|
| 1 | +# ASC MCP — Final Audit Report |
| 2 | + |
| 3 | +**Date**: 2026-02-18 |
| 4 | +**Scope**: 25 workers, 205 tools (94 read + 111 write) |
| 5 | +**Companies**: Awared SLU (primary), Wheele (write tests), FINDUS (cross-check) |
| 6 | + |
| 7 | +--- |
| 8 | + |
| 9 | +## Summary Table by Group |
| 10 | + |
| 11 | +| # | Group | Read tools | Write tools | ✅ | ⚠️ | ❌ | 🔇 | |
| 12 | +|---|-------|-----------|------------|-----|-----|-----|-----| |
| 13 | +| 1 | Companies, Auth, Apps | 16 | 3 | 15 | 3 | 0 | 1 | |
| 14 | +| 2 | Builds, TestFlight | 16 | 6 | 19 | 1 | 0 | 2 | |
| 15 | +| 3 | App Store Lifecycle | 9 | 9 | 15 | 1 | 0 | 2 | |
| 16 | +| 4 | Reviews | 5 | 2 | 6 | 1 | 0 | 0 | |
| 17 | +| 5 | Monetization | 28 | 28 | 47 | 4 | 0 | 5 | |
| 18 | +| 6 | Analytics + Metrics | 13 | 0 | 10 | 0 | 2 | 1 | |
| 19 | +| 7 | Screenshots | 3 | 9 | 12 | 0 | 0 | 0 | |
| 20 | +| 8 | Marketing (Events, CPP, PPO) | 11 | 16 | 27 | 0 | 0 | 0 | |
| 21 | +| 9 | Infrastructure (Provisioning, Users) | 12 | 12 | 22 | 0 | 0 | 2 | |
| 22 | +| **Σ** | | **113** | **85** | **173** | **10** | **2** | **13** | |
| 23 | + |
| 24 | +**Total**: 173 ✅ (87%) / 10 ⚠️ (5%) / 2 ❌ (1%) / 13 🔇 (7%) |
| 25 | + |
| 26 | +--- |
| 27 | + |
| 28 | +## Critical Issues (❌ FAIL) |
| 29 | + |
| 30 | +### 1. `metrics_list_diagnostics` — DUPLICATE + 404 |
| 31 | +**Worker**: MetricsWorker |
| 32 | +**Issue**: Identical to `metrics_build_diagnostics` — both call `/v1/builds/{id}/diagnosticSignatures`. Returns 404 for pre-release builds without explanation. |
| 33 | +**Recommendation**: Remove `metrics_list_diagnostics` or make it an alias. Add to both descriptions: "Available only for builds distributed via App Store (not pre-release)." |
| 34 | + |
| 35 | +### 2. `metrics_build_perf` — 404 for pre-release |
| 36 | +**Worker**: MetricsWorker |
| 37 | +**Issue**: Calling for a pre-release build returns 404. The description does not mention this limitation. |
| 38 | +**Recommendation**: Add to description: "Performance metrics available only for builds distributed via App Store. Pre-release/TestFlight builds return 404." |
| 39 | + |
| 40 | +--- |
| 41 | + |
| 42 | +## Medium-Severity Issues (⚠️ FIX) |
| 43 | + |
| 44 | +### Group 1: Companies, Auth, Apps |
| 45 | + |
| 46 | +#### 1.1 `apps_get_metadata` — incorrect version auto-select |
| 47 | +**Issue**: When called without `version_id` for iMapp (which has both iOS 5.4 and macOS 1.0 in PREPARE), it auto-selects macOS 1.0 instead of iOS 5.4. |
| 48 | +**Recommendation**: Auto-select should prefer iOS. Alternatively, explicitly specify the platform in the response. |
| 49 | + |
| 50 | +#### 1.2 `apps_get_metadata` / `apps_create_localization` — locale codes in description |
| 51 | +**Issue**: Descriptions reference `ru-RU`, `de-DE`, but the API actually uses `ru`, `de-DE`, `it`, `he`, `ja` (mixed formats). There is no single consistent rule. |
| 52 | +**Recommendation**: Update description to say: "Locale codes vary: some use language only (`ru`, `ja`), some use region (`en-US`, `de-DE`). Use `apps_list_localizations` to see actual codes." |
| 53 | + |
| 54 | +#### 1.3 `app_versions_list` — `states` filter does not work |
| 55 | +**Issue**: When using `states=PREPARE_FOR_SUBMISSION`, the API returns ALL versions. `filter[appStoreState]` is an incorrect parameter. |
| 56 | +**Recommendation**: Fix the API request to use `filter[appVersionState]` instead, or remove the `states` parameter from the description with a note: "use client-side filtering". |
| 57 | + |
| 58 | +### Group 2: TestFlight |
| 59 | + |
| 60 | +#### 2.1 `beta_testers_search` — partial match does not work |
| 61 | +**Issue**: Searching with `email=audit` does not find `audit-test@example.com`. Only exact match works. |
| 62 | +**Recommendation**: Description should state: "Email search is exact match only, not partial/wildcard." |
| 63 | + |
| 64 | +### Group 4: Reviews |
| 65 | + |
| 66 | +#### 4.1 `reviews_list` — territory format in description |
| 67 | +**Issue**: Description references `territory: US, RU, DE` (alpha-2), but the API returns territories in alpha-3 (USA, RUS, DEU in some contexts) and alpha-2 in filters. |
