you like
   3. You press Submit for reviewand Send changes for review on Play. Never the agent.