Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

AppGoat

REMOTE · API.APPGOAT.AI

App Store and Google Play data: apps, reviews, keywords, charts, competitors, ASO playbooks.

Available components

73 Trust /100

Last scanned (4 hours ago)

Scores higher than 64% of remote servers

Reachable. Last reached 23 Oct 2026.

Category Marketing and SEO

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security78
  • The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
  • Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
  • HTTPS enforcement could not be verified: the plaintext port answered with HTTP 401, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
  • HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
  • DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
  • The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
Schema Quality & AI Usability75
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 7503 tokens (~258/item across 29 items; 29 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 29 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 29 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 23 Oct 26 73

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 23 Oct 2026 · Probed https://api.appgoat.ai/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=appgoat.ai CN=YE1,O=Let's Encrypt,C=US 20 Oct 2026 18 Jan 2027 ECDSA 256 ECDSA-SHA384 6d3c0a8296a11c32a6dc697d7d00204a5be
SANs: *.appgoat.ai, appgoat.ai
CN=YE1,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 5ddd70dd31f801c85c186a7a04b80afe
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of api.appgoat.ai. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
ai. present 3799 8 Verified
appgoat.ai. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer realm="OAuth", error="invalid_token", error_description="Missing or invalid access token", resource_metadata="https://api.appgoat.ai/.well-known/oauth-protected-resource"

Bearer realm="OAuth", error="invalid_token", error_description="Missing or invalid access token", resource_metadata="https://api.appgoat.ai/.well-known/oauth-protected-resource"

Protected resource metadata

Document https://api.appgoat.ai/.well-known/oauth-protected-resource
Retrieved Yes
Resource https://api.appgoat.ai
Authorisation server https://api.appgoat.ai

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://api.appgoat.ai/mcp Verified 200
http (plaintext) http://api.appgoat.ai/mcp Inconclusive 401
MCP tools · 29 exposed · ~7,503 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
apply_action ~244

Go ahead with an action from propose_action, after the user has seen its diff and agreed. Outcomes: applied (written to the store / Apple Ads account, 1 credit; when the org has an auto-apply rule the guardrail score clears, or allows agents to approve); pending_approval (a person must approve it in the AppGoat dashboard: give the user the approve link, nothing is written until then); needs a person (it was already pending and agents may not approve: hand over the link, do not retry); changed (the account changed since the dry run: the new diff is shown; show it to the user and call again with force=true only if they accept it, or propose_action again). Cost: 1 credit when applied, else 0 credits.

NameTypeReqDescription
forceboolean–Apply the recomputed diff even though the account changed since the dry run. Only after the user has seen the new diff
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
idstringyesAction id (act_…) from propose_action

No output schema declared.

No examples provided.

audit_app ~432

Run an App Audit of one app in one country: a 0–100 score, prioritised ASO actions with evidence, title / subtitle / keyword rewrites within the store character limits, and findings from listing, ratings, reviews, keywords and competitors, plus a shareable report page. Takes 1–3 minutes: waits about 25 s, then returns the audit id to pass to get_audit. An audit of the same app, country and mode from the last 24 h is returned again for free unless fresh=true; failed audits are not charged. The first audit of an organization is free (free_only=true runs only that one). Cost: 100 credits.

NameTypeReqDescription
appstringyesAny app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na…
countrystring–Two-letter country code, one storefront (default 'us').
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
free_onlyboolean–Only run when it is the free first audit (402 free_audit_used otherwise). Default: false.
freshboolean–Run again even if a recent audit exists. Default: false.
label––Your label for the audit list, e.g. the client or prospect name.
modestring–lite = cached data, fewer reviews and keywords (cheaper and faster for us; same price). Default: full.
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).
white_labelboolean–Studio: the shareable report shows the organization's branding (set in the dashboard under Settings → Report branding) instead of AppGoat's, e.g. for client or prospect reports.

No output schema declared.

No examples provided.

get_action ~112

One action from propose_action: its status (draft, pending_approval, approved, applied, failed, rejected), diff, guardrail scores, the provider result or error, the approve link and the audit trail. Use it to check whether a pending action was approved and applied. Cost: 0 credits.

NameTypeReqDescription
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
idstringyesAction id (act_…)

No output schema declared.