| 68 | +**Recommendation**: Clarify: "Use alpha-2 codes (US, RU, DE) for filtering. API returns alpha-2 in review objects (USA territory == alpha-3 from Apple)." |
| 69 | + |
| 70 | +### Group 5: Monetization |
| 71 | + |
| 72 | +#### 5.1 `subscriptions_list_prices` — no actual prices |
| 73 | +**Issue**: Returns opaque price point IDs without actual price amounts (USD, EUR, etc.). |
| 74 | +**Recommendation**: Include `include=subscriptionPricePoint` with `fields[subscriptionPricePoints]=customerPrice,proceeds` to display actual prices. |
| 75 | + |
| 76 | +#### 5.2 `promoted_get` — no linked IAP/subscription |
| 77 | +**Issue**: Response contains `enabled`, `state`, `visibleForAllUsers`, but no reference to the IAP or subscription that the promoted purchase is linked to. |
| 78 | +**Recommendation**: Add `include=inAppPurchaseV2,subscription` to retrieve linked product info. |
| 79 | + |
| 80 | +#### 5.3 `pricing_get_price_schedule` — opaque IDs |
| 81 | +**Issue**: `automaticPrices` contain opaque IDs without breakdown by territories/prices. |
| 82 | +**Recommendation**: Include `territory` and `subscriptionPricePoint` relationships for human-readable output. |
| 83 | + |
| 84 | +#### 5.4 `pricing_list_territory_availability` — territory code not visible |
| 85 | +**Issue**: Territories are returned with base64 IDs without a visible territory code. |
| 86 | +**Recommendation**: Include `territory` relationship to display the territory code. |
| 87 | + |
| 88 | +### Write Tests |
| 89 | + |
| 90 | +#### W.1 `app_events_update` — resets territory schedules |
| 91 | +**Issue**: When updating an event, `territorySchedules` becomes an empty array. |
| 92 | +**Recommendation**: Either add a `territory_schedules` parameter to update, or document: "Update does not preserve territory schedules. Re-set them after update." |
| 93 | + |
| 94 | +#### W.2 `app_info_create_localization` — `name` not marked as required |
| 95 | +**Issue**: API returns 409 if `name` is not provided ("You must provide a value for the attribute 'name'"), but in the tool description `name` is optional. |
| 96 | +**Recommendation**: Mark `name` as required in the description. |
| 97 | + |
| 98 | +#### W.3 `update_phased_release` — no way to obtain phased_release_id |
| 99 | +**Issue**: The tool requires `phased_release_id`, but no other tool returns this ID. |
| 100 | +**Recommendation**: `create_phased_release` should return the ID. Alternatively, add a `get_phased_release` tool that takes version_id. |
| 101 | + |
| 102 | +#### W.4 `app_versions_update` — verbose response |
| 103 | +**Issue**: Returns all relationships with full URLs (15+ nested objects). |
| 104 | +**Recommendation**: Return only updated attributes + id, without the full relationships dump. |
| 105 | + |
| 106 | +--- |
| 107 | + |
| 108 | +## Write Test Results (Wheele) |
| 109 | + |
| 110 | +| # | Test | Tools | Status | |
| 111 | +|---|------|-------|--------| |
| 112 | +| 1 | Beta Group CRUD | create → update → delete | ✅ | |
| 113 | +| 2 | Beta Tester CRUD | create → delete | ✅ | |
| 114 | +| 3 | Beta Group ↔ Tester/Build links | add_testers → remove_testers → add_builds → remove_builds | ✅ | |
| 115 | +| 4 | App Event CRUD + Localizations | create → update → create_loc → update_loc → delete_loc → delete | ✅ ⚠️ W.1 | |
| 116 | +| 5 | Metadata Update | update_metadata (whats_new + promo) | ✅ | |
| 117 | +| 6 | Version Localization CRUD | create_localization → delete_localization | ✅ | |
| 118 | +| 7 | Build Operations | update_encryption / set_beta_localization / update_beta_detail | ⚠️ encryption (expired) / ✅ / ✅ | |
| 119 | +| 8 | App Info CRUD | create_loc → update_loc → delete_loc | ✅ ⚠️ W.2 | |
| 120 | +| 9 | Custom Pages CRUD | create → update → list_versions → update_loc → delete | ✅ | |
| 121 | +| 10 | PPO CRUD | create_exp → update_exp → create_treatment → create_treatment_loc → delete | ✅ | |
| 122 | +| 11 | Promoted IAP CRUD | create → update → delete | ✅ | |
| 123 | +| 12 | IAP CRUD + Localizations | create → update → create_loc → update_loc → delete_loc → delete | ✅ | |
| 124 | +| 13 | Subscription CRUD | create_group → create_sub → update → create_loc → update_loc → delete_loc → delete_sub → delete_group | ✅ | |
