Cursor · App Store Connect

Get App Privacy, age rating and compliance right with Cursor

Your privacy manifests already say what the app and its SDKs collect. Cursor reads them, MetaRun turns them into the exact App Privacy answers App Store Connect asks for, and the age rating questionnaire and export compliance go through previews.

Start Free Trial See pricing →

Setup checked October 2026 against Cursor MCP docs, Cursor CLI

01 · Uplink

Connect Cursor once

01 · Add to ~/.cursor/mcp.json (or .cursor/mcp.json for one project)

{
  "mcpServers": {
    "metarun": {
      "url": "https://metarun.dev/api/mcp"
    }
  }
}

02 · Or use the install link

Opens Cursor with the server filled in.

https://cursor.com/link/mcp/install?name=metarun&config=eyJ1cmwiOiJodHRwczovL21ldGFydW4uZGV2L2FwaS9tY3AifQ%3D%3D

03 · Sign in

When Cursor connects, MetaRun opens in your browser. Pick read-only or read and change, and you're back in the editor with the tools listed under MCP.

Prefer a personal access token (scripts, CI)?

Use a token instead

Mint a personal access token in MetaRun under Settings, MCP. It's shown once and can be revoked any time. Cursor reads ${env:METARUN_TOKEN} from your environment. Some Cursor versions start the browser sign-in even when a header is set; if that happens, signing in works the same.

{
  "mcpServers": {
    "metarun": {
      "url": "https://metarun.dev/api/mcp",
      "headers": { "Authorization": "Bearer ${env:METARUN_TOKEN}" }
    }
  }
}

02 · Briefing

What Cursor handles here

App Privacy is the questionnaire behind your App Store privacy label: 35 data types, six purposes, linked or not, tracking or not, for your code and every SDK you ship. Getting it wrong is a common rejection, and Apple's API can't read or write it.

A coding agent has the input App Privacy needs: your PrivacyInfo.xcprivacy and the ones inside each Swift package or pod. MetaRun maps them one to one onto App Store Connect's answers and flags what App Review rejects. The age rating and export compliance do have an API, and go through previews.

03 · Preflight

Before you start

Your app's PrivacyInfo.xcprivacy and each SDK's.
Access to App Store Connect in a browser, to enter the App Privacy answers.
The age rating questionnaire's facts: user content, web access, purchases.

04 · Execution

How it runs

01
Collect the manifests
Cursor finds your app's PrivacyInfo.xcprivacy and each SDK's: Swift packages under DerivedData's SourcePackages checkouts, CocoaPods under Pods.
02
Build the answers
MetaRun merges them strictest-wins and returns every data type to tick, whether it's linked to the user or used for tracking, its purposes, and how the label will read.
03
Fix what review would reject
Findings name the problems App Review flags: unknown keys, a data type with no purpose, tracking declared with nothing marked for tracking, missing tracking domains.
04
Enter and publish
Because App Privacy has no API, you enter the answers in App Store Connect; MetaRun returns the steps and a link to the right page. Age rating and compliance apply through previews.

05 · Session

An example session in Cursor

Build App Privacy answers from @PrivacyInfo.xcprivacy and the Pods manifests.

apple_build_privacy_answersAnswers built from four manifests, with one finding: an SDK declares tracking without a tracking domain.
apple_get_age_rating_declarationThree age rating questions were never answered.
apple_preview_set_age_ratingPreview: your answers plus the three unanswered questions, listed so you can see them.
Cursor asks before running apple_apply_set_age_rating. You read the preview above and approve.
apple_apply_set_age_ratingApplied. Apple derives the rating from the answers.

Illustrative: your apps, versions and numbers will differ. The tool names and their order are real.

06 · Tools

The MetaRun tools Cursor calls

Tool	What it does
apple_build_privacy_answersread	Turns PrivacyInfo.xcprivacy files into App Privacy answers, with findings App Review rejects.
apple_get_age_rating_declarationread	The age rating questionnaire as answered now.
apple_preview_set_age_ratingpreview + apply	Answer or change the questionnaire, and overrides.
apple_list_encryption_declarationsread	Existing export compliance declarations.
apple_preview_declare_build_encryptionpreview + apply	Answer export compliance for a build.
apple_preview_set_content_rightspreview + apply	Declare whether the app uses third-party content.
apple_list_accessibility_declarationsread	Accessibility Nutrition Labels per device family.
apple_preview_set_accessibility_declarationpreview + apply	Declare which accessibility features the app supports.

