App Store Operator
NPM · APP-STORE-OPERATOR · SCANNED SEP 20
Free App Store competitive intelligence for Claude — rival downloads, revenue, and ASO keywords.
Available components
Recent critical change
CVE-2025-7783 affects this package (2 Aug 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security66
- No malware found by supply-chain analysis.Pass
- CVE check failed: an unpatched critical CVE affects this package; the score is capped at 0. See how to fix → View diagnostics → Fail
- Runs a script at install time (postinstall) that we could not recognise. It may be perfectly ordinary, but we do not read the published tarball, so we cannot say what it does. View diagnostics → Partial
- 89 of 187 dependencies flagged as unhealthy (4 deprecated). View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to meyusufdemirci/app-store-operator). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 27 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability77
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3064 tokens (~306/item across 10 items; 4 tools + 6 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 4 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the App Store Operator MCP server?
App Store Operator runs locally as an npm package, launched with npx -y app-store-operator. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · app-store-operator
claude mcp add meyusufdemirci-app-store-operator -- npx -y app-store-operator
{
"mcpServers": {
"meyusufdemirci-app-store-operator": {
"command": "npx",
"args": [
"-y",
"app-store-operator"
]
}
}
} {
"servers": {
"meyusufdemirci-app-store-operator": {
"command": "npx",
"args": [
"-y",
"app-store-operator"
]
}
}
} codex mcp add meyusufdemirci-app-store-operator -- npx -y app-store-operator
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"meyusufdemirci-app-store-operator": {
"type": "local",
"command": [
"npx",
"-y",
"app-store-operator"
],
"enabled": true
}
}
} openclaw mcp add meyusufdemirci-app-store-operator --command npx --arg -y --arg app-store-operator
mcp_servers:
meyusufdemirci-app-store-operator:
command: "npx"
args: ["-y", "app-store-operator"] {
"McpServers": {
"meyusufdemirci-app-store-operator": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"app-store-operator"
]
}
}
} assistant mcp add meyusufdemirci-app-store-operator -t stdio -c npx -a -y app-store-operator
{
"mcpServers": {
"meyusufdemirci-app-store-operator": {
"command": "npx",
"args": [
"-y",
"app-store-operator"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 0
- Stability: pass → 0.90 functional
- 18 Sept 26 0
- Stability: 0.97 → pass security
- 12 Sept 26 0
- Stability: pass → 0.80 functional
- 11 Sept 26 0
- Stability: 0.97 → pass security
- 5 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- Stability: pass → 0.80 functional
- 4 Sept 26 0
- Stability: 0.97 → pass security
- Security disclosure: fail → unverified ▼ functional
- 31 Aug 26 0
- Security disclosure: unverified → fail ▼ functional
- 30 Aug 26 0
- Security disclosure: fail → unverified ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/app-store-operator@0.3.5
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | meyusufdemirci/app-store-operator |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/meyusufdemirci/app-store-operator/.github/workflows/publish.yml@refs/tags/0.3.5 |
| Rekor log index | 2570899653 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:17b86766b4d6be3f0ad7d11fd8cc95722fc2a0c352aa0bbc1fb7dc14febea8119d4ac7d52f54e3faf10dedd40fdaaea246f191130e2f22093058e07c6 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| postinstall | unreviewed | node scripts/postinstall.js |
Background: Why install scripts are a supply-chain risk →
Vulnerabilities 7 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-fjxv-7rqg-78g4 | CVE-2025-7783 | critical | yes | |
| GHSA-hmw2-7cc7-3qxx | CVE-2026-12143 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | yes |
| GHSA-4mjr-xmp4-gh2g | CVE-2026-82417 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | yes |
| GHSA-6rw7-vpxm-498p | CVE-2025-15284 | low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L | yes |
| GHSA-p8p7-x288-28g6 | CVE-2023-28155 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | yes |
| GHSA-72xf-g2v4-qvf3 | CVE-2023-26136 | medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | yes |
| GHSA-w5hq-g745-h8pq | CVE-2026-41907 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 187 packages
| Packages resolved | 187 |
|---|---|
| Deprecated | 4 |
| Stale | 88 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_app_details Get App Analytics ~558
Fetch SensorTower analytics for one or more App Store app IDs. Returns downloads, revenue, ratings, publisher info, markets, and more for each app. Use this when you already have app IDs (e.g. from `search_app_store`) and want detailed analytics for only a subset of them — avoiding unnecessary scrapes for apps you don't need. Use `research_rivals` instead for a single convenience call that searches and fetches analytics together. Do not use this for Google Play or Android apps — it takes numeric iOS App Store IDs only. Requires a SensorTower account. The server opens a real Chromium window on the user's machine; the first run needs the user to log in there, and the session is reused from then on. If there is no session the call returns an error result carrying `{"error": "not_logged_in"}` and leaves the window open — tell the user to log in, then call again. Results are never cached, so every call scrapes fresh and costs roughly 10–20 seconds per app ID. Returns JSON: ```json { "country": "us", "fetchedAt": "2026-04-21T10:00:00.000Z", "apps": [ { "rank": 1, "name": "App Name", "appStoreUrl": "...", "sensorTowerUrl": "...", "downloads": "<5K", "revenue": "<$5K", "rating": { "score": "4.7", "count": "1,234" }, "publisher": "Publisher Name", "categories": "Health & Fitness", "topMarkets": "United States, United Kingdom", "releaseDate": "Jan 1, 2020", "lastUpdated": "Mar 15, 2026", "languages": "English, Spanish", "inAppPurchases": "Monthly · $9.99", "publisherCountry": "United States", "advertisingNetworks": "N/A" } ] } ``` Fields missing or gated behind a paywall will be `"N/A"`. A single app failing to scrape is not fatal — that app comes back with `"N/A"` fields rather than failing the whole call.
