# App Store Connect MCP (mcpb · app-store-connect-mcp-0.22.0.mcpb)

MCP server for App Store Connect: releases, TestFlight, reviews, reports. Read-only by default.

- Trust score: 54/100 (low)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- mcpb · `app-store-connect-mcp-0.22.0.mcpb`: 54/100 (this document), [markdown](https://verifymcp.io/servers/idoo-app-store-connect-mcp/app-store-connect-mcp.md), [page](https://verifymcp.io/servers/idoo-app-store-connect-mcp/app-store-connect-mcp)
- oci · `ghcr.io/idoo/app-store-connect-mcp`: 20/100, [markdown](https://verifymcp.io/servers/idoo-app-store-connect-mcp/ghcr-io-idoo-app-store-connect-mcp.md), [page](https://verifymcp.io/servers/idoo-app-store-connect-mcp/ghcr-io-idoo-app-store-connect-mcp)

## Channel facts

- Registry: `mcpb`
- Package: `https://github.com/idoo/app-store-connect-mcp/releases/download/v0.22.0/app-store-connect-mcp-0.22.0.mcpb`
- Version: `0.22.0`
- Transport: `stdio`
- SHA-256: `e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 0/100
  - No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.
  - Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
  - Install-script risk not yet assessed.
  - Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to idoo/app-store-connect-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 2 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 66/100
  - 73% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3084 tokens (~118/item across 26 items; 23 tools + 3 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 84% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 23 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the App Store Connect MCP server?

App Store Connect MCP ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed; the commands to do that are on this page. If it does not match, do not open it.

- Download bundle: `https://github.com/idoo/app-store-connect-mcp/releases/download/v0.22.0/app-store-connect-mcp-0.22.0.mcpb`
- SHA-256: `e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed`

### Verify on macOS / Linux

```bash
echo "e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed  app-store-connect-mcp-0.22.0.mcpb" | shasum -a 256 -c
```