No examples provided.

get_app ~432

Look up one App Store or Google Play app: title, subtitle, developer, category, price, rating and histogram, installs (Play), version and dates, description, languages, and the same app in the other store. Accepts any id, bundle id, package, store URL or a name. Reads stored data (refreshed from the store only when older than max_age, default 7 days) for one country (default us); add include sections for markets, versions, IAP, privacy, estimates and chart positions. Cost: 1 + 1 per country refreshed from the store (max 10) credits.

NameTypeReqDescription
appstringyesAny app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na…
countrystring–ISO country code(s): `us` (default), a comma list (paid plans), or `all` (Studio). Example: us,de
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
full_textboolean–Return long text (description, release notes, review bodies) in full instead of cut short
includearray–Extra sections: markets (every storefront), iap, versions (history with release notes), privacy (App Store labels), estimates (modelled downloads/revenue), charts (current top-chart positions)
max_ageinteger–Refresh from the store when our data is older than this many seconds (0 = always). Default 604800 (7 days).
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).
waitboolean–Block up to ~25 s for a refresh (default). false = answer immediately from cache with a job id.

No output schema declared.

No examples provided.

get_app_changes ~321

What changed in an app's store listing, newest first, with old and new values: version, release notes, title, subtitle, description, screenshots, icon, price, IAP, privacy, in-app events, badges, featuring, installs, content rating. Use it to monitor competitors ("what did X change this month?"). Cost: 1 + 1 if the US listing is refreshed credits.

NameTypeReqDescription
appstringyesAny app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na…
countrystring–Only changes seen in these storefronts (comma list). Default all storefronts.
cursorstring–`meta.next_cursor` from the previous page.
fieldstring–Only these fields (comma list), e.g. `version,title,subtitle`.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
limitinteger–Max items to return. Default: 50.
sincestring–Only items at or after this ISO date / datetime. Example: 2026-10-01
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).

No output schema declared.

No examples provided.

get_app_history ~283

An app's daily metric history per country: rating, ratings count, reviews count, installs (Play), star histogram and price, one row per day a value changed (default the last 90 days), with the change over the period. Use it to chart growth or spot rating drops after a release. Cost: 1 + 1 per country refreshed (max 10) credits.

NameTypeReqDescription
appstringyesAny app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na…
countrystring–ISO country code(s): `us` (default), a comma list (paid plans), or `all` (Studio). Example: us,de
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
fromstring–Start date (ISO), default 90 days before `to`.
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).
tostring–End date (ISO), default today.

No output schema declared.

No examples provided.

get_app_keywords ~260

The search terms an app ranks for in a country, best rank first, with popularity (5–100) and difficulty (0–100): from the weekly keyword universe plus your tracked keywords. Call it for the app and a competitor to find keyword gaps. Cost: 1 credits.

NameTypeReqDescription
appstringyesAny app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na…
countrystring–Two-letter country code (default 'us').
cursorstring–`meta.next_cursor` from the previous page.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
limitinteger–Max items to return. Default: 100.
max_rankinteger–Only terms where the app ranks at or above this position.
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).

No output schema declared.

No examples provided.

get_audit ~142

Check on an App Audit that audit_app started (by its id, e.g. aud_3fK9aQ2mXc81LpRt): waits up to about 25 s for it to finish, then returns the report (score, actions, metadata rewrites, findings, report page) or its status. Cost: 0 credits.

NameTypeReqDescription
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
idstringyesAudit id from audit_app, e.g. aud_3fK9aQ2mXc81LpRt

No output schema declared.

No examples provided.

get_charts ~241

A top free, paid or grossing chart for a store, country and category, today or on a past date: rank, app, developer, rating and the move since the previous capture (new entries marked), plus apps that dropped out. Charts are captured daily for every country and category. Cost: 1 credits.

NameTypeReqDescription
categorystring–App Store genre id (`36` or `all` = all apps, `6014` = games, …) or Play category (`GAME_PUZZLE`; `APPLICATION` = all apps).
chartstring–'free' (default), 'paid' or 'grossing'.
countrystring–Two-letter country code (default 'us').
datestring–The chart as of this date (ISO). Default the latest capture.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
limitinteger–How many ranks to return (default 100, max 200).
storestring–'apple' (default) or 'play'.

No output schema declared.

No examples provided.

get_competitors ~219

An app's competitors, best first, scored from search terms both apps rank for (shared keywords) plus the store's similar-apps list. Feed the app ids into get_app or get_app_changes for a competitor digest. Cost: 1 credits.

