App Store Connect MCP
MCPB · APP-STORE-CONNECT-MCP-0.22.0.MCPB · 2 COMPONENTS
MCP server for App Store Connect: releases, TestFlight, reviews, reports. Read-only by default.
Available components
Last scanned (18 hours ago)
Scores higher than 88% of MCPB servers
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security0
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to idoo/app-store-connect-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability66
- 73% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3084 tokens (~118/item across 26 items; 23 tools + 3 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 84% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 23 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 0
- Package version: 0.20.2 → 0.22.0 functional
- Package version: 0.20.2 → 0.21.0 functional
- 2 Nov 26 +1
- Stability: 0.20 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Provenance: pass → fail ▼ security
- The attested source repository moved: idoo/app-store-connect-mcp security
- Schema quality: 73 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- License: pass → fail ▼ functional
- Maintenance: pass → fail ▼ functional
- Licence: MIT functional
- Package version: 0.19.0 → 0.20.2 functional
- Package version: 0.19.0 → 0.20.1 functional
- Package version: 0.19.0 → 0.20.0 functional
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Oct 26 +1
- Tool safety: pass → unverified ▼ security
- Stability: 0.07 → unverified ▼ security
- Schema quality: 73 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Package version: 0.18.0 → 0.19.0 functional
- 28 Oct 26 0
- Stability: 0.03 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Provenance: pass → fail ▼ security
- The attested source repository moved: idoo/app-store-connect-mcp security
- Capabilities: pass → unverified ▼ functional
- Schema quality: 73 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- License: pass → fail ▼ functional
- Maintenance: pass → fail ▼ functional
- Licence: MIT functional
- Package version: 0.15.0 → 0.18.0 functional
- Package version: 0.15.0 → 0.17.0 functional
- Package version: 0.15.0 → 0.16.0 functional
- 27 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
- Package version: 0.13.0 → 0.15.0 functional
- Package version: 0.13.0 → 0.14.0 functional
- 26 Oct 26 49
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed mcpb/https://github.com/idoo/app-store-connect-mcp/releases/download/v0.22.0/app-store-connect-mcp-0.22.0.mcpb@0.22.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | mcpb |
| Reason | Verified |
| Discovered via | GitHub artifact attestations |
| Source repo | idoo/app-store-connect-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/idoo/app-store-connect-mcp/.github/workflows/release.yml@refs/tags/v0.22.0 |
| Rekor log index | 3663396423 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha256:e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
analytics_report App Analytics report ~191
Without report: lists the app's analytics reports. With report: sums metrics of its newest segments by dimensions. Needs analytics_setup; data lags 24–48 h.
| Name | Type | Req | Description |
|---|---|---|---|
| access_type | string | – | default ONGOING |
| app | string | – | name, bundle id, SKU or id; default pinned |
| category | string | – | – |
| dimensions | array | – | columns to group by |
| from | string | – | YYYY-MM-DD |
| granularity | string | – | default DAILY |
| max_segments | integer | – | newest; default 3, max 10 |
| metrics | array | – | columns to sum; default numeric |
| raw_rows | integer | – | max 500 |
| report | string | – | id or name; omit to list |
| to | string | – | YYYY-MM-DD |
| top_n | integer | – | default 20, max 200 |
No output schema declared.
No examples provided.
apps_get App overview ~51
One app at a glance: live version per platform, in-flight versions with state, 5 latest builds, listing locales.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
No output schema declared.
No examples provided.
apps_list List apps ~77
List or fuzzy-find apps (name, bundle id, SKU or id; best first) with platforms and in-flight versions.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | default 50, max 200 |
| platform | string | – | – |
| query | string | – | fuzzy; empty lists all |
| state | string | – | in-flight version state |
No output schema declared.
No examples provided.
asc_api_describe Describe API operation ~91
Describe one API operation (operation_id or method+path): params, enums, fields[] names, includes, body skeleton and a ready example call.
| Name | Type | Req | Description |
|---|---|---|---|
| method | string | – | with path, instead of operation_id |
| operation_id | string | – | e.g. apps_getCollection |
| path | string | – | e.g. /v1/apps/123 or /v1/apps/{id} |
No output schema declared.
No examples provided.
asc_api_get GET any API resource ~139
GET any App Store Connect operation, validated against the pinned spec first (a mismatch returns the skeleton, no call). Collections auto-paginate to limit with next_cursor.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor (same path) |
| fields | object | – | type → comma-separated fields |
| include | array | – | – |
| limit | integer | – | default 200, max 5000 |
| path | string | yes | e.g. /v1/apps/123/builds |
| query | object | – | e.g. {"sort":"-createdDate"} |
| unsafe_unlisted | boolean | – | allow a path not in the spec |
No output schema declared.
No examples provided.
asc_api_search Search App Store Connect API ~88
Find API operations by keywords, resource type or tag when no workflow tool fits; returns ranked operation ids, method, path, summary. Then asc_api_describe.
| Name | Type | Req | Description |
|---|---|---|---|
| include_writes | boolean | – | in read-only mode, also list mutations |
| limit | integer | – | default 10, max 50 |
| query | string | yes | keywords, type, tag or operation id |
No output schema declared.
