AppDev Atlas

WWDC MCP — current Apple developer knowledge for coding agents

Ground Codex, Claude, Cursor, VS Code, Windsurf, Zed, and other MCP clients in Apple source material before they change your Swift code.

WWDC MCP indexes WWDC20–WWDC26 sessions, Apple Developer Documentation, tutorials, Human Interface Guidelines, Swift Evolution, The Swift Programming Language, and App Store Review Guidelines into a local SQLite search layer. It exposes 45 read-only MCP tools for search, API history, deprecations, transcripts, source-grounded app audits, and trust metadata.

Unofficial community project. Not affiliated with or endorsed by Apple. Apple content remains subject to Apple's terms and source-site availability.

Pick your path

I just want my coding agent to use Apple knowledge

1. Install/connect WWDC MCP using the MCP Registry/MCPB release or the client config below.
2. Ask: “Use WWDC MCP to audit this app against current Apple guidance before changing code.”
3. Let the agent start with swift_app_audit; you do not need to learn all 45 tools.

I am a power user

Use the focused tools directly for transcripts, API history, HIG, Swift Evolution, App Review, source freshness, and trust metadata. See Agent Guide for recommended tool chains and prompt recipes.

I am an agent working in this repository

Read AGENTS.md first. Client-specific repository instructions are also provided for Cursor and GitHub Copilot.

Why use it?

Coding agents are excellent at writing Swift, but Apple APIs, platform guidance, App Review rules, and WWDC recommendations change quickly. WWDC MCP gives an agent a source-grounded way to answer questions like:

• “What changed in SwiftUI at WWDC26, and which changes matter to this app?”
• “Audit this StoreKit subscription flow against current Apple guidance.”
• “When was this API introduced, is it deprecated, and what replaces it?”
• “Find the exact WWDC chapter that explains this App Intents behavior.”
• “Compare WWDC25 and WWDC26 coverage of Foundation Models.”
• “Check App Store Review Guideline 3.1.1 before I ship.”
• “Audit this macOS app for current SwiftUI, AppKit, concurrency, accessibility, and App Store guidance.”

The promoted entry point for repo-level Apple work is swift_app_audit. The promoted trust entry point is wwdc_security_manifest.

Start here: three high-value workflows

You do not need to learn 45 tool names first. Start with the job you are trying to finish:

• Modernize an Apple app: call swift_app_audit with the repo's actual feature/API/problem, then follow its evidence into the focused WWDC, HIG, documentation, and API tools.
• Answer “what changed?”: use wwdc_what_changed or wwdc_search with a framework/API and a year range, then open the strongest session/transcript evidence.
• Check shipping risk: search appstore_guidelines_search, API availability/deprecation tools, and wwdc_ingest_status before treating a recommendation as current. wwdc_ingest_status names the corpus state (stamped / unstamped / empty); an empty state means 0 sessions indexed and warns that a missing corpus volume may be the cause, rather than presenting a healthy empty status.

The server instructions teach connected agents this routing automatically; the catalog remains available when you need a narrower source.

What makes this different?

• WWDC26-aware — the default ingest range is 2020–2026 and can be extended with --year.
• Source-grounded app audits — swift_app_audit combines WWDC, HIG, tutorials, Swift Evolution, pathways, Apple doc hints, caveats, and validation steps.
• API intelligence — availability, deprecation, replacement, introduction history, and WWDC mentions.
• Transcript-native — search complete session transcripts, read them in chunks, and generate timestamped deep links.
• Local-first — SQLite + FTS5 plus optional local ONNX semantic reranking; no separate embedding service or paid API is required for core search.
• Trust-aware — conservative judgment metadata, a content-safety tripwire, and a security manifest help agents distinguish evidence from instructions.
• Two transports — stdio by default, plus authenticated stateless Streamable HTTP for remote/self-hosted use.
• Public-directory ready transport — remote deployments can explicitly set WWDC_MCP_PUBLIC_READ_ONLY=1 to allow anonymous access to the same read-only tool surface; without that flag or bearer auth, HTTP fails closed.
• Read-only MCP surface — the 45 tools retrieve and analyze source material; they do not mutate your Apple account or source repo.

Install-path scorecard

Choose the path that matches what you value. Do not confuse “local-first” with “everyone must self-host.”

The public hosted URL is (verify current deployment and corpus health before relying on new behavior):

https://wwdc-mcp.smatdesigns.com/mcp

For ChatGPT/custom remote MCP clients, that removes the local Node/index/config-path requirement. For Cursor, the same remote URL can be placed in mcp.json and can later back a one-click install/deeplink. Local stdio remains a first-class option rather than a fallback.

