How Ploa works
Ploa sits between your code and the two stores. Your coding agent does the work through Ploa's MCP server; Ploa holds your store keys, talks to Apple and Google, and leaves everything that can't be undone for you to approve.
One core, three ways in
| Way in | For | What it's good at |
|---|---|---|
| MCP server | Your coding agent (Claude Code, Cursor, Codex, VS Code with Copilot, Windsurf, Claude Desktop, Claude on the web) | The main way in: about 100 tools for every stage, with briefs for setting up an app, the store page, screenshots, privacy, rejections and release notes |
| Dashboard | People, at ploa.dev/app, on a computer or as an app on the phone | Approvals, where the apps stand, the store page, reviews, sales and the audit log |
| CLI | The terminal and CI: the ploa command | Building on your Mac, checking the project, shipping files built any way, with no agent |
All three work on the same data and by the same rules: what your agent starts, you see live on the dashboard, and what needs you waits in one place.
Where your agent fits
Your agent works on your code and calls Ploa's tools; Ploa does the store side. It reads the app to write the store page, the release notes and the privacy answers, makes the screenshots, fixes what preflight finds, and starts builds. Ploa checks that work against each store's rules, signs the builds and talks to Apple and Google.
- It works with a token. On your computer, the agent starts
ploa mcp, which uses yourploa login; on the web, it connects tohttps://ploa.dev/mcpwith the token you approved. The token's level caps what it may do and ask for. See Connect your agent. - It never holds your store keys. It asks Ploa, and every call to the stores leaves from Ploa's server.
- It asks before what can't be undone. App Review, production, prices, testers who get an email and replies under reviews wait for your approval, unless you made the agent autonomous. Steps only you can do in a store's console come to you as tasks, with their steps and links.
- Everything is recorded under its name. The dashboard shows what each agent is doing, and the audit log names it.
Workspaces and apps
A workspace is your team's space: its members, store connections, apps, tokens and plan. An app in Ploa is one product, with its iOS and Android sides paired by their identifiers (the bundle ID and the package name). Each app is linked to a folder in your code by ploa.json, and optionally to a GitHub repository.
Store connections and the vault
Ploa reaches App Store Connect with your team's API key and Google Play as an account you invite to Play Console. Those keys, the Android upload keys and the iOS distribution certificates are sealed in Ploa's vault on its server and encrypted at Google, with Ploa's key in Google Cloud HSM or, on any plan, your own key in Google Cloud KMS or AWS KMS. Every call to the stores leaves from there. Your computer, your CI and your agent never hold them. See Security and keys.
Releases and runs
A release is one build of one platform on its way to the stores. Its run records every step with its duration: preflight, build, signing, upload, Apple's processing or Google Play, the testing track, and the App Review or promotion step you approve. A release reaches testers on its own; going further always needs a decision. While it's still building, you or your agent can stop it.
| Stop | What happens |
|---|---|
| Preflight | The project is checked against what the stores reject: icons, purpose strings, versions, privacy, signing. Each finding comes with its fix. |
| Build and sign | On your Mac, GitHub, Xcode Cloud or your Google Cloud. Ploa signs with keys that stay on its server, and the build goes from where it was built straight to the store. |
| Testers | Straight to TestFlight and Google Play internal testing. |
| Review | Sent to App Review or Google's review with your approval. If a store says no, Ploa shows why. |
| Live | Production, phased release or staged rollout, pause and resume, each one approved by you. |
Drafts
The store page (text in every language, links, category, age rating, price, privacy, App Review's contact) is kept in Ploa as drafts, one set of answers for both stores. You and your agents write drafts, Ploa checks them against each store's rules as they're written, and you send them all with one click. While Apple has something with App Review, changes to it are kept in Ploa and sent once Apple decides.
Approvals
Submitting to App Review, releasing, promoting to production, changing a price, inviting testers, replying to a review: an agent or the CLI asks, and you approve it with one tap, on the dashboard or from a notification. You can make an agent autonomous instead; everything it does is still recorded under its name. The full list of what waits for you: Access and approvals.
Tokens and levels
The CLI and agents work with tokens. Each has a level (read, draft, submit for review, production) that caps what it may touch and what it may ask for; you pick it when you approve ploa login or an agent on the web, and change it in Settings › Tokens. A token never shows a secret, never approves, and never makes another token, and it never does more than you may: a member's agents have that member's permissions.
The audit log
Every change, by whom (you or a member, the CLI or a named agent) and from where, goes into a hash-chained log on the dashboard. Owners get an alert for each sign-in, new key, token or member change.
Ploa has no AI of its own
The writing (store text, release notes, privacy answers, replies to reviews) is done by your agent, from your code. Ploa knows the stores' rules, checks the work, and does the store side. That keeps your code and your data with the tools you chose.