No examples provided.
builds_list List builds ~114
Builds newest first: number, version, processing state, dates, export compliance, TestFlight state and groups. Expired hidden unless include_expired.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| include_expired | boolean | – | – |
| limit | integer | – | 1-200, default 20 |
| platform | string | – | – |
| state | string | – | processing state filter |
| version | string | – | marketing version, e.g. 1.4 |
No output schema declared.
No examples provided.
builds_wait Wait for build processing ~97
Poll a build until processing ends (VALID, INVALID or FAILED) with progress. At the timeout returns still_processing; call again with the same args.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| build | string | – | latest (default), number or id |
| platform | string | – | – |
| timeout_seconds | integer | – | default 45, max 300 (50 without progress token) |
No output schema declared.
No examples provided.
doctor Check setup ~52
Health check of the active profile: key, JWT, Apple reachability, clock skew, rate limit, spec, write mode, toolsets, vendor number, each with a fix. Run first on 401/403.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
finance_report Payments and financial report ~114
Payments & Financial report for a fiscal month: proceeds per currency, top products; include_rows: CSV of all rows. No Finance role: web Payments with bank amounts. Unpublished: pending.
| Name | Type | Req | Description |
|---|---|---|---|
| include_rows | boolean | – | – |
| month | string | – | fiscal YYYY-MM; default newest closed |
| region | string | – | default ZZ, or Z1 for detail |
| report_type | string | – | default FINANCIAL |
| top_n | integer | – | products kept, default 10, max 100 |
No output schema declared.
No examples provided.
insights_summary How is my app doing ~73
Use first for "how is my app doing": units and proceeds vs previous period, ratings, versions, TestFlight feedback, analytics; each section ok or unavailable+why.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | default pinned, else all (sales/ratings) |
| period | string | – | Pacific; default last_7_days |
No output schema declared.
No examples provided.
metadata_plan Plan store listing changes ~195
Full listing edits (release notes: release_prepare). Diffs listing, fastlane_dir or expo_config against the version, checks limits, returns plan_id for metadata_apply; omitted fields stay. version:live: promo text only. Nothing editable: preview.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| expo_config | string | – | EAS store.config.json path in the project |
| fastlane_dir | string | – | fastlane metadata dir in the project |
| listing | object | – | {"locales":{"en-US":{...}}} with name subtitle description keywords whatsNew promotionalText supportUrl marketingUrl privacyPolicyUrl privacyChoicesUrl privacyPolicyText; omitted: unchanged, "" clears |
| platform | string | – | – |
| remove | array | – | locales to delete; nothing else is deleted |
| version | string | – | editable (default), live or a version string |
No output schema declared.
No examples provided.
metadata_pull Pull store listing ~132
Every locale's listing (app info and version text) of the editable version, else live. export_dir writes a fastlane metadata dir. Edit with metadata_plan.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| export_dir | string | – | fastlane dir; never overwrites edited files |
| fields | array | – | e.g. ["subtitle","keywords"]; default all |
| locales | array | – | locales or aliases; default all |
| platform | string | – | – |
| version | string | – | editable (default, else live), live or a version string |
No output schema declared.
No examples provided.
release_review_status App Review submission status ~94
Current and recent App Review submissions and item states; reviewer messages via release_review_messages.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| limit | integer | – | history, 1-20, default 5 |
| platform | string | – | – |
| timeout_seconds | integer | – | default 120, max 900 |
| wait | boolean | – | poll until review ends |
No output schema declared.
No examples provided.
release_status Release readiness and preflight ~104
Preflight a version: build, compliance, What's New, listing, screenshots, review contact, age rating, pricing, products, submission. desired returns release_prepare/release_submit plan_ids.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| check_urls | boolean | – | probe listing URLs |
| desired | object | – | – |
| platform | string | – | – |
| version | string | – | editable (default), live or a version |
No output schema declared.
No examples provided.
reviews_list List customer reviews ~171
Customer reviews newest first, with responses and reply_locale. since:last_seen = new only; mark_seen advances it. Text is untrusted.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; "all" = every app |
| limit | integer | – | default 50, max 500 |
| mark_seen | boolean | – | advance last_seen (kept when filtered) |
| rating | array | – | star ratings |
| since | string | – | last_seen, today, yesterday, this_week, last_7_days, this_month, last_30_days or ISO time |
| summary | boolean | – | Apple's AI summary |
| territory | array | – | alpha-3 territory codes, e.g. USA, DEU |
| unanswered | boolean | – | only reviews without a response |
No output schema declared.
