Skip to main content
Glama

Raven

by ai.ravenmcp

audit_ios_privacy

Read-onlyIdempotent

Audit an iOS or React Native/Expo app's privacy posture for App Review and user trust. Reads a native Info.plist XML OR an Expo app.json (managed Expo apps have no Info.plist) — plus optional PRIVACY.md, entitlements, and source. Flags: NS*UsageDescription strings that are vague/missing or contradict the code (e.g. a HealthKit write claim the code never fulfills), entitlements/permissions and Android permissions the app doesn't use, ATS cleartext exceptions and non-HTTPS endpoints, secrets/keys shipped in the bundle or app.json, and default data-egress paths not disclosed at the point of choice (a pre-selected 'Recommended' option that silently sends personal data to a server). Same return shape as audit_page.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
sourceNoOptional concatenated source (Swift or JS/TS) — enables code-vs-declaration contradiction checks and default-egress detection
app_jsonNoExpo app.json / app.config JSON (managed RN). Its expo.ios.infoPlist, expo.android.permissions, plugins, and extra are audited.
info_plistNoRaw Info.plist XML (native iOS / bare RN). Provide this OR app_json.
privacy_mdNoOptional PRIVACY.md / privacy policy text to cross-reference against declared permissions and default behavior
entitlementsNoOptional .entitlements XML

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, and the description aligns by stating it 'Reads' inputs. It adds meaningful behavioral detail beyond the annotations: the specific audit checks (contradiction detection, unused permissions, ATS exceptions, secrets, data-egress) and the OR-requirement between Info.plist and app.json.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured: a purpose sentence, an input sentence, and a flag list. It is longer than typical but each clause adds information, and the main verb is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and five optional parameters, the description covers the tool's behavior well. It mentions the return shape via 'Same return shape as audit_page' and lists the major audit categories, making it usable for an agent. Minor gap: no explicit mention of error cases or format requirements for the XML/JSON inputs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so each parameter is individually documented. The description adds inter-parameter context: it explains that Info.plist and app.json are mutually exclusive alternatives, and that 'source' enables code-vs-declaration checks, which is beyond the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Audit') and resource ('iOS or React Native/Expo app's privacy posture') and clearly differentiates from sibling audit_* tools by focusing on privacy concerns like NS*UsageDescription strings, entitlements, and data-egress paths.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly identifies the intended use case ('for App Review and user trust') and input requirements (Info.plist OR app.json, with optional PRIVACY.md, entitlements, source). However, it does not explicitly name alternatives or exclusion criteria, so it stops short of the highest rating.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Raven toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.7/5.0
Disambiguation4/5

Most tools have clearly distinct purposes (audit_* vs get_* vs list_* vs generate_* vs score_*), but there is notable overlap among audit_page, audit_layout, score_page, and audit_url (all audit rendered HTML, with audit_page and score_page explicitly sharing checks; audit_screen and audit_ios_screen are aliases). The get_* family (get_pattern vs get_content_pattern vs get_service_pattern, get_principles vs get_brand_principles vs get_content_principles) have overlapping boundaries that may cause misselection.

Naming Consistency4/5

Names follow a consistent verb_noun pattern (audit_*, get_*, list_*, generate_*, score_*, compose_*, suggest_*, search_*), which is predictable and readable. Minor deviations exist: 'evaluate_design' uses evaluate_ instead of audit_/score_, and 'process' isn't present but 'compose_system' uses compose_ instead of generate_/get_. Overall the convention is strong and consistent.

Tool Count2/5

45 tools is far beyond the typical well-scoped server (3-15 tools) and even beyond the 'heavy' 25+ threshold. The server appears to be an all-in-one design/UX knowledge base and auditing suite, but the sheer count makes discovery and selection overwhelming, and many tools (e.g., multiple audit_* variants for mobile platforms) could be consolidated.

Completeness3/5

The server covers a wide domain: audits for web/mobile/RN/SwiftUI, design tokens, UX principles, content systems, business strategy, creative scoring, and service design. However, there are gaps: no tool for creating or editing design systems (only get/generate), no update/delete operations anywhere (all read-only or audit-only), and the creative side has list/score but no generation tool. The set feels broad but shallow in lifecycle coverage.

Resources