| 125 | +| 14 | Offer Codes + Winback | offer_codes_create / winback_create | 🔇 SKIP (require pricing/approved sub) | |
| 126 | +| 15 | Reviews Response | create_response → delete_response | ✅ | |
| 127 | +| 16 | App Version Operations | update / set_review_details / update_age_rating | ✅ ⚠️ W.3, W.4 | |
| 128 | +| 17 | Phased Release + Attach Build | create_phased_release / attach_build | 🔇 (already exists / expired build) | |
| 129 | +| 18 | Beta Notification | send_beta_notification | 🔇 SKIP (sends real notifications) | |
| 130 | +| 19 | IAP Price + Submit + Screenshot | set_price_schedule / submit_for_review / create_review_screenshot | 🔇 SKIP (irreversible operations) | |
| 131 | +| 20 | Screenshots CRUD | create_set → create (upload reserve) → delete → delete_set | ✅ | |
| 132 | +| 21 | App Previews CRUD | create_preview_set → create_preview → delete_preview → delete_set | ✅ | |
| 133 | +| 22 | Screenshots Reorder | reorder | 🔇 SKIP (no uploaded screenshots) | |
| 134 | +| 23 | User Management | invite → cancel_invitation | ✅ | |
| 135 | +| 24 | Provisioning: Devices | register_device → update_device (disable) | ✅ | |
| 136 | +| 25 | Provisioning: Bundle ID + Capabilities | create_bundle_id → enable_capability → disable_capability → delete_bundle_id | ✅ | |
| 137 | + |
| 138 | +--- |
| 139 | + |
| 140 | +## Recommendations by Priority |
| 141 | + |
| 142 | +### P0 — Fix Immediately |
| 143 | +1. **Remove `metrics_list_diagnostics`** — full duplicate of `metrics_build_diagnostics` |
| 144 | +2. **`app_info_create_localization`: mark `name` as required** — misleading, API always requires it |
| 145 | + |
| 146 | +### P1 — Fix in the Next Release |
| 147 | +3. **`app_versions_list`: fix `states` filter** — use `filter[appVersionState]` instead of `filter[appStoreState]` |
| 148 | +4. **`apps_get_metadata`: auto-select iOS over macOS** when both platforms are in PREPARE |
| 149 | +5. **`update_phased_release`: ensure phased_release_id is obtainable** — via create_phased_release response or a new getter |
| 150 | +6. **`subscriptions_list_prices`: add actual prices** — include price point relationships |
| 151 | +7. **`app_events_update`: add territory_schedules** parameter or document the reset behavior |
| 152 | + |
| 153 | +### P2 — Improve When Possible |
| 154 | +8. **`beta_testers_search`: document exact match** for email |
| 155 | +9. **Locale codes**: unify descriptions — note that formats are mixed |
| 156 | +10. **`reviews_list`: clarify territory format** in description (alpha-2 for filters) |
| 157 | +11. **`promoted_get`: include linked IAP/subscription** info |
| 158 | +12. **`pricing_*`: include territory codes** in human-readable format |
| 159 | +13. **`metrics_build_perf`: add to description** the pre-release limitation |
| 160 | +14. **`app_versions_update`: minimize response** — remove relationships dump |
| 161 | +15. **`builds_update_encryption`: improve error message** for expired builds |
| 162 | + |
| 163 | +--- |
| 164 | + |
| 165 | +## Overall Assessment |
| 166 | + |
| 167 | +**The server is in good working condition.** Out of 205 tools: |
| 168 | +- **173 (87%)** work correctly with no issues |
| 169 | +- **10 (5%)** require minor fixes (descriptions, response formats) |
| 170 | +- **2 (1%)** — critical bugs (duplicate + missing pre-release warning) |
| 171 | +- **13 (7%)** — skipped (impossible or dangerous to test) |
| 172 | + |
| 173 | +All CRUD cycles on Wheele passed successfully. Creating, updating, and deleting entities works reliably. Post-test cleanup was performed in full. |
| 174 | + |
| 175 | +### Post-Audit Cleanup |
| 176 | +- All test entities (beta groups, testers, events, IAP, subscriptions, custom pages, experiments, promoted purchases, screenshots, previews, bundle IDs, invitations) have been deleted |
| 177 | +- The only remaining artifact: disabled device `AUDIT-TEST-DEVICE-DISABLED` (UDID: 00000000-0000000000000001) — the Apple API does not allow deleting devices, only disabling them |
| 178 | +- On Wheele v4.5, the following were updated: What's New (en-US), promotional text, copyright, review details, release type (MANUAL). All of these were test data — **it is recommended to review them before an actual release**. |
0 commit comments