BDK Native MCP Server

Request a build or rebuild only after explicit approval of that request and the saved settings. A first build requires confirm_build:true after the customer says yes. A ledger rebuild consumes one banked rebuild: pass build_kind:rebuild and confirm_consumes_rebuild:true. free_rebuild is legacy-only. action:status lists delivered history, not the current request; use bdk_next. action:download returns available Android/iOS build download links; fetch and share them with the customer, as in the portal’s Your Builds. Android archives contain an .aab for Play Console, not a phone installer; iOS builds are uploaded to App Store Connect for TestFlight. Never paste keystore passwords or secrets into chat. BDK builds and signs; the customer submits. Holds/checks can refuse a request. Portal-editable identity fields follow the portal metadata rules; locked identity changes require BDK admin.

Read health checks and health_checked_at, not build execution status. run:true schedules an asynchronous check. If scheduled, re-read without run after a minute. If not scheduled, say so and use the portal. A passing check is an observation, not compatibility or store approval.

Start or poll a project purchase only after purchase approval. First read bdk_next.commerce and confirm the customer’s platform via bdk_next confirm_product; a default Both is not consent. Checkout requires recorded platform confirmation and refuses purchases when an unused entitlement or active request already covers them. Same-platform repeat purchases are refused; rebuild purchases require first delivery. Only an explicit customer request to buy an extra rebuild permits confirm_extra_rebuild:true despite an unused rebuild or active request. Ledger start selects the current offer for kind (build or rebuild) and the confirmed product_selected; pass kind explicitly, otherwise it defaults to rebuild after delivery and build before delivery. Optional promotion_code comes from the customer. Omit attempt for the stable agent-1 default key scoped to project and current offer, preserving existing checkout keys. Reuse the same attempt for retries. Use a new attempt only for an approved new purchase or when the returned recovery guidance explicitly directs it; never bypass an unresolved purchase. This is a gateway preflight check, not a global purchase lock. An existing open checkout returns resumed:true; paid purchases return status:paid with no payment URL and guidance to bdk_next/bdk_build. An expired unpaid checkout gets at most one replacement start. Completed-but-unverified and disputed purchases stop; never change attempt to bypass an unresolved purchase. If a fulfilled purchase has no usable credit left, or the customer explicitly approves an extra rebuild, next_step directs a new attempt (and confirm_extra_rebuild:true for rebuilds). On an unreadable replay, retry the same start with the same attempt. Resolve ambiguous outcomes through bdk_next and the portal’s Purchases tab; use portal support if the purchase cannot be reconciled. Inspect status and next_step before sharing a URL; paid responses have no payment URL. When quote is present, tell the customer quote.total_minor (minor units of quote.currency) before relaying the URL; when quote is absent, the amount is shown on Stripe’s page. Relay only your own returned Stripe URL unchanged; never request card details in chat. Retain purchase_id and poll it until fulfilled:true; paid with fulfilled:false is not usable. Purchase approval does not authorize a build request. Legacy polling uses checkout_session_id.

Fetch https://thebdk.com/agent/skill.md and apply only its documented writable fields after approval. Set tnc_accepted:true only after explicit acceptance of https://thebdk.com/terms for this project. launch_link changes installed apps: obtain approval for the exact URL. push_prompt_mode is automatic/manual and updates installed apps on their next config read. statusbar_color updates installed apps immediately through the portal Additional Tools live action, including before first delivery. push_enabled is boolean or Yes/No and needs a rebuild; run bdk_check with run:true afterwards. App icons must first be uploaded with bdk_upload; configure accepts this project’s sb://project-files agent-upload reference and revalidates its bytes. External icon URLs are refused. Keep secrets on the portal. Returns applied, refused and failed keys. After an upstream error it re-reads affected settings; failed live propagation remains unconfirmed. Preserve applied results on partial failure. Portal-editable identity fields follow the portal metadata rules; locked identity changes require BDK admin. Listing fields describe existing listing status, not listing copy.

Create a project after approval of the reference label and published app URL. project_name is a reference label, not the home-screen app name; that starts as the website hostname until configured. Duplicates by reference label or site host return candidates: ask the customer to choose create_new or use_existing with project_code; never reuse automatically. For an owner preview, pass from_preview_id to read editable prefill, then submit its observed_website_link. A same_site_project conflict requires explicit link_existing:true with project_code or false to create separately. Offer preview before checkout.

With project_code, verify access and read ledger offers; report lookup failure rather than substituting a standard quote. A legacy project without product returns legacy_project; with product, it returns standard prices. Without project_code, product also selects standard prices, not eligibility. offer.unit_amount is in minor units of currency. The tool never creates a payment URL. BDK builds and signs; the customer submits. Fetch purchase terms from https://thebdk.com/agent/pricing.md.

Start a device code for an additional HTTP client from an already authenticated MCP session. This MCP session cannot redeem that code through a tool. For initial or expired MCP authentication, use the host reconnect flow. For HTTP device flow, follow https://thebdk.com/agent/skill.md.

Read workflow state and next steps; call again after each action. confirm_product writes and records the customer-confirmed iOS / Android / Both choice: ask first. Checkout requires recorded confirmation matching the saved platform, even when the saved default already matches the customer's choice. If confirmation is missing or mismatched, send the answer as confirm_product, then re-read. A purchased platform can be locked: use the purchased platform or portal support; do not loop through bdk_configure. Milestones summarise project progress; unknown health or confirmation remains unknown. Preview refers to this project or its matching launch domain and is not proof of phone testing. allowed_tools is advisory. can_request_now does not guarantee the request will be accepted.

List projects or read a status/progress/health snapshot, not full settings or credentials. Use bdk_next.commerce for ledger entitlement and current requests. Do not infer payment or delivery from legacy status, paid_for_service, requested_build, build_complete, rebuild_credits or free_rebuild_expires_at.

Creation requires intent:new; legacy app_link + preview_id updates that selected preview. list returns account preview names, published URLs, IDs and creation times. new calls the portal preview-manage create path (same-URL reuse and 20-preview cap); update requires the customer-selected preview_id and replaces that link. Published-link checks reject editor and builder-share links. At cap: Delete an existing preview to add another. Password protection and credentials, including clearing them, stay human-only on the portal. Pairing stays on the customer’s phone, never in chat. On iPhone only own previews open.

Import a direct public HTTPS PNG, JPEG or WebP image up to 8 MB, without redirects; this does not assign a screen. Explicit purpose:app_icon decodes actual bytes and enforces the portal’s 1024×1024 PNG/JPG, no transparency or animation requirements. Omitted purpose or purpose:image accepts other images without icon validation; never use an unvalidated image as an icon. Use the portal for local files and screens. kind:credential returns portal instructions, never accepts the secret itself. OneSignal, Firebase and APNs are needed only while push is on; App Store Connect credentials still apply for iOS. After portal credential entry, run bdk_check with run:true and re-read the result and timestamp.

Read the signed-in user and their projects; call first. product_selected can be an unconfirmed default. Legacy status is not ledger entitlement; use bdk_next.commerce.