CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions
storebound/docs/mcp.md
CRT 710c3a53d0 README, docs and site: one story (the whole job, no avoidable rejections, the desktop app, your AI, install) 
README is a short front page (about 120 lines) with one real visual per section; every former section moved
unchanged into docs/*.md with a docs/README.md index (journey, rejections, getting-started, commands, growth,
studios, store-art, listing-languages, api, skills, mcp, safety, faq, project). The site tells the same story on one
page: the teaser in the hero, real CLI output as text, the desktop app as a section with light/dark captures of eight
screens and the per-system downloads (desktop/latest.json); /desktop/ redirects to /#download. New capture tools:
tools/site-desktop-shots.ts (fixture-mode desktop frames) and tools/site-term-shots.ts (real CLI output as text and
WebP). tests/docs-links.test.ts checks README, docs and site links resolve.
2026-10-13 03:29:59 +08:00

3.9 KiB
Raw Blame History

MCP server and the desktop machine interface

storebound mcp speaks MCP over stdio, tools only: spec revision 2026-07-28 (stateless: server/discover, per-request _meta, resultType, cacheable tools/list) and, on the same process, clients that still open with initialize (2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05). It runs each tool as a CLI call in the project directory (the server's working directory, or STOREBOUND_PROJECT) and returns the output.

  • One tool per command. Read-only: scan, check, check_aso, aso_competitors (no snapshot saved), aso_suggest (never writes), aso_audit, validate, catalog_diff, health, reviews_list, prices_diff, analytics_compare, apple_status, apple_next_build, apple_testflight_status, apple_ppo_status, play_status, play_next_version_code, privacy_manifest, shots_check, workspace_list, workspace_status, release_status, release_plan, flow_list, flow_run (dry mode only), listing_check, api_get (any App Store Connect or Google Play GET operation by id). Local writes: import_fastlane, whats_new, listing_translate, icons, health_report, reviews_draft, prices_export, analytics_snapshot, shots_capture, shots_render, shots_gallery, shots_record, shots_video. Store writes: play_listing, play_images, play_products, play_data_safety, play_subscriptions, play_release_testing, apple_bundle, apple_iap, apple_iap_review, apple_subscriptions, apple_listing, apple_screenshots, apple_previews, apple_appinfo, apple_review_details, apple_encryption, apple_phased_release, apple_testflight_groups, apple_testflight_what_to_test, apple_testflight_info, apple_testflight_distribute (internal groups only), apple_ppo_create, apple_ppo_upload, analytics_setup.
  • Annotations say what is read-only, destructive (replaces data), idempotent and network-bound.
  • No MCP SDK: a small newline-delimited JSON-RPC server (server/discover, initialize, ping, tools/list, tools/call, cancellation), so storebound keeps zero runtime dependencies.

Manual config for a tool that install does not know: command bunx with args ["storebound", "mcp"] (or the absolute path of bin/storebound plus mcp).

Desktop machine interface

storebound serve --stdio is what the desktop app (apps/desktop, in progress) runs as its sidecar: newline-delimited JSON-RPC on the same core as the MCP server (tool list, validation, forbidden flags, child-process runner), with typed methods (check, validate, apple.status, play.listing, ... plus project.inspect and portfolio.status over many project folders), structured results (the commands' --json output), progress notifications and cancellation. The first request is session.hello with a per-session secret only the host knows. Write methods are dry runs unless the call carries a single-use confirm token (HMAC over method, arguments and expiry) that the host mints after the owner confirmed a native dialog showing that dry run. Sending for review is there only as owner actions (owner.apple_submit, owner.apple_resubmit, owner.apple_iap_submit, owner.play_production, next to the rollout, phased release, price and reply owner actions): the window shows the plan (dry run) with the build or versionCode the owner picked by number, then a native dialog, and only the host's token after that dialog runs it. Nothing publishes, releases an approved version or cancels a submission, and the MCP server (AI tools) has none of the owner actions. Play's "Send changes for review" has no API: the Releases tab shows its console plan and a deep link. Types: cli/lib/desktop-protocol.ts. bun tools/build-sidecars.ts compiles the CLI for macOS, Linux and Windows (bun build --compile). Design, safety model and the Dependencies screen (tool sources and licenses): docs/desktop.md.

All docs · README