Skip to main content
Glama

ApproveKit

Audit an app for store and Google OAuth review

audit_app

Use before submitting a mobile or web app to the Apple App Store, Google Play or Google OAuth verification. Pass an inventory of what the app collects, which SDKs it uses and which Google scopes it requests (build it by reading the repo). Returns the problems reviewers are likely to reject, how to fix each one, and which paid package generates the missing documents. Free. The first call returns an app_token: save it in .approvekit.json at the project root and pass it on later calls so the app is updated instead of duplicated.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
app_tokenNoThe app_token returned by audit_app. It is stored in .approvekit.json at the project root. Omit on the first audit of an app.
inventoryYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare safety flags (readOnlyHint=false, idempotentHint=false, destructiveHint=false), so the description adds real value: it discloses that the first call mints an app_token, that omitting the token duplicates the app, that the audit is free, and that paid packages are cross-sold. The duplication behavior is consistent with idempotentHint=false. It doesn't state auth/permission requirements for the tool itself.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the when-to-use trigger, then output value, then the token mechanics. Four sentences, each doing distinct work; slightly dense but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema, so the description's summary of returns (likely-rejected problems, fixes, which paid package produces missing documents) is necessary and present, as is the token persistence workflow. It omits any mention of rate limits, auth, or error behavior, which are secondary here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only 2 params at 50% schema coverage, so the description must carry weight. It explains app_token lifecycle (first call returns it, save to .approvekit.json, pass on later calls) beyond the schema's own note, and summarizes what the inventory object should contain. It doesn't enumerate the required inventory fields, leaving that to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (audit an app for App Store / Play / Google OAuth review) and the exact trigger for running it. Siblings (create_checkout, get_order, publish_document) are unrelated domains, so no differentiation is needed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit about when to use it ('before submitting... to the Apple App Store, Google Play or Google OAuth verification') and how to prepare the inventory by reading the repo. No when-not guidance or named alternatives, which is a minor gap given no sibling overlaps.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.