Each preview has an apply twin (the same name with apply instead of preview) that only runs with the confirm token from a fresh preview, and refuses if App Store Connect changed in between. MetaRun tools save to your MetaRun workspace only (studio projects, tracked keywords), never to Apple.

07 · Apple rules

What Apple enforces, and how MetaRun handles it

App Privacy has no API

There's no App Store Connect API endpoint for App Privacy at all. MetaRun builds the answers and the label; publishing them is done in App Store Connect.

Unanswered isn't the same as No

Apple stores an unanswered age rating question as empty, not No. An override sent on an empty questionnaire comes back as a server error, so MetaRun stages every unanswered question alongside your edits and lists them for you to see.

Korea's override needs the right category

Apple only accepts a Korea age rating override for apps in the Games or Entertainment category. The preview warns before the attempt instead of letting Apple refuse it.

Compliance declarations are permanent

An export compliance declaration can't be withdrawn once assigned to a build. Setting ITSAppUsesNonExemptEncryption in Info.plist avoids the question for future builds.

08 · Comms

What to ask Cursor

Ask Cursor: Build App Privacy answers from @PrivacyInfo.xcprivacy and the Pods manifests.
Ask Cursor: Does our label say we track users? Why?
Ask Cursor: Set content rights to 'no third-party content'.

09 · Unattended

Run it from a script with Cursor

The Cursor CLI runs one request without the editor with agent -p. Allow only the read tools the request needs in ~/.cursor/cli-config.json (Mcp(metarun:tool_name) rules), and keep MetaRun's apply tools out of that list.

Read-only check, safe to schedule

agent -p "Build the App Privacy answers from the PrivacyInfo.xcprivacy files in this repository and list every finding App Review would reject. Read only." --output-format json

Don't run it with --force for MetaRun: that approves every tool, applies included.

10 · Safety

How Cursor asks before a change

Cursor asks before each MCP tool call by default, following your Run Mode settings. Keep MetaRun's apply tools on ask: that prompt is the confirm step for every App Store change. In the Cursor CLI, allow rules live in ~/.cursor/cli-config.json in the form Mcp(server:tool), so you can allow MetaRun's read tools and leave the applies out.

Apple key stays on MetaRun, encryptedPreview before every writeRecorded, revertible from history

11 · FAQ

Frequently asked questions

Can Cursor fill in App Privacy for me?

It can do all the thinking: Cursor reads the manifests and MetaRun produces the exact answers and the label. The last step, entering them in App Store Connect, is manual because Apple offers no API for App Privacy.

Which manifests should it read?

Your app's own PrivacyInfo.xcprivacy and every SDK's: Swift packages under DerivedData/<project>/SourcePackages/checkouts, CocoaPods under Pods. App Privacy covers everything the app links.

Can it set the age rating?

Yes. The questionnaire has an API, so Cursor reads it, stages your answers through a preview, and applies on your approval.

What about export compliance?

Per build, via apple_preview_declare_build_encryption. It's permanent for that build, so the preview says so before you approve.

How do I connect Cursor to App Store Connect?

Add https://metarun.dev/api/mcp to ~/.cursor/mcp.json (or use the install link) and sign in to MetaRun when Cursor opens your browser. After that, ask for "app privacy and compliance" in plain words and Cursor picks the MetaRun tools.

Does Cursor see my App Store Connect key?

No. Your App Store Connect API key stays envelope-encrypted on MetaRun's servers and is decrypted per request. Cursor holds a MetaRun token that you can revoke in Settings at any time.

More with Cursor

Cursor

Submit for review

Attach the build, clear export compliance, run the readiness sweep, submit.

Open

Cursor

TestFlight

Hand builds to tester groups, write What to Test, and read crash feedback.

Open

Cursor

Subscriptions and IAPs

Create subscription groups, subscriptions and in-app purchases with copy and prices.