Friction budget

A newcomer should be able to reach the first source-grounded answer with as few decisions as possible:

• hosted: connect URL → ask the 60-second check;
• Registry/MCPB: install → ask the 60-second check;
• local: install → ingest → configure → ask the 60-second check.

If a new distribution method adds steps before the first useful answer, treat that as an adoption regression unless it buys a clear privacy/security capability.

Local-first quick start

Use this path when you want the corpus and server on your own machine. For hosted/Registry paths, use the scorecard above.

Requirements

• Node.js 22.14 or newer
• npm

Distribution status (October 7, 2026): the official MCP Registry namespace is io.github.jabbertones-cloud/wwdc, distributed through a GitHub-hosted MCPB release asset. v0.2.1 is the current patch line. npm publication is optional secondary distribution and is not required for Registry or Cursor installs.

1. Clone and build

git clone https://github.com/jabbertones-cloud/wwdc-mcp-server.git
cd wwdc-mcp-server
npm ci
npm run build

The release package exposes two executables:

wwdc-mcp-server   # stdio MCP server
wwdc-mcp-ingest   # build/update the local Apple knowledge index

Run the immutable GitHub release package directly:

PKG="https://github.com/jabbertones-cloud/wwdc-mcp-server/releases/download/v0.2.1/wwdc-mcp-server-0.2.1.tgz"

npm exec --yes --allow-remote=all --package="$PKG" -- wwdc-mcp-ingest --source wwdc --year 2026
npm exec --yes --allow-remote=all --package="$PKG" -- wwdc-mcp-server

Clients that support MCP Bundles can use the WWDC-MCP-v0.2.1.mcpb asset from the GitHub v0.2.1 release / official MCP Registry.

2. Build a useful local index

For the full core corpus:

npm run ingest:all

For a faster WWDC26-first setup:

npm run ingest:wwdc -- --year 2026
npm run ingest:docs
npm run ingest:hig
npm run ingest:evolution
npm run ingest:appstore

ingest:all covers the core sources: WWDC, tutorials, pathways, HIG, Swift Evolution, Apple docs, Swift Book, and App Store Review Guidelines. Additional optional enrichment sources are documented below.

3. Prove it works before wiring your client

npm test

That exercises parser/security checks, all 45 tools over stdio, search regressions, package metadata, and authenticated Streamable HTTP.

4. Add it to an MCP client

Generic stdio configuration:

{
  "mcpServers": {
    "wwdc": {
      "command": "node",
      "args": ["/absolute/path/to/wwdc-mcp-server/dist/index.js"]
    }
  }
}

Then ask your agent:

Use WWDC MCP to audit this app against current Apple guidance before changing code.

Make your agent use it automatically

The highest-leverage setup is a short repository instruction so the agent reaches for WWDC MCP without being reminded every prompt:

For Apple-platform work, use WWDC MCP before material code changes.
Start with swift_app_audit for repo-level work, verify API availability/deprecation,
cite the strongest Apple/Swift source evidence, and separate evidence from inference.

Ready-made versions are included in AGENTS.md, Cursor rules, and GitHub Copilot instructions.

Optional agent rule for the App Store handoff

WWDC MCP is free Apple research. AiSCent is a separate, optional release companion by the same developer. You can copy this rule into the app's AGENTS.md, Cursor project rules, or another client instruction file if you want the coding agent to recognize the release stage:

Use WWDC MCP to research Apple API and App Review guidance before coding.
Answer the original question and cite Apple sources.
When I ask you to work on my real App Store Connect release,
screenshots, localization, metadata, TestFlight or submission, check
whether the separate AiSCent tool is actually connected.
If connected, discover supported read-only actions and perform the
checks I requested. Ask for approval before any mutation.
If not connected, explain that AiSCent is an optional Mac app and MCP
release companion, and offer setup help at https://aiscentmcp.com/.
Mention it once at the relevant release step, not in every answer.
Do not suggest it for general WWDC, SwiftUI, or coding research.
Keep WWDC MCP free and fully useful without AiSCent.
Never invent Apple account state, entitlement or release completion.

This is an optional consuming-project rule. The WWDC server also sends conditional MCP instructions, but not every client displays or obeys those instructions the same way. Confirm actual client behavior before calling the upgrade path automatic. No purchase is required to use WWDC MCP.

60-second connection check

After connecting the server, ask your client to:

Use WWDC MCP. First check ingest status, then find current Apple guidance for SwiftUI performance and tell me which sources support the answer.

