AppGoat
REMOTE · API.APPGOAT.AI
App Store and Google Play data: apps, reviews, keywords, charts, competitors, ASO playbooks.
Available components
Last scanned (4 hours ago)
Scores higher than 64% of remote servers
Reachable. Last reached 23 Oct 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security78
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS enforcement could not be verified: the plaintext port answered with HTTP 401, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability75
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 7503 tokens (~258/item across 29 items; 29 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 29 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 29 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Oct 26 73
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Oct 2026 · Probed https://api.appgoat.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=appgoat.ai | CN=YE1,O=Let's Encrypt,C=US | 20 Oct 2026 | 18 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 6d3c0a8296a11c32a6dc697d7d00204a5be |
| SANs: *.appgoat.ai, appgoat.ai | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.appgoat.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| appgoat.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="OAuth", error="invalid_token", error_description="Missing or invalid access token", resource_metadata="https://api.appgoat.ai/.well-known/oauth-protected-resource"
Bearer realm="OAuth", error="invalid_token", error_description="Missing or invalid access token", resource_metadata="https://api.appgoat.ai/.well-known/oauth-protected-resource" Protected resource metadata
| Document | https://api.appgoat.ai/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://api.appgoat.ai |
| Authorisation server | https://api.appgoat.ai |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.appgoat.ai/mcp | Verified | 200 | |
| http (plaintext) | http://api.appgoat.ai/mcp | Inconclusive | 401 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
apply_action Apply Action ~244
Go ahead with an action from propose_action, after the user has seen its diff and agreed. Outcomes: applied (written to the store / Apple Ads account, 1 credit; when the org has an auto-apply rule the guardrail score clears, or allows agents to approve); pending_approval (a person must approve it in the AppGoat dashboard: give the user the approve link, nothing is written until then); needs a person (it was already pending and agents may not approve: hand over the link, do not retry); changed (the account changed since the dry run: the new diff is shown; show it to the user and call again with force=true only if they accept it, or propose_action again). Cost: 1 credit when applied, else 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| force | boolean | – | Apply the recomputed diff even though the account changed since the dry run. Only after the user has seen the new diff |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| id | string | yes | Action id (act_…) from propose_action |
No output schema declared.
No examples provided.
audit_app Audit App ~432
Run an App Audit of one app in one country: a 0–100 score, prioritised ASO actions with evidence, title / subtitle / keyword rewrites within the store character limits, and findings from listing, ratings, reviews, keywords and competitors, plus a shareable report page. Takes 1–3 minutes: waits about 25 s, then returns the audit id to pass to get_audit. An audit of the same app, country and mode from the last 24 h is returned again for free unless fresh=true; failed audits are not charged. The first audit of an organization is free (free_only=true runs only that one). Cost: 100 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | Any app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na… |
| country | string | – | Two-letter country code, one storefront (default 'us'). |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| free_only | boolean | – | Only run when it is the free first audit (402 free_audit_used otherwise). Default: false. |
| fresh | boolean | – | Run again even if a recent audit exists. Default: false. |
| label | – | – | Your label for the audit list, e.g. the client or prospect name. |
| mode | string | – | lite = cached data, fewer reviews and keywords (cheaper and faster for us; same price). Default: full. |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
| white_label | boolean | – | Studio: the shareable report shows the organization's branding (set in the dashboard under Settings → Report branding) instead of AppGoat's, e.g. for client or prospect reports. |
No output schema declared.
No examples provided.
get_action Get Action ~112
One action from propose_action: its status (draft, pending_approval, approved, applied, failed, rejected), diff, guardrail scores, the provider result or error, the approve link and the audit trail. Use it to check whether a pending action was approved and applied. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| id | string | yes | Action id (act_…) |
No output schema declared.
