Install
$ agentstack add mcp-kelvinkosbab-appbootstrapai ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
AppBootstrapAI
A drop-in bundle of AI agent steering — rules, skills (Claude), and MCP recipes — for bootstrapping new app projects. Covers Apple platforms (iOS, macOS, tvOS, watchOS, visionOS) and Android in one bundle, so single-platform and mixed-stack teams can share one source of truth. Works with Claude Code, GitHub Copilot, Cursor, Gemini CLI, Codex CLI, and Amazon Kiro out of the box (./install.sh --agents writes the right files per agent).
One install.sh bootstraps modern review, testing, style, accessibility, and localization guidance into any new or existing app repo — and keeps it up to date with --upgrade. Day-one consistency without writing the rules yourself; day-N reproducibility without drifting from upstream.
Claude Code is the default target, but the installer can write for other agents too. Pass --agents copilot,cursor,gemini,codex,kiro (or all) and install.sh drops the right file shape per agent: .github/copilot-instructions.md, .cursor/rules/*.mdc, GEMINI.md, AGENTS.md, .kiro/steering/*.md. Skills stay Claude-only. For Cline / Goose / Roo / Windsurf etc., layer a sync tool — see [Using with non-Claude AI agents](#using-with-non-claude-ai-agents) below.
Get started in one line: ./install.sh setup runs a guided flow that detects whether you're creating, adopting, or updating — and walks you through the rest. Prefer flags? See [Getting started](#getting-started).
Contents
[What you get](#what-you-get) · [Getting started](#getting-started) · [Quick start](#quick-start) · [How it fires](#how-it-fires) · [Using AI to install](#using-ai-to-install) · [Upgrading](#upgrading-an-existing-install) · [Removing](#removing-the-install) · [Saving AI tokens](#saving-ai-tokens) · [Non-Claude agents](#using-with-non-claude-ai-agents) · [Repo layout](#repo-layout) · [Extending](#extending-for-your-project) · [Roadmap](#roadmap)
What you get
The 30-second view. Expand any section below for the full rule-by-rule detail, or run ./install.sh --list --features all for the always-current catalog.
| Area | What's inside | |------|---------------| | Apple rules | Swift 6 concurrency · SwiftUI MVVM · accessibility · testing · DocC · localization · SPM · linting · logging · Foundation Models · visionOS · TestFlight · Objective-C | | Android rules | Kotlin/Compose/MVVM/Hilt · coroutines · accessibility · testing · KDoc · localization · Gradle · linting · logging · Play beta | | Skills (Claude) | 9 Apple + 5 Android on-demand deep-review agents | | Agents | One rule source → Claude Code, Copilot, Cursor, Gemini, Codex, Kiro | | MCP recipes | XcodeBuildMCP · Xcode-native · android-mcp-server · Firebase · Sentry | | Lifecycle | guided setup · install · upgrade (3-way diff — never clobbers your edits) · uninstall |
Apple — 14 rules + 9 skills (click to expand)
apple-swift6-strict-concurrency.md— Swift 6.4 strict concurrency (Xcode 27 toolchain; language mode.v6), enforced on every.swiftfile.apple-accessibility-best-practices.md— VoiceOver, Dynamic Type, Reduce Motion for SwiftUI (including streaming AI text).apple-foundation-models.md— Apple Foundation Models patterns: session ownership, two-level availability gating, streaming placeholder-then-mutate,Task.isCancelleddiscipline, protocol + mock + simulator testability.apple-swiftui-mvvm.md— SwiftUI MVVM conventions: when to extract a view model,@Statevs@Bindableownership, dependency plumbing, what stays on the View vs the view model, splitting large VMs across extension files.apple-objc-best-practices.md— Modern Objective-C for legacy / mixed-language codebases: ARC discipline, nullability, lightweight generics,instancetype, designated initializers, modern literals/blocks, Swift bridging-header conventions.apple-objc-accessibility-best-practices.md— UIKit accessibility in Objective-C:accessibilityLabel/accessibilityHint/accessibilityTraitsdiscipline,accessibilityIdentifiervsaccessibilityLabel, Dynamic Type viapreferredFontForTextStyle:,UIAccessibilityIsReduceMotionEnabled(), VoiceOver announcements (UIAccessibilityPostNotification), modal-focus management (accessibilityViewIsModal), custom-action support.apple-testing-strategy.md— what to test (and what not), Given/When/Then naming, determinism (inject clocks/UUIDs/network), Swift Testing vs XCTest split, XCUITest discipline, CI coverage gates with sensible exclusions.apple-documentation-strategy.md— what to document (and what not), DocC discipline (summary line,- Parameter/- Returns/- Throws, double-backtick symbol linking,## Topicsorganization), deprecation discipline with mandatory migration paths, when to write a DocC Article vs. a doc comment.apple-localization-best-practices.md— String Catalogs (.xcstrings) as the modern format, type-safeStringsenum facade pattern,LocalizedStringResourceoverNSLocalizedString, plurals, locale-aware.formatted()for numbers/dates/currency, RTL via leading/trailing modifiers, translator-context