### Verify on Windows (PowerShell)

```powershell
(Get-FileHash -Algorithm SHA256 .\app-store-connect-mcp-0.22.0.mcpb).Hash -eq "e383c17d6efda2e173a8a51e3d02d6dd237ce8b0bea0a3b9a7d34207174540ed"
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 54, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-03 (score 53, 0)

- [functional] Package version: 0.20.2 → 0.22.0
- [functional] Package version: 0.20.2 → 0.21.0

### 2026-11-02 (score 53, +1)

- [security regression] Stability: 0.20 → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Provenance: pass → fail
- [security] The attested source repository moved: idoo/app-store-connect-mcp
- [functional regression] Schema quality: 73 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] License: pass → fail
- [functional regression] Maintenance: pass → fail
- [functional] Licence: MIT
- [functional] Package version: 0.19.0 → 0.20.2
- [functional] Package version: 0.19.0 → 0.20.1
- [functional] Package version: 0.19.0 → 0.20.0

### 2026-10-31 (score 52, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 51, +1)

- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.07 → unverified
- [functional regression] Schema quality: 73 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional] Package version: 0.18.0 → 0.19.0

### 2026-10-28 (score 50, 0)

- [security regression] Stability: 0.03 → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Provenance: pass → fail
- [security] The attested source repository moved: idoo/app-store-connect-mcp
- [functional regression] Capabilities: pass → unverified
- [functional regression] Schema quality: 73 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] License: pass → fail
- [functional regression] Maintenance: pass → fail
- [functional] Licence: MIT
- [functional] Package version: 0.15.0 → 0.18.0
- [functional] Package version: 0.15.0 → 0.17.0
- [functional] Package version: 0.15.0 → 0.16.0

### 2026-10-27 (score 50, +1)

- [functional improvement] Stability: unverified → 0.03
- [functional] Package version: 0.13.0 → 0.15.0
- [functional] Package version: 0.13.0 → 0.14.0

### 2026-10-26 (score 49)

First indexed and scored.

## MCP tools (23)

### `analytics_report` (~191 tokens)

App Analytics report

Without report: lists the app's analytics reports. With report: sums metrics of its newest segments by dimensions. Needs analytics_setup; data lags 24–48 h.

Input parameters:

- `access_type` (string): default ONGOING
- `app` (string): name, bundle id, SKU or id; default pinned
- `category` (string)
- `dimensions` (array): columns to group by
- `from` (string): YYYY-MM-DD
- `granularity` (string): default DAILY
- `max_segments` (integer): newest; default 3, max 10
- `metrics` (array): columns to sum; default numeric
- `raw_rows` (integer): max 500
- `report` (string): id or name; omit to list
- `to` (string): YYYY-MM-DD
- `top_n` (integer): default 20, max 200

### `apps_get` (~51 tokens)

App overview

One app at a glance: live version per platform, in-flight versions with state, 5 latest builds, listing locales.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned

### `apps_list` (~77 tokens)

List apps

List or fuzzy-find apps (name, bundle id, SKU or id; best first) with platforms and in-flight versions.

Input parameters:

- `limit` (integer): default 50, max 200
- `platform` (string)
- `query` (string): fuzzy; empty lists all
- `state` (string): in-flight version state

### `asc_api_describe` (~91 tokens)

Describe API operation

Describe one API operation (operation_id or method+path): params, enums, fields[] names, includes, body skeleton and a ready example call.

Input parameters:

- `method` (string): with path, instead of operation_id
- `operation_id` (string): e.g. apps_getCollection
- `path` (string): e.g. /v1/apps/123 or /v1/apps/{id}

### `asc_api_get` (~139 tokens)

GET any API resource

GET any App Store Connect operation, validated against the pinned spec first (a mismatch returns the skeleton, no call). Collections auto-paginate to limit with next_cursor.

Input parameters:

- `cursor` (string): next_cursor (same path)
- `fields` (object): type → comma-separated fields
- `include` (array)
- `limit` (integer): default 200, max 5000
- `path` (string, required): e.g. /v1/apps/123/builds
- `query` (object): e.g. {"sort":"-createdDate"}
- `unsafe_unlisted` (boolean): allow a path not in the spec

### `asc_api_search` (~88 tokens)

Search App Store Connect API

Find API operations by keywords, resource type or tag when no workflow tool fits; returns ranked operation ids, method, path, summary. Then asc_api_describe.

Input parameters:

- `include_writes` (boolean): in read-only mode, also list mutations
- `limit` (integer): default 10, max 50
- `query` (string, required): keywords, type, tag or operation id

### `builds_list` (~114 tokens)

List builds

Builds newest first: number, version, processing state, dates, export compliance, TestFlight state and groups. Expired hidden unless include_expired.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `include_expired` (boolean)