NameTypeReqDescription
appstringyesAny app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na…
countrystring–Two-letter country code (default 'us').
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
limitinteger–Max items to return. Default: 20.
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).

No output schema declared.

No examples provided.

get_developer ~170

A developer's profile: name, website, country, app count, total ratings and installs, all their apps (most-rated first) and the same company in the other store. get_app shows the developer id as dev <store>:<id>. Cost: 1 credits.

NameTypeReqDescription
devstringyes`apple:<artist id>`, `play:<developer id>`, a numeric Apple artist id, a Play developer id (often the name), or the website domain (`spotify.com`). Example: apple:324684583
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).

No output schema declared.

No examples provided.

get_events ~341

Significant changes on your watched apps and keywords, newest first: type, one-line title, AI summary, significance (0–1), app, country and the key payload fields (version, changes old → new, rating drop, rank move, chart rank…). Filter by type, app, watch, since and min_significance. To check for news, pass since = the created_at of the newest event already handled. Cost: 0 credits.

NameTypeReqDescription
appstring–Only events of this app (any id, bundle id, package, URL or name).
cursorstring–`meta.next_cursor` from the previous page.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
limitinteger–Max items to return. Default: 50.
min_significancenumber–Only events at least this significant (0–1).
sincestring–Only items at or after this ISO date / datetime. Example: 2026-10-01
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).
typestring–Comma list of event types, e.g. 'new_version,rating_drop'. Types: new_version, metadata_change, price_change, featured, in_app_event, installs_milestone, rating_drop, ratings_spike, review_spike, neg…
watchinteger–Only events of this watch id.

No output schema declared.

No examples provided.

get_insights ~295

What an app's users praise and complain about, from the AI tags on its reviews: top issues (topics behind negative, bug, crash, UX and pricing reviews) with last-30-days vs previous-30-days counts and sample reviews, topics, what each recent version changed in rating, sentiment and topics, and weekly sentiment. Use it for "what do users complain about since v2.3?" before reading individual reviews with get_reviews. Cost: 25 credits.

NameTypeReqDescription
appstringyesAny app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na…
countrystring–One storefront; omit for every storefront we hold reviews for.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
since_daysinteger–How many days of reviews to analyse, 7–730 (default 180).
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).
versionsinteger–How many of the latest versions to break down. Default: 6.

No output schema declared.

No examples provided.

get_job ~105

Poll a background store fetch that another call started (its output said refreshing or still being fetched, with a job id): status, per-country progress. When it is done, repeat the original call. Cost: 0 credits.

NameTypeReqDescription
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
idstringyes`meta.freshness.job_id`, e.g. `fetch_123`.

No output schema declared.

No examples provided.

get_keyword_ranks ~193

Ranking history of a watched keyword: per capture the top 10 app ids, or with app, that app's rank over time (best, worst, latest). Default the last 90 days. The id is a keyword slot of a keyword watch (list_watches and watch show the slot ids) or a list_tracked_keywords id. Cost: 1 credits.

NameTypeReqDescription
appstring–Store app id; returns `rank` per point instead of the full id list.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
fromstring–Start, ISO date or datetime (default 90 days ago)
idintegeryesKeyword slot id (from a keyword watch, or list_tracked_keywords)
tostring–End date or datetime (ISO), default now.

No output schema declared.

No examples provided.

get_reviews ~558

Read an app's user reviews, newest first, up to 100 per page: rating, title, text, version, date, developer reply and AI tags (sentiment, intent, severity, topic) where tagged. Filter by stars (rating='1-2' for complaints), version, date range, text (q) or AI tags (intent='bug,crash'; tag filters skip untagged reviews). Page with cursor. Cost: 1 per page + 1 if the US reviews are refreshed credits.