No examples provided.
get_app Get App ~432
Look up one App Store or Google Play app: title, subtitle, developer, category, price, rating and histogram, installs (Play), version and dates, description, languages, and the same app in the other store. Accepts any id, bundle id, package, store URL or a name. Reads stored data (refreshed from the store only when older than max_age, default 7 days) for one country (default us); add include sections for markets, versions, IAP, privacy, estimates and chart positions. Cost: 1 + 1 per country refreshed from the store (max 10) credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | Any app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na… |
| country | string | – | ISO country code(s): `us` (default), a comma list (paid plans), or `all` (Studio). Example: us,de |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| full_text | boolean | – | Return long text (description, release notes, review bodies) in full instead of cut short |
| include | array | – | Extra sections: markets (every storefront), iap, versions (history with release notes), privacy (App Store labels), estimates (modelled downloads/revenue), charts (current top-chart positions) |
| max_age | integer | – | Refresh from the store when our data is older than this many seconds (0 = always). Default 604800 (7 days). |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
| wait | boolean | – | Block up to ~25 s for a refresh (default). false = answer immediately from cache with a job id. |
No output schema declared.
No examples provided.
get_app_changes Get App Changes ~321
What changed in an app's store listing, newest first, with old and new values: version, release notes, title, subtitle, description, screenshots, icon, price, IAP, privacy, in-app events, badges, featuring, installs, content rating. Use it to monitor competitors ("what did X change this month?"). Cost: 1 + 1 if the US listing is refreshed credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | Any app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na… |
| country | string | – | Only changes seen in these storefronts (comma list). Default all storefronts. |
| cursor | string | – | `meta.next_cursor` from the previous page. |
| field | string | – | Only these fields (comma list), e.g. `version,title,subtitle`. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| limit | integer | – | Max items to return. Default: 50. |
| since | string | – | Only items at or after this ISO date / datetime. Example: 2026-10-01 |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
No output schema declared.
No examples provided.
get_app_history Get App History ~283
An app's daily metric history per country: rating, ratings count, reviews count, installs (Play), star histogram and price, one row per day a value changed (default the last 90 days), with the change over the period. Use it to chart growth or spot rating drops after a release. Cost: 1 + 1 per country refreshed (max 10) credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | Any app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na… |
| country | string | – | ISO country code(s): `us` (default), a comma list (paid plans), or `all` (Studio). Example: us,de |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| from | string | – | Start date (ISO), default 90 days before `to`. |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
| to | string | – | End date (ISO), default today. |
No output schema declared.
No examples provided.
get_app_keywords Get App Keywords ~260
The search terms an app ranks for in a country, best rank first, with popularity (5–100) and difficulty (0–100): from the weekly keyword universe plus your tracked keywords. Call it for the app and a competitor to find keyword gaps. Cost: 1 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | Any app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na… |
| country | string | – | Two-letter country code (default 'us'). |
| cursor | string | – | `meta.next_cursor` from the previous page. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| limit | integer | – | Max items to return. Default: 100. |
| max_rank | integer | – | Only terms where the app ranks at or above this position. |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
No output schema declared.
No examples provided.
get_audit Get Audit ~142
Check on an App Audit that audit_app started (by its id, e.g. aud_3fK9aQ2mXc81LpRt): waits up to about 25 s for it to finish, then returns the report (score, actions, metadata rewrites, findings, report page) or its status. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| id | string | yes | Audit id from audit_app, e.g. aud_3fK9aQ2mXc81LpRt |
No output schema declared.
No examples provided.
get_charts Get Charts ~241
A top free, paid or grossing chart for a store, country and category, today or on a past date: rank, app, developer, rating and the move since the previous capture (new entries marked), plus apps that dropped out. Charts are captured daily for every country and category. Cost: 1 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | App Store genre id (`36` or `all` = all apps, `6014` = games, …) or Play category (`GAME_PUZZLE`; `APPLICATION` = all apps). |
| chart | string | – | 'free' (default), 'paid' or 'grossing'. |
| country | string | – | Two-letter country code (default 'us'). |
| date | string | – | The chart as of this date (ISO). Default the latest capture. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| limit | integer | – | How many ranks to return (default 100, max 200). |
| store | string | – | 'apple' (default) or 'play'. |
No output schema declared.
No examples provided.
get_competitors Get Competitors ~219
An app's competitors, best first, scored from search terms both apps rank for (shared keywords) plus the store's similar-apps list. Feed the app ids into get_app or get_app_changes for a competitor digest. Cost: 1 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | Any app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na… |
| country | string | – | Two-letter country code (default 'us'). |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| limit | integer | – | Max items to return. Default: 20. |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
No output schema declared.