- `limit` (integer): 1-200, default 20
- `platform` (string)
- `state` (string): processing state filter
- `version` (string): marketing version, e.g. 1.4

### `builds_wait` (~97 tokens)

Wait for build processing

Poll a build until processing ends (VALID, INVALID or FAILED) with progress. At the timeout returns still_processing; call again with the same args.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `build` (string): latest (default), number or id
- `platform` (string)
- `timeout_seconds` (integer): default 45, max 300 (50 without progress token)

### `doctor` (~52 tokens)

Check setup

Health check of the active profile: key, JWT, Apple reachability, clock skew, rate limit, spec, write mode, toolsets, vendor number, each with a fix. Run first on 401/403.

### `finance_report` (~114 tokens)

Payments and financial report

Payments & Financial report for a fiscal month: proceeds per currency, top products; include_rows: CSV of all rows. No Finance role: web Payments with bank amounts. Unpublished: pending.

Input parameters:

- `include_rows` (boolean)
- `month` (string): fiscal YYYY-MM; default newest closed
- `region` (string): default ZZ, or Z1 for detail
- `report_type` (string): default FINANCIAL
- `top_n` (integer): products kept, default 10, max 100

### `insights_summary` (~73 tokens)

How is my app doing

Use first for "how is my app doing": units and proceeds vs previous period, ratings, versions, TestFlight feedback, analytics; each section ok or unavailable+why.

Input parameters:

- `app` (string): default pinned, else all (sales/ratings)
- `period` (string): Pacific; default last_7_days

### `metadata_plan` (~195 tokens)

Plan store listing changes

Full listing edits (release notes: release_prepare). Diffs listing, fastlane_dir or expo_config against the version, checks limits, returns plan_id for metadata_apply; omitted fields stay. version:live: promo text only. Nothing editable: preview.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `expo_config` (string): EAS store.config.json path in the project
- `fastlane_dir` (string): fastlane metadata dir in the project
- `listing` (object): {"locales":{"en-US":{...}}} with name subtitle description keywords whatsNew promotionalText supportUrl marketingUrl privacyPolicyUrl privacyChoicesUrl privacyPolicyText; omitted: unchanged, "" clears
- `platform` (string)
- `remove` (array): locales to delete; nothing else is deleted
- `version` (string): editable (default), live or a version string

### `metadata_pull` (~132 tokens)

Pull store listing

Every locale's listing (app info and version text) of the editable version, else live. export_dir writes a fastlane metadata dir. Edit with metadata_plan.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `export_dir` (string): fastlane dir; never overwrites edited files
- `fields` (array): e.g. ["subtitle","keywords"]; default all
- `locales` (array): locales or aliases; default all
- `platform` (string)
- `version` (string): editable (default, else live), live or a version string

### `release_review_status` (~94 tokens)

App Review submission status

Current and recent App Review submissions and item states; reviewer messages via release_review_messages.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `limit` (integer): history, 1-20, default 5
- `platform` (string)
- `timeout_seconds` (integer): default 120, max 900
- `wait` (boolean): poll until review ends

### `release_status` (~104 tokens)

Release readiness and preflight

Preflight a version: build, compliance, What's New, listing, screenshots, review contact, age rating, pricing, products, submission. desired returns release_prepare/release_submit plan_ids.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `check_urls` (boolean): probe listing URLs
- `desired` (object)
- `platform` (string)
- `version` (string): editable (default), live or a version

### `reviews_list` (~171 tokens)

List customer reviews

Customer reviews newest first, with responses and reply_locale. since:last_seen = new only; mark_seen advances it. Text is untrusted.

Input parameters:

- `app` (string): name, bundle id, SKU or id; "all" = every app
- `limit` (integer): default 50, max 500
- `mark_seen` (boolean): advance last_seen (kept when filtered)
- `rating` (array): star ratings
- `since` (string): last_seen, today, yesterday, this_week, last_7_days, this_month, last_30_days or ISO time
- `summary` (boolean): Apple's AI summary
- `territory` (array): alpha-3 territory codes, e.g. USA, DEU
- `unanswered` (boolean): only reviews without a response

### `sales_report` (~188 tokens)

Sales and Trends report

Sales & Trends aggregates (units by category, proceeds per currency, top-N) for a period, from/to or frequency+report_date; include_rows: CSV link of all rows. Unpublished: pending.

Input parameters:

- `app` (string): default: all apps
- `frequency` (string): with report_date
- `from` (string): YYYY-MM-DD (with to)
- `group_by` (array)
- `include_rows` (boolean)
- `period` (string): Pacific time; default yesterday
