Summary: The Appo MCP server lets an AI agent run the full Appo app lifecycle (create, configure, preview, publish, push, rejection recovery) plus local SDK code-generation and diagnostics.
App lifecycle (14 tools)
create_app / configure_app / set_icon / set_permissions — create and configure an app (name, base_url, prep_mode, icon, native permissions).
list_apps / get_app_overview — list owned apps; read config, publication state and metadata in one call (single-app default).
preview_app — open-on-device payload (TestFlight URL, Android deeplink, QR, readiness).
get_build_status — poll a build until ready/failed.
get_rejection / get_fix_recipe — curated required action and code-free remediation recipes.
publish_app / unpublish_app / send_push / trigger_resubmission — destructive actions requiring confirm:true, else return a preview envelope.
Local dev-tools (7 tools, no remote equivalent)
generate_hook / generate_component / scaffold_feature — emit React hooks, UI components, or full feature scaffolds for SDK features (push, biometrics, camera, location, haptics, storage, share, network, device).
validate_setup / check_permissions / diagnose_issue — validate SDK install and config, analyze permission patterns, diagnose integration issues.
generate_universal_links — emit apple-app-site-association + assetlinks.json with hosting instructions.
Cross-cutting behaviour
Auth resolves like the CLI: stored appo login profile, APPO_TOKEN, or APPO_API_BASE; unauthenticated calls return a structured not_authenticated envelope rather than crashing.
Errors are structured data (error, message, next_actions, HTTP status), with structuredContent plus a JSON text mirror.
Also exposes resources (appo://overview, api/{feature}, examples/{feature}, best-practices, troubleshooting) and prompts (setup_wizard, integrate_feature, debug_assistant).
Note: the schema exposes 21 tools, including set_permissions, which is absent from the README's stated inventory of 20.
Provides tools for generating React hooks, UI components, and complete feature scaffolding to integrate the Appo SDK's capabilities—such as push notifications, biometrics, and hardware access—into web applications.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Appo MCP generate a React hook for biometrics authentication"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Retired. The Appo MCP is the remote connector served by Appo itself:
https://apps.goappo.io/mcp. Register it withnpx @appolabs/appo mcp, or add it as an HTTP MCP server in your client (claude mcp add --transport http appo https://apps.goappo.io/mcp,codex mcp add appo --url https://apps.goappo.io/mcp). This package is no longer maintained.
Local MCP (Model Context Protocol) server for the Appo app
platform. It gives an AI agent the same app lifecycle outcomes as the appo CLI
— create, configure, preview, publish, push, rejection recovery, test builds,
resubmission — plus local code-generation dev-tools for the
@appolabs/appo SDK.
The server carries no API client of its own: every lifecycle call reuses the
CLI core (@appolabs/appo ops/api/config). Tool names mirror the canonical
/mcp AppoServer vocabulary documented in
apps-web-app/docs/CROSS-SURFACE-PARITY.md, so an agent sees one vocabulary
across both MCP surfaces.
Add to your .mcp.json:
{
"mcpServers": {
"appo": {
"command": "npx",
"args": ["-y", "@appolabs/appo-mcp"]
}
}
}Related MCP server: React Native Expo MCP
The server does not prompt for credentials or hold credential state. It resolves auth exactly as the CLI does, so both surfaces always target the same environment:
appo login once. After a device-flow login with the CLI, the token is
stored in the active profile (~/.appo/config.json). The server reads it
through the shared config module — no extra configuration.
APPO_TOKEN override. Set APPO_TOKEN to supply a PAT directly (CI /
non-interactive contexts); it takes precedence over the stored profile token.
Base URL / profile. APPO_API_BASE env → the active profile's api_base
→ http://localhost:8002. Profile selection: APPO_ENV → config current →
default.
If no token can be resolved, every lifecycle tool returns a structured
{ error: "not_authenticated", message, next_actions: [] } envelope (it never
crashes) — the message tells the operator to run appo login.
Reuse the CLI core; names match the canonical /mcp inventory.
