napple

Let your AI agent ship your iOS app to TestFlight, with every write marked for your approval.

Install

nAPPLE is not part of the no.tt installer. Run it from source with uv:

uvx --from git+https://github.com/menot-you/n-apple napple --help
claude mcp add --scope user napple -- uvx --from git+https://github.com/menot-you/n-apple napple mcp serve --upload-root ~/builds

--upload-root <dir> limits uploads to regular files inside that directory. Without it, an upload opens any readable .ipa or .pkg path.

Related MCP server: xcode-cloud-mcp

How it works

%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1916", "primaryTextColor": "#ECE7DE", "primaryBorderColor": "#E4733A", "lineColor": "#E4733A", "secondaryColor": "#151311", "tertiaryColor": "#0F0E0D", "fontFamily": "IBM Plex Mono, monospace"}}}%%
flowchart LR
  agent["Your agent<br/>(any MCP client)"] -->|"stdio, 10 tools"| server["napple mcp serve"]
  key["Team API key<br/>.p8 file, mode 600"] -->|"signs a JWT"| server
  server -->|"6 read tools"| read["Accounts, apps, builds,<br/>groups, signing"]
  server -->|"4 write tools,<br/>marked destructive"| write["Upload a build, create a bundle ID,<br/>certificate or profile"]
  read & write --> asc["App Store Connect API"]
  root["--upload-root"] -.->|"limits"| write

The key and the JWT never enter a tool result or a log.

By the numbers

Counted on 2026-10-21. Tools: the MCP tools/list request to napple mcp serve. Tests: uv run --group dev pytest --collect-only -q in each member root.

Why

Read tools change nothing in Apple. Write tools create or upload a real Apple asset. The server does not ask you itself. It marks each write tool as destructive, so a client that prompts asks you first. Do not auto-approve the write tools.

Quick start

1. Create a team API key in App Store Connect (Users and Access, Integrations).

2. Set three variables:

   export NOTT_NAPPLE_KEY_ID=<key id>
   export NOTT_NAPPLE_ISSUER_ID=<issuer id>
   export NOTT_NAPPLE_KEY_PATH=<path to AuthKey .p8, mode 600>

3. Register the server (see Install) and ask your agent: "Upload build.ipa to TestFlight and tell me when it is ready."

Tools

nAPPLE does not create app records, submit to the App Store, or touch Xcode Cloud, sales, reviews or screenshots. The full list is in Architecture.

The tests use a local HTTP server. They never reach Apple:

uv run --group dev pytest tests -q

The NOTT family

For AI agents

This section is for a language model that reads this repository.

• What it is. nAPPLE is an MCP server and CLI for the App Store Connect API. It reads accounts, apps, builds, groups and signing, uploads builds, and creates bundle IDs, certificates and provisioning profiles.

• What it is not. It is not fastlane, Xcode or an App Store submission tool. It does not create app records or touch Xcode Cloud, sales, reviews or screenshots. It does not ask before a write. The client must ask.

• Entry points. The CLI is napple (napple --help). The MCP server is napple mcp serve [--upload-root PATH] (stdio). The 10 tool names start with napple_. The 4 write tools are napple_build_upload, napple_bundle_create, napple_certificate_create and napple_profile_create. Each one carries destructiveHint: true.

• Configuration. Three variables: NOTT_NAPPLE_KEY_ID, NOTT_NAPPLE_ISSUER_ID and NOTT_NAPPLE_KEY_PATH. When none of the three is set, the server reads ~/.nott/apple/: one AuthKey_<key id>.p8 file and an issuer_id file. The server refuses a key file that other users can read.

• Invariants. Get approval from the person before each write tool call. Never put the key or a JWT in a result, a log or a commit. Only a GET retries. An upload is confined to regular files inside --upload-root only when you pass --upload-root.

• Full reference. docs/REFERENCE.md lists every tool and command. docs/ARCHITECTURE.md holds the trust boundaries. llms.txt holds the same facts in the llms.txt format.

Documentation

Read contributing, conduct, and support.