NameTypeReqDescription
appstringyesAny app identifier: App Store id (`284882215`, `id284882215`), Play package (`com.spotify.music`), Apple bundle id (`com.spotify.client`), store URL (URL-encoded), `apple:<id>` / `play:<id>`, or a na…
countrystring–ISO country code(s): `us` (default), a comma list (paid plans), or `all` (Studio). Example: us,de
cursorstring–`meta.next_cursor` from the previous page.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
full_textboolean–Return long text (description, release notes, review bodies) in full instead of cut short
intentstring–AI intent filter (comma list): bug, crash, feature_request, pricing, ux, praise, spam, other. Example: bug,crash
limitinteger–Max items to return. Default: 50.
max_ageinteger–Refresh the latest US reviews when older than this many seconds. Default 86400 (1 day).
qstring–Case-insensitive text search in the title and body. Example: crash
ratingstring–Star rating filter, `1`, `1,2` or a range `1-3`. Example: 1-2
sentimentstring–AI sentiment filter (comma list): positive, neutral, negative. Example: negative
sincestring–Only items at or after this ISO date / datetime. Example: 2026-10-01
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).
topicstring–AI topic filter (comma list of topic labels, case-insensitive, or topic ids).
untilstring–Only reviews created before this ISO date / datetime.
versionstring–Only reviews written for this app version.

No output schema declared.

No examples provided.

keyword_research ~314

Keyword metrics and research for App Store / Google Play search terms: popularity (5–100), difficulty (0–100), result count and the #1 result's estimated daily downloads. include adds related terms with metrics, the store's autocomplete and the current top 10 apps; app adds that app's rank and metadata relevance per term (the core of an ASO keyword audit). Unmeasured terms are measured live (a few per call) or come back pending. Cost: 1 per keyword; 5 per seed with include=related or suggestions credits.

NameTypeReqDescription
appstring–Any app identifier (as in `{app}`); adds `app.rank` and `app.relevance` per term.
countrystring–Two-letter ISO country code (storefront), e.g. us, gb, de. Default: us.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
includearray–related (~10 related terms with metrics), suggestions (store autocomplete), top_apps (current top 10). related/suggestions cost 5 credits per term
storestring–Required unless `app` is given.
termsarrayyesSearch terms, 1–25 (at most 5 with include related or suggestions)
waitboolean–Block up to ~25 s for a refresh (default). false = answer immediately from cache with a job id.

No output schema declared.

No examples provided.

list_connections ~135

The user's connected App Store Connect, Play Console and Apple Ads accounts: connection id, provider, mode (actions or read_only), status and the linked apps. Start here before read_connection or propose_action; secrets are never returned. No connections yet: the user adds them at https://dash.appgoat.ai/connections. Cost: 0 credits.

NameTypeReqDescription
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
providerstring–Only this provider: 'asc' (App Store Connect), 'play_console' or 'apple_ads'.

No output schema declared.

No examples provided.

list_playbooks ~127

AppGoat playbooks: step-by-step recipes (which tools to call, credit budget, decision rules, output format) for app audits, app idea research, ASO metadata rewrites, weekly competitor digests, turning reviews into GitHub issues, and, on connected accounts, replying to every review, optimizing Apple Ads and pushing localized listings. Without name, lists them; with name, returns the full playbook to follow. Also offered as MCP prompts. Free.

NameTypeReqDescription
namestring–A playbook name from the list, e.g. 'app-audit-lite'

No output schema declared.

No examples provided.

list_tracked_keywords ~143

Deprecated: use list_watches (keyword watches list their slots). Your tracked keywords with id, store, country, popularity, depth, cadence, last ranking and current top 3. Filter by store, country or a term substring. Cost: 0 credits.

NameTypeReqDescription
countrystring–Only this two-letter country code.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
qstring–Only terms containing this text.
storestring–'apple' = Apple App Store (iOS), 'play' = Google Play (Android).

No output schema declared.

No examples provided.

list_watches ~170

Your watches (apps, competitor sets, keyword sets), newest first, with id, apps, terms, countries, event types and whether they are paused, plus watched apps and keyword slots used vs the plan's limits. Filter by kind or by an app they include. Cost: 0 credits.

NameTypeReqDescription
appstring–Only watches that include this app (any id, bundle id, package, URL or name).
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
kindstring–Only this kind: 'app', 'competitor_set' or 'keyword'.
storestring–Disambiguates `{app}` (a bundle id vs a Play package, or a name).

No output schema declared.