Tool | Outcome | Gate |
| Create an app ( | — |
| Set content fields ( | — |
| Set the app icon from an https | — |
| List the apps owned by the authenticated principal | — |
| App config, publication state, and metadata in one read; single-app default when | — |
| Open-on-device payload (iOS TestFlight URL, Android deeplink, QR target, per-platform readiness) | — |
| Poll a build by id until | — |
| Curated required action for a rejected app (never raw reviewer text) | — |
| Code-free remediation recipes for the current rejection | — |
| Start publication to the chosen stores | confirm |
| Remove an app from the chosen stores | confirm |
| Send a push to the app's devices | confirm |
| Resubmit a rejected app for review (requires a customer-owned Apple credential) | confirm |
There is intentionally no ship tool and no publish-build trigger.
Agents chain create_app → publish_app (and trigger_resubmission for
rejection cycles). Build triggering is not exposed: the store-publish-kind build
is operator-internal (Nova Release), and self-serve verification is via preview_app
(the managed preview).
Operate on the local project; no CLI or remote-MCP equivalent by design.
Tool | Description |
| Generate a React hook for an SDK feature |
| Generate a UI component with SDK integration |
| Scaffold a feature (hook + component + types) |
| Validate SDK installation and configuration |
| Analyze permission-handling patterns |
| Diagnose common SDK integration issues |
| Emit |
Destructive tools (publish_app, unpublish_app, send_push,
trigger_resubmission) take an optional confirm: boolean. Without
confirm:true they perform no write and return a preview envelope
({ error: "confirm_required", will, ..., next_actions }) describing what would
happen. This mirrors the CLI's --confirm flag / exit-code-3 semantics at the
MCP idiom layer.
Errors are returned as structured data, never thrown. Every tool returns
{ error, message, next_actions } (plus status for HTTP errors). HTTP status
maps to a stable code: 401 → not_authenticated, 403 → forbidden,
404 → not_found, 409 → conflict, 422 → validation_error, otherwise
request_failed. Each response carries structuredContent (the canonical
envelope) and a JSON text mirror in content for text-only clients.
URI | Description |
| SDK overview and capabilities |
| API reference per feature |
| Code examples per feature |
| Integration best practices |
| Common issues and solutions |
Prompts: setup_wizard, integrate_feature, debug_assistant.
Features: push, biometrics, camera, location, haptics, storage, share, network,
device.
This release adopts the canonical tool vocabulary and the CLI-shared auth chain.
get_app removed — superseded by get_app_overview (single-call config +
publication state + metadata, with a single-app default).
update_app split into configure_app (content fields name/base_url
via PATCH /apps/{id}) and set_icon (POST /apps/{id}/icon, https
icon_url). update_app's catch-all field list (splash colors, injected
CSS/JS, path fields, …) is gone — webview injection is a dashboard concern and
is not on the CLI/MCP configure surface.
Env vars renamed — APPS_API_URL / APPS_API_TOKEN are no longer read.
Use the CLI-canonical APPO_API_BASE / APPO_TOKEN, or simply appo login
and let the server read the stored profile.
pnpm install
pnpm build # tsup (ESM + CJS + DTS)
pnpm dev # watch
pnpm typecheck # tsc --noEmit
pnpm test # vitestMIT
Analyze permission handling patterns in code for a specific SDK feature. Returns analysis with suggestions for proper permission flow.
Inputs: code (required), feature (required).
Configures an app's content fields (name, base_url) and who prepares it (prep_mode). Reversible - executes immediately. Content-only, matching the CLI apps update; icon is set_icon, webview injection is a dashboard concern.
Inputs: app_id (required), name, base_url, prep_mode.
Creates a new app for the authenticated user. Non-destructive — executes immediately. Authenticate once with appo login (or set APPO_TOKEN). Omit prep_mode when app source code is available in context.
Inputs: name (required), base_url (required), user_id, metadata_name, +1 more.
Diagnose common @appolabs/appo SDK integration issues. Provides diagnosis with solutions and code fixes.
Inputs: symptom (required), feature, platform, errorMessage.
Generate a UI component that uses @appolabs/appo SDK features. Returns a complete React component with SDK integration.
Inputs: feature (required), styling, variant, componentName.
