ipaShip - Mobile Apps Compliance Auditor (Open Source)

AI-powered iOS App Store compliance auditor. Upload your .ipa file and get a comprehensive audit against Apple's Review Guidelines — before you submit.

Added kimi 2.5 as default with my own api key.

Live at: opensource.ipaship.com

Features

• IPA Analysis — Upload .ipa files (up to 150MB) for automated compliance auditing
• Full Guidelines Coverage — Checks all 6 major App Store Review Guideline categories: Safety, Performance, Business, Design, Legal & Privacy, and Technical
• Multi-Provider AI — Bring your own key from Anthropic (Claude), OpenAI (GPT), Google Gemini, or OpenRouter
• Model Selection — Choose specific models per provider (Kimi 2.5, Claude Sonnet 4, GPT-4o, Gemini 2.5 Flash, etc.)
• Real-Time Streaming — Watch your audit report generate live as the AI analyzes your code
• Export Reports — Download as Markdown or PDF
• Zero-Trust Security — Files processed in ephemeral temp storage and deleted immediately. API keys stay in your browser, never on our servers
• 100% Open Source — Fully auditable codebase

Tech Stack

Layer	Technology
Frontend	Next.js 15, React 19, TypeScript, Tailwind CSS, Framer Motion
Backend	Next.js API Routes (Node.js)
Database	MongoDB (Mongoose)
AI Providers	Anthropic, OpenAI, Google Gemini, OpenRouter
File Processing	Busboy (streaming uploads), unzip (IPA extraction)
Export	html2pdf.js, React Markdown

Getting Started

Prerequisites

• Node.js 18+
• MongoDB URI (Atlas or local)
• API key from at least one AI provider
• unzip installed on the server/runtime environment

# Ubuntu/Debian
sudo apt-get update && sudo apt-get install -y unzip

Setup

# Clone the repo
git clone https://github.com/atharvnaik1/ipaship-app-reviewer.git
cd ipaship-app-reviewer

# Install dependencies
npm install

# Create environment file and fill in the required values
cp .env.example .env.local

# Start dev server
npm run dev

Open http://localhost:8080 in your browser.

Production Build

npm run build
npm start

How It Works

1. Upload — Drop your .ipa file. The server streams it to disk via Busboy without buffering in memory.
2. Extract — The IPA is unzipped and all relevant source files are collected (.swift, .m, .plist, .entitlements, .storyboard, .xcprivacy, etc.). Binary files and build artifacts are skipped.
3. Analyze — Source files are sent to your chosen AI provider with a structured audit prompt. The response streams back in real-time.
4. Report — You get a structured compliance report with pass/fail indicators, severity ratings, and a prioritized remediation plan.

API Endpoints

Method	Endpoint	Purpose
POST	/api/audit	Upload IPA, stream AI audit report
POST	/api/save-report	Save report to MongoDB
GET	/api/visitor	Increment and return visitor count

Client Wrappers / SDKs

ipaShip provides ready-to-use boilerplate SDKs and wrappers for various ecosystems and languages. You can find them in the wrappers/ directory. Each wrapper is skeletoned to pragmatically audit your .ipa files directly from your CI/CD pipelines, backend backend, or build environments!

Commands to Run Wrappers