No examples provided.

propose_action ~500

Prepare a change to the user's connected account as a DRY RUN: nothing is written. AppGoat reads the live account and returns the before → after diff, guardrail results (AI probabilities for store policy, tone and risky claims, plus checks such as character limits and bid jumps) and an action id. ALWAYS show the diff and any guardrail flags to the user and get their go-ahead before calling apply_action. Types and params (app = a linked App Store id or package name, locale like en-US): review.reply {app, review_id, text} (review ids from read_connection what=reviews; Play replies ≤ 350 chars); listing.update {app, locale, fields: {name|title, subtitle, description, promotional_text, whats_new, marketing_url, support_url, privacy_policy_url}} (Play: title, short_description, full_description, video); keywords.set {app, locale, keywords: [..] or 'a,b,c', mode?: replace|add|remove} (App Store, 100 bytes comma-joined); screenshots.upload {app, locale, display_type: APP_IPHONE_67… (asc) or image_type: phoneScreenshots… (play), images: [{url}], replace?}; ads.keyword.bid {campaign_id, ad_group_id, keywords: [{id, bid?, status?: ENABLED|PAUSED}], max_increase?}; ads.keyword.add {campaign_id, ad_group_id, keywords: [{text, match_type?: EXACT|BROAD, bid?}]}; ads.negative.add {campaign_id, ad_group_id?, keywords: [{text, match_type?}]} (Apple Ads ids from read_connection what=ads). Cost: 0 credits.

NameTypeReqDescription
connectionstring–Connection id from list_connections; optional when exactly one active connection fits the type and app
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
paramsobjectyesParams for the type (see the tool description)
playbookstring–The playbook proposing this, e.g. 'reply-to-every-review' (shown to approvers); omit outside a playbook
typestringyesWhat to change: review.reply, listing.update, keywords.set, screenshots.upload, ads.keyword.bid, ads.keyword.add or ads.negative.add

No output schema declared.

No examples provided.

read_connection ~592

Read live data from one of the user's connected accounts. what='reviews' (asc, play_console): the app's own reviews with reply status, unanswered=true for those without a developer reply; their review_id feeds propose_action review.reply (Play only returns reviews from the last 7 days). what='listing' (asc, play_console): the current listing text for one locale with lengths and which fields are editable right now (App Store name, subtitle, description, keywords and what's new need a version in Prepare for Submission). what='ads' (apple_ads): view=campaigns → ad_groups (campaign_id) → keywords (campaign_id, ad_group_id) gives the ids the ads.* actions take, view=negatives lists negative keywords, view=report with level=campaigns|adgroups|keywords|searchterms returns impressions, taps, installs, spend, CPT and CPA for start..end (default the last 7 days). Cost: 1 credits.

NameTypeReqDescription
ad_group_idstring–ads: ad group id (needed for keywords; optional for negatives)
appstring–A linked app (App Store id or package name); required for reviews and listing
campaign_idstring–ads: campaign id (needed for ad_groups, keywords, negatives and every report level except campaigns)
countrystring–reviews: App Store territory filter (two-letter code)
cursorstring–reviews: next_cursor from the previous page
endstring–ads report: end date YYYY-MM-DD (default yesterday, UTC)
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
full_textboolean–Return long text (description, release notes, review bodies) in full instead of cut short
idstringyesConnection id (con_…) from list_connections
levelstring–ads report: 'campaigns' (default), 'adgroups', 'keywords' or 'searchterms'
limitinteger–Max rows: reviews up to 200 (default 100), ads up to 1000 (default 200)
localestring–listing: locale such as en-US, de-DE (default en-US)
ratingstring–reviews: star filter, '1', '1,2' or '1-3'
startstring–ads report: start date YYYY-MM-DD (default 7 days before end)
unansweredboolean–reviews: only reviews without a developer reply
viewstring–ads: 'campaigns' (default), 'ad_groups', 'keywords', 'negatives' or 'report'
whatstringyes'reviews', 'listing' or 'ads' (Apple Ads)

No output schema declared.

No examples provided.

reject_action ~90

Discard a draft or pending action the user does not want; nothing is written to the account. Cost: 0 credits.

NameTypeReqDescription
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
idstringyesAction id (act_…)
reasonstring–Why (shown in the audit log)

No output schema declared.

No examples provided.

search_apps ~215

Find apps by name or id in AppGoat's catalog of both stores (~5M apps): exact title matches first, then prefix, then substring, most-rated first. Returns store, app_id, title, developer, category, rating, ratings and price; pass the app_id to the other tools. Cost: 1 credits.

NameTypeReqDescription
categorystring–Store category name, e.g. `Photo & Video` (App Store) or `PHOTOGRAPHY` (Play).
cursorstring–`meta.next_cursor` from the previous page.
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
limitinteger–Max items to return. Default: 20.
qstringyesApp name (≥ 2 characters) or exact id. Example: photo editor
storestring–Limit to one store: 'apple' or 'play'. Omit for both.