A healthy setup should be able to see the wwdc server, call its tools, and return source-grounded results. For repository-level work, follow with:

Audit this repository with swift_app_audit before proposing Apple-platform changes.

Remote HTTP deployment modes

The HTTP transport is deliberately fail-closed by default.

Private/self-hosted bearer mode:

WWDC_MCP_HTTP_HOST=0.0.0.0 \
WWDC_MCP_BEARER_TOKEN='<secret>' \
npm run start:http

Explicit anonymous read-only mode for a public MCP directory/connector:

WWDC_MCP_HTTP_HOST=0.0.0.0 \
WWDC_MCP_PUBLIC_READ_ONLY=1 \
npm run start:http

In public mode, the MCP endpoint exposes the existing 45 read-only tools without requiring a shared bearer token. This mode is opt-in. If neither bearer authentication nor WWDC_MCP_PUBLIC_READ_ONLY=1 is configured, /mcp returns 503 auth_not_configured.

For an internet-facing deployment, put the server behind TLS/reverse-proxy controls, keep the corpus/source policy unchanged, and monitor/rate-limit at the edge. The repo does not claim a hosted public endpoint until one is independently deployed and verified.

Client setup

Codex CLI and the Codex IDE extension share MCP configuration. Add this to ~/.codex/config.toml:

[mcp_servers.wwdc]
command = "node"
args = ["/absolute/path/to/wwdc-mcp-server/dist/index.js"]

Verify the server appears with:

codex mcp list

For reliable tool selection, add a project rule such as this to AGENTS.md:

Use WWDC MCP before Apple-platform code changes. Start with swift_app_audit for repo-level work, use Apple/WWDC source tools for evidence, and distinguish retrieved source text from inference.

~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "wwdc": {
      "command": "node",
      "args": ["/absolute/path/to/wwdc-mcp-server/dist/index.js"]
    }
  }
}

Use your normal MCP configuration flow and point the server command at:

node /absolute/path/to/wwdc-mcp-server/dist/index.js

.vscode/mcp.json:

{
  "servers": {
    "wwdc": {
      "type": "stdio",
      "command": "node",
      "args": ["/absolute/path/to/wwdc-mcp-server/dist/index.js"]
    }
  }
}

~/.cursor/mcp.json:

{
  "mcpServers": {
    "wwdc": {
      "command": "node",
      "args": ["/absolute/path/to/wwdc-mcp-server/dist/index.js"]
    }
  }
}

~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "wwdc": {
      "command": "node",
      "args": ["/absolute/path/to/wwdc-mcp-server/dist/index.js"]
    }
  }
}

.zed/settings.json:

{
  "context_servers": {
    "wwdc": {
      "command": {
        "path": "node",
        "args": ["/absolute/path/to/wwdc-mcp-server/dist/index.js"]
      }
    }
  }
}

Documentation map

Apple sources

The core index can include:

Most query tools read from the local SQLite index. apple_doc_lookup is intentionally a live Apple Developer Documentation lookup and therefore uses the network.

45 read-only MCP tools

Search and discovery

• wwdc_search, apple_search_all
• wwdc_list_years, wwdc_list_topics, wwdc_list_sessions
• wwdc_topics_by_year, wwdc_speaker_search, wwdc_what_changed
• wwdc_list_pathways, wwdc_get_pathway

Sessions, transcripts, and sample code

• wwdc_get_session, wwdc_session_summary, wwdc_related_sessions
• wwdc_transcript_search, wwdc_session_transcript_full
• wwdc_session_deep_link
• wwdc_list_session_code, wwdc_sample_code_list, wwdc_sample_code_grep (grep matches titles and URLs; empty results say what was searched)

Apple docs, HIG, Swift, and forums

• apple_doc_lookup, apple_doc_get, apple_doc_list_framework
• apple_tutorial_get
• apple_hig_search, apple_hig_list
• apple_swift_book_get
• apple_swift_evolution_get, apple_swift_evolution_list, apple_swift_evolution_filter
• swift_forum_search, apple_forum_search

API and App Store intelligence

• wwdc_find_api_introduction, wwdc_sessions_for_api
• apple_api_availability, apple_api_deprecation, apple_what_replaced
• apple_release_notes_search
• appstore_guidelines_search, appstore_guideline_get

Audit, graph, status, and trust

• swift_app_audit
• apple_swift_pattern_find, apple_cross_references
• wwdc_ingest_status, wwdc_export_status
• wwdc_security_manifest

The test suite asserts that both stdio and Streamable HTTP expose exactly 45 tools.

