v2.0.0

Profiles are curated, not derived

Breaking change — every profile changed. Which tool belonged to which profile was read off the URL, so every relationship hanging off an app landed in app-info and eight of eleven profiles could not reach their own resources from an app. Membership is hand-curated in spec/profiles.csv now and generated into the code.

• 13 profiles, up from 11. New: access, app-clips, testflight.
• user-management is gone, split into four. A config still naming it starts anyway, with a single tool explaining the split.
• Every profile changed size — app-info goes from 112 tools to 57. Check your config; the tool you reached for may be in another profile now.

Sub-profiles

32 sub-profiles across five profiles. A profile narrows with a colon: take monetization at 204 tools, or monetization:subscription-pricing at 24.
Some tools belong to more than one, so reaching a single tool no longer means loading a whole profile. The setup picker unfolds a checked profile's sub-profiles under the cursor, all on, and writes the argument for you; asc__status reports which are loaded and roughly what they cost.

Any tool in the profile, on any client

asc__describe + asc__call are present from the start, so nothing depends on a client refreshing its tool list mid-session.
asc__call is read-only; writes keep their own names and their confirmation gate.
asc__load adds a sub-profile mid-session for clients that do refresh.

Setup registers with every client you have installed

setup knew one command, claude mcp add, and left the rest to the user on a machine with Codex and Cursor.

• It detects the clients on the machine and asks which to install into: Claude Code, Claude Desktop, Codex, Antigravity, Cursor, Windsurf, VS Code.
• The vendor's own command writes where one exists (claude, codex, code --add-mcp); plain JSON configs are backed up and edited. One that cannot be parsed is left untouched and reported with a block to paste. A client failing never stops the others.
• register is the same work without a terminal, for an agent installing on your behalf: asc-mcp register monetization:subscription-pricing analytics. It only adds; removing is setup's job.

Note

ChatGPT's own connectors accept only remote HTTPS servers, so Heimdall cannot appear there; it runs on your machine over stdio, which is why the private key never leaves it. The Codex entry covers the CLI, the IDE extension and the Codex side of the ChatGPT desktop app — the three share one config file.

Fixed

• A misspelled filter changed which app you were editing. filter[bundleId] was dropped silently, ran unfiltered and returned the account's first app. Both spellings are accepted now.
• The binary exited 0 with no output when invoked through a symlink.
• Tool search returned nothing for queries in any language but English, and never said why. It returns results in every language now, and an empty result explains itself.
• Tool search offered tools the server refuses to load.

Added for contributors

An agent-experience harness: a 50-intent corpus with adversarial goals run n times rather than once, a contract check across all 982 operations for unstamped risk levels and readOnly disagreeing with the HTTP method, and a live write-path probe that creates and deletes a TestFlight group on a throwaway app — the only check that exercises token to POST to Apple's answer, since every other one runs --dry-run. tests/gate.test.ts proves the write gate fires end to end over stdio rather than merely classifying correctly.