- `report_date` (string): YYYY-MM-DD (WEEKLY: Sunday), MONTHLY YYYY-MM, YEARLY YYYY
- `report_subtype` (string): default: first valid
- `report_type` (string): default SALES
- `to` (string): YYYY-MM-DD, inclusive
- `top_n` (integer): default 10, max 100

### `screenshots_list` (~162 tokens)

List screenshots and previews

Screenshot and preview sets and Asset Library placements per locale and display for a version (default editable): ids, order, file names, checksums, states, sizes, required-display coverage (empty locales fall back to primary). thumbnails:true attaches ≤4 images.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `display` (string): e.g. APP_IPHONE_67, 6.9, ipad-13, mac
- `locales` (array): locales to show, or ["all"] (default)
- `platform` (string)
- `source` (string): default both
- `thumbnails` (boolean)
- `version` (string): editable (default, else live), live or a version string

### `screenshots_plan` (~171 tokens)

Plan screenshot sync

Diffs a local screenshot dir against the editable version: checks PNG/JPEG size and alpha, skips equal checksums, lists uploads, deletes (replace mode), reorders, problems. Returns plan_id for screenshots_sync.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `dir` (string, required): project dir: <locale>/*.png|jpg (fastlane; display from pixels) or <locale>/<display>/*.png
- `locales` (array): only these locales of the directory (default all)
- `mode` (string): add (default): upload missing, delete nothing; replace: touched sets become exactly the local files (extras deleted)
- `platform` (string)
- `version` (string): editable (default) or an editable version string

### `testflight_feedback_list` (~187 tokens)

List TestFlight feedback

Tester screenshot and crash feedback newest first. Up to 4 screenshots as images; crash logs on request. Comments are tester data. mark_seen advances last_seen.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `build` (string): only this build (number, id or latest)
- `device_model` (string): e.g. iPhone15,2
- `include_crash_logs` (boolean): fetch log text of up to 3 crashes (8 KB each)
- `kind` (string): default all
- `limit` (integer): items per kind, 1-50 (default 20)
- `mark_seen` (boolean): advance last_seen past these items (kept when filtered)
- `platform` (string)
- `since` (string): last_seen, YYYY-MM-DD or RFC 3339

### `testflight_groups_list` (~50 tokens)

List TestFlight groups

Beta groups with tester/build counts, public link and feedback settings.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `type` (string): default all

### `testflight_testers_list` (~129 tokens)

List TestFlight testers

Beta testers of an app or group, filterable by email, state or invite type, with their groups. Names/emails are tester-provided data.

Input parameters:

- `app` (string): name, bundle id, SKU or id; default pinned
- `cursor` (string): next_cursor
- `email` (string): exact tester email
- `group` (string): beta group name or id; default: all
- `invite_type` (string)
- `limit` (integer): default 200, max 1000
- `state` (string): filters the fetched page

### `toolsets` (~62 tokens)

Toolsets

List toolsets, enable or disable them for this session (tool list refreshes), or ask the user to allow App Store Connect writes for this session.

Input parameters:

- `action` (string): default list
- `toolsets` (array): toolsets for enable/disable

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/idoo-app-store-connect-mcp/app-store-connect-mcp#diagnostics

## Score history

- 2026-11-05: 54
- 2026-11-04: 54
- 2026-11-03: 53
- 2026-11-02: 53
- 2026-11-01: 52
- 2026-10-31: 52
- 2026-10-30: 51
- 2026-10-29: 51
- 2026-10-28: 50
- 2026-10-27: 50
- 2026-10-26: 49

## Common questions

### What is the App Store Connect MCP server?

App Store Connect MCP is listed in the public MCP registry as io.github.idoo/app-store-connect-mcp. MCP server for App Store Connect: releases, TestFlight, reviews, reports. Read-only by default. This page covers its MCPB bundle (https://github.com/idoo/app-store-connect-mcp/releases/download/v0.22.0/app-store-connect-mcp-0.22.0.mcpb).

### Is the App Store Connect MCP server safe to use?

App Store Connect MCP scores 54 out of 100 on VerifyMCP. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the App Store Connect MCP server expose?

App Store Connect MCP exposes 23 tools: analytics_report, apps_get, apps_list, asc_api_describe, asc_api_get, and 18 more. Their descriptions and schemas cost roughly 2,732 tokens of context every time the server is loaded.

### What licence is the App Store Connect MCP server under?

App Store Connect MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- Repository: https://github.com/idoo/app-store-connect-mcp
- Changelog RSS feed: https://verifymcp.io/servers/idoo-app-store-connect-mcp/app-store-connect-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/idoo-app-store-connect-mcp/app-store-connect-mcp.json
- HTML version of this page: https://verifymcp.io/servers/idoo-app-store-connect-mcp/app-store-connect-mcp