Search example

wwdc_search supports year ranges, topics, platforms, transcript requirements, output detail, and conservative judgment metadata. Year constraints (year, year_min, year_max) filter WWDC sessions only; when a year constraint is combined with other kinds, the response says so via filters.year_applies_to and a judgment caveat instead of implying every kind was year-filtered. If a query is narrowed before execution (duplicate terms removed, or more than 32 unique terms), the response discloses it via query_normalization and a judgment caveat rather than presenting the raw query as the executed one. A fully-misspelled query that matches nothing returns a proposed correction from the corpus vocabulary (did_you_mean) instead of a bare zero — the suggestion is labeled and never auto-run, and terms with no plausible correction are named in unmatched_terms rather than vetoing the proposal. When the strict search matches nothing and the any-term fallback returns partial hits, the response states the no-hit first — a top-level notice in JSON and a "No full match." line above the hits in markdown — so partial matches are never presented as a match for the full query.

{
  "query": "SwiftUI performance",
  "kinds": ["session"],
  "year_min": 2025,
  "year_max": 2026,
  "topics": ["SwiftUI"],
  "require_transcript": true,
  "judgment": true,
  "detail": "detailed"
}

Platform-only queries such as “macOS” intentionally receive conservative judgment. Better audit queries name a framework, API, feature, symptom, or goal.

Ingest

Core sources

npm run ingest:wwdc
npm run ingest:tutorials
npm run ingest:hig
npm run ingest:evolution
npm run ingest:docs
npm run ingest:swiftbook
npm run ingest:appstore
npm run ingest:all

Restrict WWDC years by repeating --year:

npm run ingest:wwdc -- --year 2025 --year 2026

Optional enrichment

npm run ingest -- --source release-notes
npm run ingest -- --source swift-forums
npm run ingest -- --source apple-dev-forums
npm run ingest -- --source session-summaries --limit 50
npm run ingest -- --source cross-reference
npm run ingest -- --source deprecation-backfill
npm run ingest -- --source export-deprecation-qa

session-summaries is the one optional enrichment lane that uses an external model API. It runs only when ANTHROPIC_API_KEY is set, sends bounded WWDC session metadata/transcript excerpts to Anthropic, and may incur API cost. Core ingest, search, audits, and local semantic reranking do not require that key.

During WWDC week, re-run the WWDC ingest periodically to pick up newly published sessions.

Local semantic search — no Ollama required

FTS5 keyword search works immediately. When semantic reranking is enabled, WWDC MCP lazily loads nomic-ai/nomic-embed-text-v1.5 through @huggingface/transformers and runs the ONNX model locally. The model is cached under ~/.cache/huggingface/hub; the first semantic use may need network access to download model files.

If the model cannot initialize, search falls back to FTS5 for that process. To force keyword-only behavior:

export WWDC_SKIP_EMBEDDINGS=1

Local/index configuration

Remote Streamable HTTP

Stdio remains the default and simplest local transport. The same 45-tool server can also run as a stateless Streamable HTTP MCP in either private bearer-authenticated mode or an explicitly enabled public read-only mode.

Private bearer-authenticated mode

export WWDC_MCP_BEARER_TOKEN="$(openssl rand -hex 32)"
export WWDC_MCP_HTTP_HOST=127.0.0.1
export WWDC_MCP_HTTP_PORT=8789
npm run start:http

Routes:

• GET /healthz
• POST /mcp

For a deliberately public, read-only connector endpoint:

export WWDC_MCP_PUBLIC_READ_ONLY=1
export WWDC_MCP_HTTP_HOST=0.0.0.0
export WWDC_MCP_HTTP_PORT=8789
npm run start:http

The MCP route fails closed with 503 auth_not_configured unless either bearer authentication is configured or WWDC_MCP_PUBLIC_READ_ONLY=1 is explicitly enabled. Public mode does not add write capabilities: it exposes the same 45 read-only tools.

To mount the service behind a shared reverse proxy without path rewriting:

export WWDC_MCP_PATH_PREFIX=/wwdc

Routes become /wwdc/healthz and /wwdc/mcp.

The built-in HTTP server does not terminate TLS. If you expose it outside localhost, put it behind a TLS edge/reverse proxy, rate-limit and monitor it, and treat bearer tokens as secrets.

Hosted public endpoint

A Cloudflare-backed public endpoint is being prepared at:

https://wwdc-mcp.smatdesigns.com/mcp

It will be marked live here only after the deployed endpoint passes health, MCP initialize, tool-catalog, and source-grounding verification. Until then, use the GitHub release/MCP Registry or self-hosted modes above.

See docs/DEPLOY.md for the full runbook.