comments.apple-spm-package-conventions.md—Package.swiftauthoring:swift-tools-versiondiscipline, mandatoryplatforms:, flat per-module folder layout ({Module}/Sources/+{Module}/Tests/, matching KozBon and BasicSwiftUtilities),makeTargets()helper for many similar modules withhasTests/hasResources/pluginstoggles, resources (.processvs.copy), build plugins (SwiftLintPlugins, swift-docc-plugin),Package.resolveddiscipline (commit for apps, gitignore for libraries), local-path overrides for sibling-package development, modern features (InternalImportsByDefault,.swiftLanguageMode(.v6),public import), dependency hygiene (from:vsexact:).apple-linting-strategy.md(linting) — SwiftLint as primary linter + a single formatter (SwiftFormat or Apple's swift-format, not both):.swiftlint.ymlstructure, the high-valueopt_in_rules(force_unwrapping,empty_count, …), analyzer rules, scoped// swiftlint:disable:nexthygiene,--strictin CI, build-phase vs SPM-plugin vs CI placement, incremental adoption on legacy code, version pinning, plus a triage decision-order.apple-logging-strategy.md(logging) —Logger/OSLogoverprint/NSLog, subsystem/category conventions (oneLoggerper category), privacy markers (.public/.private/.private(mask: .hash)— the part people get wrong), log levels (debug/info/notice/error/fault) and their persistence behavior, lazy@autoclosureinterpolation, signposts for perf, what never to log (secrets/PII/bodies), retrieving logs via Console /logCLI /OSLogStore. Complements theswift-logging-proskill.apple-visionos-best-practices.md(spatial) — visionOS: scene types (Window / Volume / ImmersiveSpace), immersion styles, spatial gestures + hover affordances, head-mounted-display accessibility (Reduce Motion as vestibular safety), RealityKit / ECS conventions, 90fps performance budgets, USDZ pipeline.apple-testflight-deployment.md(deployment) — shipping to TestFlight:CFBundleVersionmonotonicity, App Store Connect API key (.p8) auth,xcodebuild archive→-exportArchive→altoolflow, ExportOptions.plist gotchas, manual signing for CI, internal vs external tester groups, dSYM upload, ranked gotchas.swift-concurrency-proskill — reviews async/await, actors, structured concurrency.swift-testing-proskill — writes and migrates tests to Swift Testing.swiftui-proskill — reviews SwiftUI for modern APIs and a11y compliance.coredata-swift6-proskill — Core Data under Swift 6 strict concurrency,viewContext/@MainActor, SPM.xcdatamodeldcaveats.swiftdata-proskill — SwiftData review: core model/context rules, safe#Predicateusage, CloudKit constraints, iOS 18+ indexing, iOS 26+ class inheritance.swift-docc-proskill — DocC comment review: parameter/return/throws tags, double-backtick symbol linking, Topics organization.swift-error-handling-proskill — typed throws, Result vs throws,LocalizedError, Sendable errors, async propagation.swift-logging-proskill —os.Loggerreview: subsystem/category conventions, privacy markers, log-level semantics.swift-package-proskill — SPM library design: public API surface,InternalImportsByDefault, resources, versioning, dependency hygiene.
Android — 12 rules + 5 skills (click to expand)
android-project-rules.md— Kotlin, Jetpack Compose, MVVM, Hilt, StateFlow, Retrofit/Moshi, ktlint.android-coroutines-best-practices.md— structured concurrency, scope discipline (viewModelScope/lifecycleScope, noGlobalScope), dispatcher choice,Flow/StateFlow/SharedFlowexposure, cancellation safety.android-compose-best-practices.md— state hoisting, side effects (LaunchedEffect/DisposableEffect/SideEffect),Modifierordering, recomposition stability (@Stable/@Immutable), lifecycle-awarecollectAsStateWithLifecycle(),LazyColumnkeys.android-accessibility-best-practices.md— TalkBack semantics, 48dp touch targets, dynamic text, WCAG AA contrast, reduce-motion.android-testing-strategy.md— test pyramid, source-set discipline (src/testvssrc/androidTest),runTest+StandardTestDispatcherpatterns, Turbine forFlow, Compose UI tests via semantics (not visible text), Hilt test modules, MockK conventions, JaCoCo coverage gates with generated-code exclusions.android-documentation-strategy.md— KDoc syntax (@param/@return/@throws/@property/@sample/@see), Composable docs (state hoisting, semantics, skippable vs. restartable), Hilt module docs, suspend / cancellation behavior, deprecation withReplaceWith, Dokka conventions and external links.android-localization-best-practices.md—strings.xmldiscipline,stringResource/pluralStringResourcein Compose, positional format args (%1$snot%s), `withgetQuantityString, locale-awareNumberFormat/DateTimeFormatter, RTL withstart/endmodifiers andandroid:supportsRtl="true"`, translator-context comment blocks.android-gradle-conventions.md— Kotlin DSL only, version catalogs (gradle/libs.versions.toml) as single source of truth, AGP/Kotlin/Compose-compiler co-versioning,jvmToolchain,apivsimplementation, multi-module graph patterns (:app+:feature:*+:data:*+:core:*), library publishing withconsumer-rules.pro, KSP over kapt. Now includes an inline-strings → catalog migration walkthrough for legacy projects.android-linting-strategy.md(linting) — three linters, three jobs: ktlint (.editorconfig, formatting), detekt (detekt.ymltuning,buildUponDefaultConfig, type resolution, baselines), and Android Lint (lint {},lint.xml,warningsAsErrors, baselines).