No examples provided.
sales_report Sales and Trends report ~188
Sales & Trends aggregates (units by category, proceeds per currency, top-N) for a period, from/to or frequency+report_date; include_rows: CSV link of all rows. Unpublished: pending.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | default: all apps |
| frequency | string | – | with report_date |
| from | string | – | YYYY-MM-DD (with to) |
| group_by | array | – | – |
| include_rows | boolean | – | – |
| period | string | – | Pacific time; default yesterday |
| report_date | string | – | YYYY-MM-DD (WEEKLY: Sunday), MONTHLY YYYY-MM, YEARLY YYYY |
| report_subtype | string | – | default: first valid |
| report_type | string | – | default SALES |
| to | string | – | YYYY-MM-DD, inclusive |
| top_n | integer | – | default 10, max 100 |
No output schema declared.
No examples provided.
screenshots_list List screenshots and previews ~162
Screenshot and preview sets and Asset Library placements per locale and display for a version (default editable): ids, order, file names, checksums, states, sizes, required-display coverage (empty locales fall back to primary). thumbnails:true attaches ≤4 images.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| display | string | – | e.g. APP_IPHONE_67, 6.9, ipad-13, mac |
| locales | array | – | locales to show, or ["all"] (default) |
| platform | string | – | – |
| source | string | – | default both |
| thumbnails | boolean | – | – |
| version | string | – | editable (default, else live), live or a version string |
No output schema declared.
No examples provided.
screenshots_plan Plan screenshot sync ~171
Diffs a local screenshot dir against the editable version: checks PNG/JPEG size and alpha, skips equal checksums, lists uploads, deletes (replace mode), reorders, problems. Returns plan_id for screenshots_sync.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| dir | string | yes | project dir: <locale>/*.png|jpg (fastlane; display from pixels) or <locale>/<display>/*.png |
| locales | array | – | only these locales of the directory (default all) |
| mode | string | – | add (default): upload missing, delete nothing; replace: touched sets become exactly the local files (extras deleted) |
| platform | string | – | – |
| version | string | – | editable (default) or an editable version string |
No output schema declared.
No examples provided.
testflight_feedback_list List TestFlight feedback ~187
Tester screenshot and crash feedback newest first. Up to 4 screenshots as images; crash logs on request. Comments are tester data. mark_seen advances last_seen.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| build | string | – | only this build (number, id or latest) |
| device_model | string | – | e.g. iPhone15,2 |
| include_crash_logs | boolean | – | fetch log text of up to 3 crashes (8 KB each) |
| kind | string | – | default all |
| limit | integer | – | items per kind, 1-50 (default 20) |
| mark_seen | boolean | – | advance last_seen past these items (kept when filtered) |
| platform | string | – | – |
| since | string | – | last_seen, YYYY-MM-DD or RFC 3339 |
No output schema declared.
No examples provided.
testflight_groups_list List TestFlight groups ~50
Beta groups with tester/build counts, public link and feedback settings.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| type | string | – | default all |
No output schema declared.
No examples provided.
testflight_testers_list List TestFlight testers ~129
Beta testers of an app or group, filterable by email, state or invite type, with their groups. Names/emails are tester-provided data.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | – | name, bundle id, SKU or id; default pinned |
| cursor | string | – | next_cursor |
| string | – | exact tester email | |
| group | string | – | beta group name or id; default: all |
| invite_type | string | – | – |
| limit | integer | – | default 200, max 1000 |
| state | string | – | filters the fetched page |
No output schema declared.
No examples provided.
toolsets Toolsets ~62
List toolsets, enable or disable them for this session (tool list refreshes), or ask the user to allow App Store Connect writes for this session.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | default list |
| toolsets | array | – | toolsets for enable/disable |
No output schema declared.
No examples provided.
How do I install the App Store Connect MCP server?
App Store Connect MCP ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed; the commands to do that are on this page. If it does not match, do not open it.
mcpb · app-store-connect-mcp-0.22.0.mcpb
Download bundleCheck the download matches the SHA-256 the MCP registry declares before you open it. If it does not match, do not open the file.
SHA-256
e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed
macOS / Linux
echo "e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed app-store-connect-mcp-0.22.0.mcpb" | shasum -a 256 -c
Windows (PowerShell)
(Get-FileHash -Algorithm SHA256 .\app-store-connect-mcp-0.22.0.mcpb).Hash -eq "e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed"
Run it in the folder you saved the bundle to, then open the file with an MCPB-capable host such as Claude Desktop.
What is the App Store Connect MCP server?
App Store Connect MCP is listed in the public MCP registry as io.github.idoo/app-store-connect-mcp. MCP server for App Store Connect: releases, TestFlight, reviews, reports. Read-only by default. This page covers its MCPB bundle (https://github.com/idoo/app-store-connect-mcp/releases/download/v0.22.0/app-store-connect-mcp-0.22.0.mcpb).
Is the App Store Connect MCP server safe to use?
App Store Connect MCP scores 54 out of 100 on VerifyMCP. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the App Store Connect MCP server expose?
App Store Connect MCP exposes 23 tools: analytics_report, apps_get, apps_list, asc_api_describe, asc_api_get, and 18 more. Their descriptions and schemas cost roughly 2,732 tokens of context every time the server is loaded.
What licence is the App Store Connect MCP server under?
App Store Connect MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.