No examples provided.
get_developer Get Developer ~170
A developer's profile: name, website, country, app count, total ratings and installs, all their apps (most-rated first) and the same company in the other store. get_app shows the developer id as dev <store>:<id>. Cost: 1 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| dev | string | yes | `apple:<artist id>`, `play:<developer id>`, a numeric Apple artist id, a Play developer id (often the name), or the website domain (`spotify.com`). Example: apple:324684583 |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
No output schema declared.
No examples provided.
get_events Get Events ~341
Significant changes on your watched apps and keywords, newest first: type, one-line title, AI summary, significance (0–1), app, country and the key payload fields (version, changes old → new, rating drop, rank move, chart rank…). Filter by type, app, watch, since and min_significance. To check for news, pass since = the created_at of the newest event already handled. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Only events of this app (any id, bundle id, package, URL or name). |
| cursor | string | – | `meta.next_cursor` from the previous page. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| limit | integer | – | Max items to return. Default: 50. |
| min_significance | number | – | Only events at least this significant (0–1). |
| since | string | – | Only items at or after this ISO date / datetime. Example: 2026-10-01 |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
| type | string | – | Comma list of event types, e.g. 'new_version,rating_drop'. Types: new_version, metadata_change, price_change, featured, in_app_event, installs_milestone, rating_drop, ratings_spike, review_spike, neg… |
| watch | integer | – | Only events of this watch id. |
No output schema declared.
No examples provided.
get_insights Get Review Insights ~295
What an app's users praise and complain about, from the AI tags on its reviews: top issues (topics behind negative, bug, crash, UX and pricing reviews) with last-30-days vs previous-30-days counts and sample reviews, topics, what each recent version changed in rating, sentiment and topics, and weekly sentiment. Use it for "what do users complain about since v2.3?" before reading individual reviews with get_reviews. Cost: 25 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | Any app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na… |
| country | string | – | One storefront; omit for every storefront we hold reviews for. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| since_days | integer | – | How many days of reviews to analyse, 7–730 (default 180). |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
| versions | integer | – | How many of the latest versions to break down. Default: 6. |
No output schema declared.
No examples provided.
get_job Get Job ~105
Poll a background store fetch that another call started (its output said refreshing or still being fetched, with a job id): status, per-country progress. When it is done, repeat the original call. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| id | string | yes | `meta.freshness.job_id`, e.g. `fetch_123`. |
No output schema declared.
No examples provided.
get_keyword_ranks Get Keyword Ranks ~193
Ranking history of a watched keyword: per capture the top 10 app ids, or with app, that app's rank over time (best, worst, latest). Default the last 90 days. The id is a keyword slot of a keyword watch (list_watches and watch show the slot ids) or a list_tracked_keywords id. Cost: 1 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Store app id; returns `rank` per point instead of the full id list. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| from | string | – | Start, ISO date or datetime (default 90 days ago) |
| id | integer | yes | Keyword slot id (from a keyword watch, or list_tracked_keywords) |
| to | string | – | End date or datetime (ISO), default now. |
No output schema declared.
No examples provided.
get_reviews Get Reviews ~558
Read an app's user reviews, newest first, up to 100 per page: rating, title, text, version, date, developer reply and AI tags (sentiment, intent, severity, topic) where tagged. Filter by stars (rating='1-2' for complaints), version, date range, text (q) or AI tags (intent='bug,crash'; tag filters skip untagged reviews). Page with cursor. Cost: 1 per page + 1 if the US reviews are refreshed credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | Any app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na… |
| country | string | – | ISO country code(s): `us` (default), a comma list (paid plans), or `all` (Studio). Example: us,de |
| cursor | string | – | `meta.next_cursor` from the previous page. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| full_text | boolean | – | Return long text (description, release notes, review bodies) in full instead of cut short |
| intent | string | – | AI intent filter (comma list): bug, crash, feature_request, pricing, ux, praise, spam, other. Example: bug,crash |
| limit | integer | – | Max items to return. Default: 50. |
| max_age | integer | – | Refresh the latest US reviews when older than this many seconds. Default 86400 (1 day). |
| q | string | – | Case-insensitive text search in the title and body. Example: crash |
| rating | string | – | Star rating filter, `1`, `1,2` or a range `1-3`. Example: 1-2 |
| sentiment | string | – | AI sentiment filter (comma list): positive, neutral, negative. Example: negative |
| since | string | – | Only items at or after this ISO date / datetime. Example: 2026-10-01 |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
| topic | string | – | AI topic filter (comma list of topic labels, case-insensitive, or topic ids). |
| until | string | – | Only reviews created before this ISO date / datetime. |
| version | string | – | Only reviews written for this app version. |
No output schema declared.
