Make an app store-ready from your coding agent

Your agent reads the app in front of it — SDKs, permissions, bundle id — and drafts every compliance page from what it finds. You read the drafts and publish them. The agent cannot.

Before you start

You need Claude Code and an AppFoyer account. The free plan is enough: create one, open Agent & API keys, and create a key. It is shown once.

Install

export APPFOYER_API_KEY=cpk_…
claude
/plugin marketplace add appfoyer/claude-plugin
/plugin install appfoyer@appfoyer

The plugin reads the key from that environment variable only — the skill never sees it, and it travels only in the Authorization header Claude Code fills in. Revoke a key in the dashboard and the next call fails immediately.

What to say

Run these inside your app's repository, not in an empty directory:

Say	What happens
`Make this app store-ready`	Scans the build files, confirms the facts it could not derive, drafts every page, returns a review link.
`Is this app store-ready?`	Read-only audit against the compliance checklist. Writes nothing.
`Wire the store-ready links into the app`	After you publish: proposes the in-app privacy and support links as a diff you review.

What leaves your machine

Only derived facts:

the app's name, platform and bundle or application id;
the names of the SDKs and permissions found in your build files;
the answers you confirm — company name, support email, jurisdiction, store URLs;
the page text the agent drafts, which is stored on your account as a draft.

Never file contents, never source code, never secrets or keys found in the repository. What the agent sends is what a privacy policy has to state anyway.

What the agent cannot do

The plugin authenticates with an API key, and an API key is an agent credential — so publishing is not available to it at all. This is enforced on the server, not by asking the agent nicely:

There is no publish tool. The agent writes drafts; your live pages do not change.
The REST route that publishes a page refuses API keys outright — session only.
Every page still passes the same content screening at publish time as a hand-written edit.
Every agent call is recorded in the account's audit log with the key that made it.

So the worst case for a compromised key is drafts you have to discard — not a page going public in your name.

The tools it gets

The plugin connects to an MCP endpoint that exposes exactly these:

Tool		What it does
`list_apps`	Read	Every app on the account with its slug, public URL, and whether anything is published.
`get_app`	Read	One app: settings, stored data-collection facts, and each page's live text, publish state and pending draft.
`create_app`	Write	Creates an app with template pages. Nothing is public.
`update_app`	Write	Changes settings or the stored data-collection facts. Never edits page text.
`set_page`	Write	Writes the draft for one page. The live page is untouched.
`set_ad_lines`	Write	Replaces app-ads.txt. Only used when an ad SDK is present and you supplied publisher ids.
`get_checklist`	Read	The server-computed store-readiness checklist, plus which pages still have unpublished drafts.
`request_publish`	Write	Says drafting is finished and returns the review URL. Publishes nothing.

When something goes wrong

Symptom	Cause
Tools do not appear in Claude Code	The key was not exported before `claude` started. Set it, then restart.
`unauthorized` on every call	The key was revoked in the dashboard, or it belongs to a different account. Create a new one and export it again.
Publishing returns a quota error	The plan's published-app limit is used up. The app and its drafts are kept — unpublish another app or upgrade, then publish from the review screen.
A draft comes back rejected or held	Content screening matched something. The reasons list what matched and how to fix it; edit and re-send. Nothing public changed.

One thing this does not change

The drafts are templates completed from your code, not legal advice. An agent writing them quickly does not make them true — read what it wrote before you publish, especially the list of what your app collects. You are the one the store holds responsible.

Questions: support@appfoyer.com.