# App Store Release (mcpb · appstore-release.mcpb)

Ship an iOS app to App Store review: readiness report, idempotent pipeline, submit.

- Trust score: 51/100 (low)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-24

## Components

- mcpb · `appstore-release.mcpb`: 51/100 (this document), [markdown](https://verifymcp.io/servers/beydemirfurkan-appstore-release/appstore-release.md), [page](https://verifymcp.io/servers/beydemirfurkan-appstore-release/appstore-release)

## Channel facts

- Registry: `mcpb`
- Package: `https://github.com/beydemirfurkan/appstore-release/releases/download/v4.3.2/appstore-release.mcpb`
- Transport: `stdio`
- SHA-256: `20d685b3b6172d99112edf6b1baa0dcc346930bb1d0522e07ecb572748319b9e`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-24.

- **Supply Chain Security**: 13/100
  - No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.
  - Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
  - No install/post-install scripts declared.
  - Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 13 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 85/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3830 tokens (~93/item across 41 items; 13 tools + 28 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the App Store Release MCP server?

App Store Release ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, 20d685b3b6172d99112edf6b1baa0dcc346930bb1d0522e07ecb572748319b9e; the commands to do that are on this page. If it does not match, do not open it.

- Download bundle: `https://github.com/beydemirfurkan/appstore-release/releases/download/v4.3.2/appstore-release.mcpb`
- SHA-256: `20d685b3b6172d99112edf6b1baa0dcc346930bb1d0522e07ecb572748319b9e`

### Verify on macOS / Linux

```bash
echo "20d685b3b6172d99112edf6b1baa0dcc346930bb1d0522e07ecb572748319b9e  appstore-release.mcpb" | shasum -a 256 -c
```

