Public submission requirements relevant to RUMBO IA CRM
Submission type: With MCP for a remote MCP-only plugin.
Submitter access: organization role with Apps Management Write / api.apps.write. Organization owners automatically have read/write.
Publisher identity: verified individual or business identity matching the public listing.
Final directory metadata: package name (<=64, restricted characters), semantic version (<=64), display name (<=30), short description (<=30), long description (<=4000), developer name (<=80), supported category, and up to 20 capabilities (each <=120).
Listing materials: production-ready logo plus public HTTPS website, support, privacy, and terms URLs matching the publisher and actual data handling.
Starter prompts: provide realistic, high-value workflows. The current RUMBO packet deliberately uses three validated prompts; this receipt does not assert a stricter public-doc maximum beyond the validated packet/schema constraint.
Remote MCP: publicly accessible production HTTPS MCP URL. Do not submit a local or testing endpoint. Universal is the normal/default choice when one fixed URL works for all users and organizations.
Domain verification: required for final remote-MCP directory submission. Serve the exact portal-issued token at the generated /.well-known/openai-apps-challenge URL and complete Verify Domain.
Tool scan: select Scan Tools, inspect discovered metadata, fix issues, deploy, and scan again; final submission requires a successful current scan of the production MCP server.
Tool annotations: every remote MCP tool must accurately expose readOnlyHint, openWorldHint, and destructiveHint, and the submission must provide a justification for every annotation value on every tool.
Response/privacy hygiene: tool responses must not include unnecessary personal data, auth secrets, debug payloads, internal identifiers, or undisclosed user-related fields. Public policy URLs must match actual data handling.
Review materials: a demo-recording URL is not listed as a mandatory field in the current public submission or remote-MCP review documentation. Demo credentials are required only when authentication is needed; screenshots are optional only when the plugin has UI.
Tests: at least five positive and three negative reviewer-reproducible test cases, plus release notes.
Availability: explicitly choose countries/regions in the portal.
UI/CSP/screenshots: CSP applies only when the server returns UI. Screenshots are allowed only when the current tool scan reports a UI output template; RUMBO IA CRM v1 has no custom UI, so screenshots and CSP are not applicable.
Review vs publication: Submit for Review starts review and does not publish. After approval, the developer separately chooses when to publish.
Remote MCP review residency gate: projects with EU data residency cannot currently submit MCP plugins for review; use a project with global data residency.
RUMBO interpretation
MONEY_SPEND=0 remains invariant.
Current staging technical conformance does not grant production-host, submission, or publication authority.
Candidate GitHub HEAD must be reconciled before workspace-draft or public-directory readiness can be promoted.
The current rumbo-crm-openai-staging.val.run surface is technically testable, but its use as the production MCP URL remains separately unauthorized and the official review guidance says not to submit a testing endpoint.
Final attestations: complete the policy attestations only after listing, server, prompts, tests, availability, and related submission materials have been confirmed accurate; only then may Submit for Review be selected.