TOMO Sandbox-to-Production Checklist

Audience: every TOMO partner. Our team reviews every connection by hand. Nothing reaches real people until it is approved — you cannot self-promote.

We don't promise a review time yet. Complete submissions are the fastest to approve.

Why this page is short (2026-10-03): an earlier version listed field audits, probation ranks, bans and review windows that no code or team runs today. This checklist lists only what TOMO really checks. Anything planned is marked (planned).

1. The principle

Sandbox traffic does not reach real people. Production traffic does. Before your connection goes live, TOMO must trust three things:

1. You return real, complete data. No placeholders, no Lorem Ipsum, no AI-generated photos, no fake ratings.
2. You honor the contract. What is in your search response is what the customer pays and receives.
3. Your business is legitimate. A live privacy policy, the licences your intent's spec names (for businesses in India: GSTIN, and FSSAI for food), and real customer support.

2. The checklist

[ ] Application approved, and your keys set up with our team (there is no self-serve dashboard yet)
[ ] Sandbox credentials stored in your secrets manager
[ ] Webhook URL given to us and its signing key stored — never in source control
[ ] One signed test POST to /api/v1/cpc/mcp_provider/<your_account_id> returned 201
    (see WEBHOOK_SIGNING.md — and never resend after a 201; duplicates are not de-duplicated yet)
[ ] Manifest submitted: every intent has `intent` and `domain`, pricing.min ≤ pricing.max,
    at least one service_area
[ ] Verification sent: live privacy-policy URL, business name, legal entity type — and for
    businesses in India, GSTIN, plus FSSAI if you serve food
[ ] MCP server on HTTPS answers `initialize` and `tools/list`, and every TOMO tool carries
    `_meta.tomo` with `intent` and `domain` (see MCP_SPEC.md)
[ ] If your customers sign in with you: OAuth 2.1 with PKCE works end to end from TOMO
[ ] Your responses carry real data — every field your intent's spec requires, no placeholder
    photos or ratings, none of the forbidden ranking fields (paid_placement_score, ad_bid,
    sponsored_rank, promotion_priority, kickback fields, artificial urgency text)
[ ] Real customer support at the hours you state

3. What happens next

Our team reviews your submission by hand and runs real requests through TOMO with you — search, choices, cart — up to your own checkout. Then one of two things:

• Approved — your connection is switched on and your service can be offered as one of the choices when someone asks for what you serve.
• Changes requested — with notes on what to fix. Fix them and tell us; we review again.

(planned: automatic latency, completeness and support monitoring — not built yet. Today, problems after launch are handled by our team.)

4. Questions

Email krishna.gamasany@automobnxt.com — every partner message goes to the founder.

Built by AUTOMOBNXT · DPIIT Recognised Startup · 2026.