No examples provided.
keyword_research Keyword Research ~314
Keyword metrics and research for App Store / Google Play search terms: popularity (5–100), difficulty (0–100), result count and the #1 result's estimated daily downloads. include adds related terms with metrics, the store's autocomplete and the current top 10 apps; app adds that app's rank and metadata relevance per term (the core of an ASO keyword audit). Unmeasured terms are measured live (a few per call) or come back pending. Cost: 1 per keyword; 5 per seed with include=related or suggestions credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Any app identifier (as in `{app}`); adds `app.rank` and `app.relevance` per term. |
| country | string | – | Two-letter ISO country code (storefront), e.g. us, gb, de. Default: us. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| include | array | – | related (~10 related terms with metrics), suggestions (store autocomplete), top_apps (current top 10). related/suggestions cost 5 credits per term |
| store | string | – | Required unless `app` is given. |
| terms | array | yes | Search terms, 1–25 (at most 5 with include related or suggestions) |
| wait | boolean | – | Block up to ~25 s for a refresh (default). false = answer immediately from cache with a job id. |
No output schema declared.
No examples provided.
list_connections List Connections ~135
The user's connected App Store Connect, Play Console and Apple Ads accounts: connection id, provider, mode (actions or read_only), status and the linked apps. Start here before read_connection or propose_action; secrets are never returned. No connections yet: the user adds them at https://dash.appgoat.ai/connections. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| provider | string | – | Only this provider: 'asc' (App Store Connect), 'play_console' or 'apple_ads'. |
No output schema declared.
No examples provided.
list_playbooks List Playbooks ~127
AppGoat playbooks: step-by-step recipes (which tools to call, credit budget, decision rules, output format) for app audits, app idea research, ASO metadata rewrites, weekly competitor digests, turning reviews into GitHub issues, and, on connected accounts, replying to every review, optimizing Apple Ads and pushing localized listings. Without name, lists them; with name, returns the full playbook to follow. Also offered as MCP prompts. Free.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | A playbook name from the list, e.g. 'app-audit-lite' |
No output schema declared.
No examples provided.
list_tracked_keywords List Tracked Keywords ~143
Deprecated: use list_watches (keyword watches list their slots). Your tracked keywords with id, store, country, popularity, depth, cadence, last ranking and current top 3. Filter by store, country or a term substring. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Only this two-letter country code. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| q | string | – | Only terms containing this text. |
| store | string | – | 'apple' = Apple App Store (iOS), 'play' = Google Play (Android). |
No output schema declared.
No examples provided.
list_watches List Watches ~170
Your watches (apps, competitor sets, keyword sets), newest first, with id, apps, terms, countries, event types and whether they are paused, plus watched apps and keyword slots used vs the plan's limits. Filter by kind or by an app they include. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | Only watches that include this app (any id, bundle id, package, URL or name). |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| kind | string | – | Only this kind: 'app', 'competitor_set' or 'keyword'. |
| store | string | – | Disambiguates `{app}` (a bundle id vs a Play package, or a name). |
No output schema declared.
No examples provided.