Generate a custom React hook for an @appolabs/appo SDK feature. Returns TypeScript code with types, error handling, and loading states.
Inputs: feature (required), hookName, includeError, includeLoading.
Generate the well-known configuration files needed for iOS Universal Links and Android App Links. Returns apple-app-site-association and assetlinks.json with hosting instructions.
Inputs: ios_team_id (required), ios_bundle_id (required), android_package_name (required), android_sha256_fingerprint (required), +1 more.
Returns app configuration, publication state, and metadata in one call. Start here. If app_id is omitted and you own exactly one app, that app is used.
Inputs: app_id.
Returns the status of a build by id. Poll until the status reaches ready (then publish_app) or failed. Non-destructive.
Inputs: app_id (required), build_id (required).
Returns code-free Appo remediation recipes for the current rejection. Non-destructive.
Inputs: app_id (required).
Returns the Appo publication status and the curated required action for a rejected app. Never exposes raw reviewer text. Non-destructive.
Inputs: app_id (required).
Lists all apps owned by the authenticated user. Non-destructive.
Inputs: no named parameters.
Returns the open-on-device payload: iOS TestFlight URL, Android deeplink, QR target URL, and per-platform readiness. Non-destructive — executes immediately.
Inputs: app_id (required).
Starts publication to the chosen stores. Destructive — call with confirm:true to execute; without it returns a preview of the target stores.
Inputs: app_id (required), app_stores (required), confirm.
Scaffold complete feature integration including hook, component, and types. Returns multiple files with integration instructions.
Inputs: feature (required), directory, includeTests.
Sends a push to the app's devices. Destructive — call with confirm:true to send; without it returns a preview.
Inputs: body (required), title (required), app_id (required), confirm, +3 more.
Sets an app's icon from a publicly reachable https URL. The server fetches, validates, and stores the image. Reversible — executes immediately.
Inputs: app_id (required), icon_url (required).
Sets an app's native permissions. Pass permissions as an object of { name: boolean }; keys are tracking, camera, microphone, nfc. Only the keys you include change — the rest and every usage message are preserved. Reversible — executes immediately. Request only permissions the app actually uses (store-review discipline).
Inputs: app_id (required), permissions (required).
Resubmits a rejected app for review. Destructive — call with confirm:true to execute; without it returns a preview. Requires a customer-owned Apple credential.
Inputs: app_id (required), confirm.
Removes an app from the chosen stores. Destructive — call with confirm:true to execute; without it returns a preview of the target stores.
Inputs: app_id (required), app_stores (required), confirm.
Validate @appolabs/appo SDK installation and configuration. Analyzes package.json and optionally checks import patterns.
Inputs: packageJson (required), tsConfig, sampleCode.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 21 tools
Some tools have clear boundaries (create_app, list_apps, set_icon), but several overlap in purpose: generate_hook, generate_component, and scaffold_feature all produce SDK integration code, and diagnose_issue, get_fix_recipe, and get_rejection all deal with app rejection/diagnosis. The descriptions help somewhat, but an agent could easily confuse generate_hook with generate_component or diagnose_issue with get_fix_recipe.
Most tools follow a consistent verb_noun pattern (validate_setup, generate_hook, list_apps, configure_app, set_icon, publish_app, get_app_overview, send_push). Minor deviations exist: trigger_resubmission and generate_universal_links are longer but still verb-based, and scaffold_feature is a verb_noun pair. Overall the pattern is predictable.
21 tools is on the higher end but reasonable for a server covering both SDK code generation and app lifecycle management. The count is slightly heavy, but each tool addresses a distinct aspect of the Appo platform, and the two clusters (code generation vs. app management) justify the size.
The server covers the core app lifecycle well: create, list, configure, set icon/permissions, publish, unpublish, preview, build status, rejection handling, and push. Minor gaps exist: there's no delete_app or update_app (only configure_app for content fields), and no tool for managing team members or viewing analytics. The code generation side is also somewhat redundant but complete.
MCP server that lets your AI assistant build and deploy apps, hosting each one at a live URL.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Hosted MCP server connecting AI assistants to 9,000+ apps and 40,000+ actions via Zapier.
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