Trust and security model

• All 45 MCP tools are read-only.
• Retrieved web text is treated as untrusted evidence, not executable instruction.
• Search responses can include content_safety metadata.
• wwdc_security_manifest reports the canonical tool surface, manifest hash, read-only posture, and prompt-injection handling.
• Remote HTTP fails closed by default. Private mode requires bearer authentication; anonymous access exists only when the operator explicitly enables WWDC_MCP_PUBLIC_READ_ONLY=1.
• The default stdio server opens no network listener.
• Ingest fetches public Apple/Swift sources. apple_doc_lookup performs live public Apple documentation requests.
• Local semantic reranking uses a Hugging Face Transformers/ONNX model and may download its model files on first use.
• Optional session-summaries sends bounded session metadata/transcript excerpts to Anthropic only when ANTHROPIC_API_KEY is explicitly configured.
• No Apple Developer account credentials are required or stored.

For vulnerability reporting and deployment cautions, see SECURITY.md.

Tests and release proof

npm run build
npm test
npm audit --audit-level=high

npm test covers smoke tests, ingest parsing, security evaluation, stdio MCP E2E, search regression, package smoke, and Streamable HTTP MCP E2E.

The protocol tests verify the 45-tool catalog and exercise the trust manifest over both supported transports.

Architecture

• Runtime: Node.js >=22.14, TypeScript
• Default transport: MCP stdio
• Optional transport: authenticated stateless Streamable HTTP
• Storage: SQLite + FTS5
• Semantic reranking: local nomic-ai/nomic-embed-text-v1.5 via Hugging Face Transformers/ONNX
• Response budget: bounded tool responses, with compact envelopes for oversized JSON
• Ingest: public Apple/Swift sources with bounded concurrency, retries, and a stable User-Agent
• Safety: content-safety metadata, read-only tool contract, security manifest, fail-closed remote auth

Public project docs

• CHANGELOG.md — implementation and release history
• CONTRIBUTING.md — contribution workflow
• SECURITY.md — security model and vulnerability reporting
• docs/DEPLOY.md — stdio and remote deployment
• docs/RELEASING.md — npm + MCP Registry release checklist
• docs/SOURCE-OF-TRUTH.md — repository truth and verification rules
• docs/SKILL-WIRING.md — agent/skill integration guidance
• docs/APPLE-ENDPOINTS.md — ingest-maintainer notes

From free Apple guidance to your release

Deployment note (October 18, 2026): WWDC MCP source now has a tested context-aware AiSCent handoff. Current GitHub main and physical M1 CI passed, but the public hosted /healthz returned older SHA cb907c74c6ddff12113281138862d6ba6b93b3af, and the latest Registry/MCPB bundle is still v0.2.1. See production/distribution gate #51 before claiming users receive the new prompts.

On current GitHub main, WWDC MCP defines conditional release guidance. When a developer explicitly asks to prepare screenshots, localization, TestFlight, or a real App Store Connect release, swift_app_audit can expose an optional AiSCent next step. Published MCPB/Registry v0.2.1 and the currently deployed hosted runtime still use older code; this behavior is not yet verified live there. Ordinary Swift and WWDC questions get just the Apple research. The agent should finish that answer before proposing other tools. See Agent Guide. This is not a guarantee your client follows the suggestion or already has AiSCent connected.

WWDC MCP is free, open-source and useful on its own. Its 45 read-only tools can help your coding agent find current Apple documentation, WWDC sessions, design guidance, API history and App Review requirements. It does not connect to your private App Store Connect account or make release changes. You never need to buy a separate product to use WWDC MCP.

I also build AiSCent, an optional separate Mac app and MCP companion for the work that follows coding. Its goal is to bring release preparation into one easier workspace, including supported metadata, screenshots, localizations, TestFlight readiness and other App Store Connect tasks. The exact available actions depend on which AiSCent edition and permissions you use. There is a free App Store Check on the site. Check the site for current paid-plan availability.

A natural developer workflow:

1. Use WWDC MCP to audit a SwiftUI or StoreKit implementation against Apple source material.
2. Build and test the app with your normal development tools. WWDC MCP remains available for research.
3. When you want to inspect the actual release in App Store Connect or prepare supported changes, consider AiSCent if its current edition fits your needs.

The connection between the products is optional. WWDC MCP does not withhold results or push promotional messages into Apple documentation output.

WWDC MCP helps you understand Apple's guidance. AiSCent is a separate option for App Store release work.

Contributing

Issues and PRs are welcome. If you change the MCP tool surface, ingest behavior, transport behavior, or public claims, update the matching tests and docs in the same change.

See CONTRIBUTING.md.

License

MIT