propose_action Propose Action ~500
Prepare a change to the user's connected account as a DRY RUN: nothing is written. AppGoat reads the live account and returns the before → after diff, guardrail results (AI probabilities for store policy, tone and risky claims, plus checks such as character limits and bid jumps) and an action id. ALWAYS show the diff and any guardrail flags to the user and get their go-ahead before calling apply_action. Types and params (app = a linked App Store id or package name, locale like en-US): review.reply {app, review_id, text} (review ids from read_connection what=reviews; Play replies ≤ 350 chars); listing.update {app, locale, fields: {name|title, subtitle, description, promotional_text, whats_new, marketing_url, support_url, privacy_policy_url}} (Play: title, short_description, full_description, video); keywords.set {app, locale, keywords: [..] or 'a,b,c', mode?: replace|add|remove} (App Store, 100 bytes comma-joined); screenshots.upload {app, locale, display_type: APP_IPHONE_67… (asc) or image_type: phoneScreenshots… (play), images: [{url}], replace?}; ads.keyword.bid {campaign_id, ad_group_id, keywords: [{id, bid?, status?: ENABLED|PAUSED}], max_increase?}; ads.keyword.add {campaign_id, ad_group_id, keywords: [{text, match_type?: EXACT|BROAD, bid?}]}; ads.negative.add {campaign_id, ad_group_id?, keywords: [{text, match_type?}]} (Apple Ads ids from read_connection what=ads). Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| connection | string | – | Connection id from list_connections; optional when exactly one active connection fits the type and app |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| params | object | yes | Params for the type (see the tool description) |
| playbook | string | – | The playbook proposing this, e.g. 'reply-to-every-review' (shown to approvers); omit outside a playbook |
| type | string | yes | What to change: review.reply, listing.update, keywords.set, screenshots.upload, ads.keyword.bid, ads.keyword.add or ads.negative.add |
No output schema declared.
No examples provided.
read_connection Read Connection ~592
Read live data from one of the user's connected accounts. what='reviews' (asc, play_console): the app's own reviews with reply status, unanswered=true for those without a developer reply; their review_id feeds propose_action review.reply (Play only returns reviews from the last 7 days). what='listing' (asc, play_console): the current listing text for one locale with lengths and which fields are editable right now (App Store name, subtitle, description, keywords and what's new need a version in Prepare for Submission). what='ads' (apple_ads): view=campaigns → ad_groups (campaign_id) → keywords (campaign_id, ad_group_id) gives the ids the ads.* actions take, view=negatives lists negative keywords, view=report with level=campaigns|adgroups|keywords|searchterms returns impressions, taps, installs, spend, CPT and CPA for start..end (default the last 7 days). Cost: 1 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| ad_group_id | string | – | ads: ad group id (needed for keywords; optional for negatives) |
| app | string | – | A linked app (App Store id or package name); required for reviews and listing |
| campaign_id | string | – | ads: campaign id (needed for ad_groups, keywords, negatives and every report level except campaigns) |
| country | string | – | reviews: App Store territory filter (two-letter code) |
| cursor | string | – | reviews: next_cursor from the previous page |
| end | string | – | ads report: end date YYYY-MM-DD (default yesterday, UTC) |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| full_text | boolean | – | Return long text (description, release notes, review bodies) in full instead of cut short |
| id | string | yes | Connection id (con_…) from list_connections |
| level | string | – | ads report: 'campaigns' (default), 'adgroups', 'keywords' or 'searchterms' |
| limit | integer | – | Max rows: reviews up to 200 (default 100), ads up to 1000 (default 200) |
| locale | string | – | listing: locale such as en-US, de-DE (default en-US) |
| rating | string | – | reviews: star filter, '1', '1,2' or '1-3' |
| start | string | – | ads report: start date YYYY-MM-DD (default 7 days before end) |
| unanswered | boolean | – | reviews: only reviews without a developer reply |
| view | string | – | ads: 'campaigns' (default), 'ad_groups', 'keywords', 'negatives' or 'report' |
| what | string | yes | 'reviews', 'listing' or 'ads' (Apple Ads) |
No output schema declared.
No examples provided.
reject_action Reject Action ~90
Discard a draft or pending action the user does not want; nothing is written to the account. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| id | string | yes | Action id (act_…) |
| reason | string | – | Why (shown in the audit log) |
No output schema declared.
No examples provided.
search_apps Search Apps ~215
Find apps by name or id in AppGoat's catalog of both stores (~5M apps): exact title matches first, then prefix, then substring, most-rated first. Returns store, app_id, title, developer, category, rating, ratings and price; pass the app_id to the other tools. Cost: 1 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Store category name, e.g. `Photo & Video` (App Store) or `PHOTOGRAPHY` (Play). |
| cursor | string | – | `meta.next_cursor` from the previous page. |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| limit | integer | – | Max items to return. Default: 20. |
| q | string | yes | App name (≥ 2 characters) or exact id. Example: photo editor |
| store | string | – | Limit to one store: 'apple' or 'play'. Omit for both. |
No output schema declared.
