If I have Apex code in my managed package that makes calls to the metadata API of the org in which it is installed to do various things, e.g. describe page layouts, create Visualforce pages based on arbitrary logic, will such an app pass the security review and is it eligible to be listed on the AppExchange? Or does SFDC have any objections against such use-cases?
Note that a call to the Metadata API is a SOAP over HTTP call, one would typically import the Metadata WSDL into an org to generate Apex stubs to be able to make calls. Alternative is to construct SOAP envelops manually.