No output schema declared.

No examples provided.

track_keywords ~227

Deprecated: use watch with kind keyword (also reports rank moves as events). Starts tracking the search ranking of terms in one or both stores and the given countries: ranked apps are captured daily from now on (idempotent; already tracked terms are reported as such). Each term × store × country uses one keyword slot of the plan; a request over the limit tracks nothing (plan_limit). Read history with get_keyword_ranks. Cost: 0 credits.

NameTypeReqDescription
countriesarray–Two-letter country codes to track in (default ['us'])
depthinteger–How many results to keep per ranking (default 100 Apple / 50 Play).
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
storestringyes'apple', 'play' or 'both' (tracks each term in each store)
tagsarray–Free-form labels.
termsarrayyesSearch terms to track, e.g. ['habit tracker', 'streaks']

No output schema declared.

No examples provided.

untrack_keywords ~62

Deprecated: use unwatch for keyword watches. Stops tracking keywords by id (from list_tracked_keywords or track_keywords): no new rankings are recorded and their plan slots are freed. Cost: 0 credits.

NameTypeReqDescription
idsarrayyesTracked keyword ids

No output schema declared.

No examples provided.

unwatch ~66

Stop watches by id (from list_watches or watch): no new events, and their watched apps and keyword slots are freed. Past events are kept. To pause instead, call watch with id and active=false. Cost: 0 credits.

NameTypeReqDescription
idsarrayyesWatch ids

No output schema declared.

No examples provided.

watch ~514

Watch an app, a set of competitors or a set of keywords; significant changes become events (get_events, webhooks, daily email). kind app {app}: new versions, metadata and price changes, featuring, rating drops, review and ratings spikes, chart entries. kind competitor_set {competitors, app?}: the same for every competitor. kind keyword {terms, store or app}: the app's rank moves per term and new apps in the top N. Watched apps count against the plan's watch limit, keyword watches use one keyword slot per term × store × country; over a limit nothing changes (plan_limit). With id, changes that watch instead (send only what changes; settings are merged; active=false pauses it). Cost: 0 credits.

NameTypeReqDescription
activeboolean–false pauses the watch, true resumes it
appstring–Any app id, bundle id, package, store URL or name. kind app: the app (required); competitor_set: your own app (optional); keyword: the app whose ranks to report (optional)
competitorsarray–kind competitor_set: the apps to watch (any identifiers), up to 50
countriesarray–Two-letter country codes to watch in (default ['us'])
event_types––Only these event types (default: every type of the kind)
formatstring–'markdown' (default): compact tables for reading. 'json': the API's raw { data, meta }
idinteger–Watch id to change (from list_watches). Omit to create a watch
kindstring–'app' (one app), 'competitor_set' (several apps) or 'keyword' (search terms). Required when creating
name––A label for the watch
settingsobject–Thresholds: significance (0–1, default 0.5, minimum for an event), rank_move (default 5), keyword_top_n (10), chart_top_n (100), rating_drop (stars over 7 days, 0.1), spike_factor (3), email_digest (…
storestring–'apple', 'play' or 'both' (keyword watches without app; default both). Also disambiguates app inputs
termsarray–kind keyword: search terms, e.g. ['habit tracker', 'streaks']

No output schema declared.

No examples provided.

Install

How do I install the AppGoat MCP server?

AppGoat is a hosted endpoint at https://api.appgoat.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · api.appgoat.ai

# add to Claude Code
claude mcp add --transport http ai-appgoat-mcp 'https://api.appgoat.ai/mcp'
Common questions

What is the AppGoat MCP server?

AppGoat is an MCP server listed in the public MCP registry as ai.appgoat/mcp. App Store and Google Play data: apps, reviews, keywords, charts, competitors, ASO playbooks. This page covers its hosted endpoint (https://api.appgoat.ai/mcp).

Is the AppGoat MCP server safe to use?

AppGoat scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the AppGoat MCP server expose?

AppGoat exposes 29 tools: get_app, get_reviews, get_app_history, get_app_changes, get_app_keywords, and 24 more. Their descriptions and schemas cost roughly 7,503 tokens of context every time the server is loaded.

Does the AppGoat MCP server require authentication?

Yes. AppGoat asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the AppGoat MCP server still maintained?

AppGoat is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.