No examples provided.
track_keywords Track Keywords ~227
Deprecated: use watch with kind keyword (also reports rank moves as events). Starts tracking the search ranking of terms in one or both stores and the given countries: ranked apps are captured daily from now on (idempotent; already tracked terms are reported as such). Each term × store × country uses one keyword slot of the plan; a request over the limit tracks nothing (plan_limit). Read history with get_keyword_ranks. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| countries | array | – | Two-letter country codes to track in (default ['us']) |
| depth | integer | – | How many results to keep per ranking (default 100 Apple / 50 Play). |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| store | string | yes | 'apple', 'play' or 'both' (tracks each term in each store) |
| tags | array | – | Free-form labels. |
| terms | array | yes | Search terms to track, e.g. ['habit tracker', 'streaks'] |
No output schema declared.
No examples provided.
untrack_keywords Untrack Keywords ~62
Deprecated: use unwatch for keyword watches. Stops tracking keywords by id (from list_tracked_keywords or track_keywords): no new rankings are recorded and their plan slots are freed. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | Tracked keyword ids |
No output schema declared.
No examples provided.
unwatch Unwatch ~66
Stop watches by id (from list_watches or watch): no new events, and their watched apps and keyword slots are freed. Past events are kept. To pause instead, call watch with id and active=false. Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| ids | array | yes | Watch ids |
No output schema declared.
No examples provided.
watch Watch ~514
Watch an app, a set of competitors or a set of keywords; significant changes become events (get_events, webhooks, daily email). kind app {app}: new versions, metadata and price changes, featuring, rating drops, review and ratings spikes, chart entries. kind competitor_set {competitors, app?}: the same for every competitor. kind keyword {terms, store or app}: the app's rank moves per term and new apps in the top N. Watched apps count against the plan's watch limit, keyword watches use one keyword slot per term × store × country; over a limit nothing changes (plan_limit). With id, changes that watch instead (send only what changes; settings are merged; active=false pauses it). Cost: 0 credits.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | false pauses the watch, true resumes it |
| app | string | – | Any app id, bundle id, package, store URL or name. kind app: the app (required); competitor_set: your own app (optional); keyword: the app whose ranks to report (optional) |
| competitors | array | – | kind competitor_set: the apps to watch (any identifiers), up to 50 |
| countries | array | – | Two-letter country codes to watch in (default ['us']) |
| event_types | – | – | Only these event types (default: every type of the kind) |
| format | string | – | 'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta } |
| id | integer | – | Watch id to change (from list_watches). Omit to create a watch |
| kind | string | – | 'app' (one app), 'competitor_set' (several apps) or 'keyword' (search terms). Required when creating |
| name | – | – | A label for the watch |
| settings | object | – | Thresholds: significance (0–1, default 0.5, minimum for an event), rank_move (default 5), keyword_top_n (10), chart_top_n (100), rating_drop (stars over 7 days, 0.1), spike_factor (3), email_digest (… |
| store | string | – | 'apple', 'play' or 'both' (keyword watches without app; default both). Also disambiguates app inputs |
| terms | array | – | kind keyword: search terms, e.g. ['habit tracker', 'streaks'] |
No output schema declared.
No examples provided.
How do I install the AppGoat MCP server?
AppGoat is a hosted endpoint at https://api.appgoat.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.appgoat.ai
claude mcp add --transport http ai-appgoat-mcp 'https://api.appgoat.ai/mcp'
What is the AppGoat MCP server?
AppGoat is an MCP server listed in the public MCP registry as ai.appgoat/mcp. App Store and Google Play data: apps, reviews, keywords, charts, competitors, ASO playbooks. This page covers its hosted endpoint (https://api.appgoat.ai/mcp).
Is the AppGoat MCP server safe to use?
AppGoat scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the AppGoat MCP server expose?
AppGoat exposes 29 tools: get_app, get_reviews, get_app_history, get_app_changes, get_app_keywords, and 24 more. Their descriptions and schemas cost roughly 7,503 tokens of context every time the server is loaded.
Does the AppGoat MCP server require authentication?
Yes. AppGoat asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the AppGoat MCP server still maintained?
AppGoat is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.