### Verify on Windows (PowerShell)

```powershell
(Get-FileHash -Algorithm SHA256 .\appstore-release.mcpb).Hash -eq "20d685b3b6172d99112edf6b1baa0dcc346930bb1d0522e07ecb572748319b9e"
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-22 (score 51, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-10-14 (score 47, +33)

- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Destructive annotations: 100
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: good
- [functional] First check of Tool coverage: 100

### 2026-10-12 (score 14)

First indexed and scored.

## MCP tools (13)

### `asc_readiness_report` (~167 tokens)

App Store readiness report

The main tool. Answers 'can this version be submitted, and if not, what exactly is in the way, in what order'. Read-only. Returns findings with a verdict and an ordered list of next actions, each marked as something this tool can fix or something only a human in App Store Connect can. Start here.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `configPath` (string): Path to the config file. Defaults to the usual discovery order.
- `locale` (string): Locale to report on.
- `waitMinutes` (number): After a submission: keep re-checking for up to this many minutes while the version is in review. Review usually takes hours; call again later rather than waiting long.

### `asc_app_overview` (~98 tokens)

App Store Connect inventory

Read-only inventory: versions, builds, localizations, screenshot sets, pricing and subscriptions. Use it to answer questions about current state; use asc_readiness_report to decide what to do.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `configPath` (string): Path to the config file. Defaults to the usual discovery order.
- `locale` (string): Locale to inspect.

### `asc_list_apps` (~63 tokens)

Find an app id

List the apps this API key can see, with their numeric ids and bundle ids. Every other tool needs the numeric id, and it is the one thing people never have to hand.

Input parameters:

- `query` (string): Filter by name or bundle id, case-insensitive.

### `asc_validate_config` (~191 tokens)

Validate a config, and preflight the app

Check a config against the schema and against the rules Apple enforces but does not document — emoji in the description, keywords over 100 bytes, whatsNew on a first version. With preflight: true, also read the app itself (Info.plist, privacy manifest, code) for what App Review rejects: missing or generic permission texts, invalid required-reason codes, login without an equivalent private option, no account deletion, no restore purchases. Touches no network and needs no credentials, so it is safe to call while drafting.

Input parameters:

- `config` (object): The config object itself.
- `configPath` (string): Or a path to read it from.
- `preflight` (boolean): Also check the app's own project: Info.plist, privacy manifest and code.
- `projectDir` (string): The app's project directory, for preflight (default: the config's directory).

### `asc_plan_release` (~137 tokens)

Plan the listing pipeline

Dry-run the whole listing pipeline and return the exact changes it would send to App Store Connect. Writes nothing. Call this before asc_apply_release so the human can see the diff first.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `configPath` (string): Path to the config file. Defaults to the usual discovery order.
- `only` (array): Subset of: attach-build, metadata, pricing, content-rights, age-rating, category, accessibility, review-info, release-options, screenshots, previews, custom-product-pages, experiments, subscription,…

### `asc_open_next_version` (~157 tokens)

Open the next version

Create the next App Store version, so its listing can be prepared. Needed whenever every existing version is already live — asc_readiness_report reports that as version.none. A no-op when a version is already editable, so it is safe to call first.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `configPath` (string): Path to the config file. Defaults to the usual discovery order.
- `confirm` (boolean, required): Must be true. Set it only after the human has approved this change to a live App Store listing.
- `version` (string): Version string, e.g. 1.2.0. Inferred from the newest existing one if omitted.

### `asc_apply_release` (~176 tokens)

Apply the listing pipeline

Write the listing to App Store Connect: build attach, metadata, pricing, content rights, age rating, category, review info, screenshots and subscription. Idempotent — re-running when everything already matches sends nothing. Does not submit for review.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `configPath` (string): Path to the config file. Defaults to the usual discovery order.
- `confirm` (boolean, required): Must be true. Set it only after the human has approved this change to a live App Store listing.
- `only` (array): Subset of: attach-build, metadata, pricing, content-rights, age-rating, category, accessibility, review-info, release-options, screenshots, previews, custom-product-pages, experiments, subscription,…

### `asc_upload_screenshots` (~143 tokens)

Upload screenshots

Upload the PNGs in the configured directory to the version's screenshot set. Deletes remote screenshots that have no local counterpart only when prune is true, which it is not by default.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `configPath` (string): Path to the config file. Defaults to the usual discovery order.
- `confirm` (boolean, required): Must be true. Set it only after the human has approved this change to a live App Store listing.
- `displayType` (string): Override config.screenshots.displayType.
- `prune` (boolean): Delete remote screenshots with no local counterpart.

### `asc_configure_subscription` (~150 tokens)

Configure subscriptions and in-app purchases

Create any missing subscription plans and one-time purchases from the config, then write their localizations, prices, introductory offers and App Review screenshots, so they leave MISSING_METADATA. Once READY_TO_SUBMIT, asc_submit_for_review sends them with the app version — the app's first subscription and first in-app purchase included, with the website's clicks as the fallback.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `configPath` (string): Path to the config file. Defaults to the usual discovery order.
- `confirm` (boolean, required): Must be true. Set it only after the human has approved this change to a live App Store listing.

### `asc_submit_for_review` (~283 tokens)

Submit for review

Submit the app version to App Review, with the configured subscriptions and in-app purchases. This is the irreversible one. It computes the readiness report first and refuses if anything is blocking, unless force is set. An app's first product is sent by API with the version; if App Store Connect refuses it, nothing is submitted and the result is MANUAL with the clicks — or call again with skipProducts: true to send the app alone. After a submission, follow it with asc_readiness_report or check --wait.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `configPath` (string): Path to the config file. Defaults to the usual discovery order.
- `confirm` (boolean, required): Must be true. Set it only after the human has approved this change to a live App Store listing.
- `force` (boolean): Submit even though blockers remain. Apple will reject it.
- `resolved` (boolean): After a rejection: the user has addressed what App Review asked for in Resolution Center. Resubmits.
- `skipExperiments` (boolean): Leave product page tests out of this submission.
- `skipPages` (boolean): Leave custom product pages out of this submission.
- `skipProducts` (boolean): Submit the app version alone; configured subscriptions and in-app purchases wait for a later version.

### `asc_customer_reviews` (~183 tokens)

Customer reviews

Read the app's customer reviews, newest first: rating, title, text, territory, and any published reply. Filter to what needs attention — low ratings, unanswered ones — and optionally include Apple's own summary of recent reviews. Read-only. To answer one, draft a reply, show it to the human, and only after they approve it call asc_reply_to_review.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `limit` (integer): How many, newest first. Default 20.
- `rating` (array): Only these star ratings, e.g. [1, 2].
- `summary` (boolean): Also return Apple's summary of recent reviews.
- `territory` (string): Only reviews from this territory, e.g. USA.
- `unanswered` (boolean): Only reviews without a published reply.

### `asc_reply_to_review` (~172 tokens)

Reply to a customer review

Publish a reply to one customer review on the App Store — publicly, under the developer's name. Replying again replaces the previous reply; the same text twice changes nothing. Draft the reply in the review's language, show the exact text to the human, and call this only once they approve that text. Never reply in bulk without approval of each reply.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `confirm` (boolean, required): Must be true. Set it only after the human has approved this change to a live App Store listing.
- `delete` (boolean): Remove the published reply instead of writing one.
- `reviewId` (string, required): The review id, from asc_customer_reviews.
- `text` (string): The reply exactly as approved.

### `asc_generate_credentials` (~118 tokens)

Generate iOS distribution credentials

Issue a new distribution certificate and provisioning profile and write them to disk. Apple caps an account at three distribution certificates and this consumes one. Disabled unless the operator sets APPSTORE_RELEASE_ALLOW_LOCAL_WRITES=1.

Input parameters:

- `appId` (string): Numeric App Store Connect app id. Defaults to ASC_APP_ID.
- `configPath` (string): Path to the config file. Defaults to the usual discovery order.
- `confirm` (boolean, required): Must be true. Set it only after the human has approved this change to a live App Store listing.

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/beydemirfurkan-appstore-release/appstore-release#diagnostics

## Score history

- 2026-10-24: 51
- 2026-10-23: 51
- 2026-10-22: 51
- 2026-10-21: 47
- 2026-10-20: 47
- 2026-10-19: 47
- 2026-10-18: 47
- 2026-10-17: 47
- 2026-10-16: 47
- 2026-10-15: 47
- 2026-10-14: 47
- 2026-10-13: 14
- 2026-10-12: 14

## Common questions

### What is the App Store Release MCP server?

App Store Release is an MCP server listed in the public MCP registry as io.github.beydemirfurkan/appstore-release. Ship an iOS app to App Store review: readiness report, idempotent pipeline, submit. This page covers its MCPB bundle (https://github.com/beydemirfurkan/appstore-release/releases/download/v4.3.2/appstore-release.mcpb).

### Is the App Store Release MCP server safe to use?

App Store Release scores 51 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the App Store Release MCP server expose?

App Store Release exposes 13 tools: asc_readiness_report, asc_app_overview, asc_list_apps, asc_validate_config, asc_plan_release, and 8 more. Their descriptions and schemas cost roughly 2,038 tokens of context every time the server is loaded.

### What licence is the App Store Release MCP server under?

App Store Release declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- Repository: https://github.com/beydemirfurkan/appstore-release
- Changelog RSS feed: https://verifymcp.io/servers/beydemirfurkan-appstore-release/appstore-release.xml
- Changelog JSON feed: https://verifymcp.io/servers/beydemirfurkan-appstore-release/appstore-release.json
- HTML version of this page: https://verifymcp.io/servers/beydemirfurkan-appstore-release/appstore-release