@Suppress/@SuppressLinthygiene, CI placement (ktlintCheck detekt lintDebug), version pinning, plus a triage decision-order.android-logging-strategy.md(logging) — Timber overandroid.util.Log(plant a tree inApplication.onCreate), log levels (V/D/I/W/E/WTF) and passing theThrowable, stripping debug logs from release (DebugTree-in-debug-only + R8assumenosideeffects), no PII/secrets, crash-reporter integration (Crashlytics/Sentry breadcrumbs + non-fatals via aCrashReportingTree), Logcat hygiene.android-ai-best-practices.md(ai) — in-app AI models on Android, the counterpart to the Apple Foundation Models rule: on-device Gemini Nano via ML Kit GenAI / AICore vs cloud Gemini via Firebase AI Logic, never ship a raw model API key (App Check / backend proxy), two-level availability gating (feature download + user preference), streaming into Compose with placeholder-then-mutate, structural cancellation, interface + fake testability, consent + Data-safety implications.android-play-beta-deployment.md(deployment) — shipping to Play beta tracks:versionCodemonotonicity, Play App Signing (upload key vs app signing key), AAB-not-APK, service-account JSON for CI, internal/closed/open tracks, Triple-T / fastlane upload,mapping.txtupload, ranked gotchas.android-compose-proskill — deep Compose review: recomposition stability + skippability (incl. strong-skipping-mode awareness), side-effect audit (LaunchedEffectkeys,rememberUpdatedState,DisposableEffectteardown), lazy-list performance (keys,contentType,derivedStateOffor scroll), state modeling and hoisting.android-coroutines-proskill — deep coroutines/Flow review: scope-to-lifecycle mapping, cooperative cancellation (CancellationExceptiondiscipline,runCatchingtraps),launchvsasyncexception propagation, supervisor boundaries,stateIn/shareInconfiguration,callbackFlowteardown, coroutine testing (virtual time, Turbine).android-gradle-architecture-proskill — reviews multi-module Android builds against the Now in Android convention-plugin pattern:build-logic/convention/factoring, version-catalog depth, AGP co-versioning, KSP-over-kapt migration.xml-to-compose-migration-proskill — reviews and assists XML/Fragment → Compose migration: incremental interop viaComposeView/AndroidView, layout translation (LinearLayout/ConstraintLayout/FrameLayout → Modifier), RecyclerView →LazyColumnwith stable keys, Fragment → Composable, Navigation Component → Navigation-Compose, ViewModel bridging, themes/styles →MaterialTheme.r8-shrink-proskill — reviews R8 / ProGuard configuration:-keeprule discipline,consumer-rules.procontract for libraries, common reflection-library rules (Moshi, Room, Retrofit, Hilt, Glide, kotlinx-serialization), mapping-file workflow, debugging release-build crashes.
Cross-platform — 2 rules (click to expand)
concise-comments-and-commits.md(core) — fires on all Swift/Kotlin/ObjC source: in-code comments default to none (write only what code can't express — why, traps, ticket refs; never narration, diff commentary, or commented-out code), and commit messages stay short (imperative ≤72-char subject; body only when the why isn't in the diff — never file-by-file inventories or process reports). Aimed squarely at AI-assistant verbosity.project-documentation.md— README structure, Keep a Changelog format,CONTRIBUTING.mdessentials, ADR conventions (docs/adr/####-title.md, immutable once accepted), inline-comment philosophy (why not what), and link-rot defenses (pinned versions, permalinked source). Scoped toREADME.md/CHANGELOG.md/CONTRIBUTING.md/docs/**/*.md.
Baseline & bundle files — settings, .gitignore, the full install.sh flag reference, templates (click to expand)
settings.json— safe defaults forxcodebuild,swift,swiftlint,./gradlew,gradle,ktlint,adb,git,gh, plus Apple/Android docs domains forWebFetch..gitignore— recommended entries for Xcode, SPM, CocoaPods, Carthage, fastlane, plus Gradle/Android Studio/Kotlin.install.sh— one-command bootstrap into any target repo.- Commands (verb form):
install [TARGET](default — verb optional),recommend [TARGET](analyze a dir → suggested command,--jsonfor agents),upgrade TARGET,uninstall TARGET,list,list-mcps,setup(guided),help. Each has a legacy--flagalias (--upgrade,--uninstall,--list,--list-mcps,-i/--interactive,-h/--help) — verbs and flags are interchangeable, so existing scripts keep working. A directory whose name collides with a verb can be targeted via an explicit path (./upgrade) or the--flagform.
Flags:
-i/--interactive— guided, prompt-driven setup. Detects create vs. adopt
…
Source & license
This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: kelvinkosbab
- Source: kelvinkosbab/AppBootstrapAI
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.