| Name | Type | Req | Description |
|---|---|---|---|
| app_ids | array | yes | List of numeric App Store app IDs, as strings (e.g. ["123456", "789012"]). Each is the digits from an apps.apple.com URL's `id` segment, without the `id` prefix. |
| country | string | yes | Two-letter App Store country code (e.g. us, gb, tr) |
No output schema declared.
No examples provided.
prepare_iae Prepare In-App Event Copy ~988
Prepare an iOS App Store In-App Event (IAE) — generate copy variations and a final report. Use this when the user wants to create or draft an in-app event, prepare IAE metadata, or generate App Store event copy. Accepts user-supplied keywords and event parameters, then returns a structured brief. Do not use it for ordinary App Store listing metadata (title, subtitle, description) — it covers In-App Event fields only. Runs entirely locally: no network calls, no App Store or SensorTower lookup, and no keyword research of its own — the caller supplies the keywords (reach for `research_rivals` or `search_app_store` first if you still need to find them). Returns immediately. **After receiving the tool output, you MUST:** 1. Generate **3 distinct copy variations** in the target language (from `locale.language`), each differing meaningfully in angle, tone, or keyword emphasis. For each variation produce: - **Event name** (hard limit: 30 chars — count every character; trim at word boundary if over) - **Short description** (hard limit: 50 chars — same rules) - **Long description** (hard limit: 120 chars — same rules) Display every field with its exact character count and ✓ / ✗ indicator. Fix any ✗ before showing the user. Keyword placement: Tier 1 keywords must appear in short description and long description; embed in event name only if it fits naturally. Prioritize keywords toward the beginning of each field. Copy rules: active voice, present tense, no pricing claims or % discounts, no competitor names, all three fields independently meaningful. If locale is not en-US, add an English translation line under each localized field so the user can verify meaning. 2. Ask the user to choose one variation. 3. After the user picks a variation, print the **output table** and the **final summary report** using this exact format: **Output table:** ``` CHOSEN VARIATION — <locale.appleCode> ───────────────────────────────────── Event name : <text> (<N>…
| Name | Type | Req | Description |
|---|---|---|---|
| audience | string | yes | Target audience (e.g. students, professionals, parents, casual users). |
| event_context | string | yes | Real-world hook tying the event to a moment (e.g. a holiday, season, product milestone). |
| event_purpose | string | yes | 1–2 sentences describing what the event is about and why users should care. |
| goal | string | yes | Primary conversion goal (e.g. increase conversions, attract new users, boost engagement). |
| keywords | array | yes | Ordered list of keywords by priority (index 0–2 = Tier 1 must-use, 3–6 = Tier 2, 7–9 = Tier 3). Maximum 10. |
| locale | string | yes | Target locale/language for the IAE copy (e.g. en-us, en-gb, de-de, fr-fr, tr, ja, ko, zh-hans). An unlisted value returns an `unknown_locale` error naming the supported ones. |
| tone | string | yes | Copy tone. |
No output schema declared.
No examples provided.
research_rivals Research App Store Rivals ~767
Search the App Store for a keyword and fetch SensorTower analytics for the top results — all in one call. Results are cached for 24 hours so repeat queries are instant. Use this for a quick competitive overview when you want everything in one step. Use `search_app_store` + `get_app_details` separately when you need more than 3 results, a custom limit, or selective fetching of specific apps. Do not use this for Google Play or Android apps — it covers the iOS App Store only. Requires a SensorTower account. On a cache miss the server opens a real Chromium window on the user's machine; the first run needs the user to log in there, and the session is reused from then on. If there is no session the call returns an error result carrying `{"error": "not_logged_in"}` and leaves the window open — tell the user to log in, then call again. A cache miss scrapes three apps and typically takes 30–60 seconds; a cache hit returns immediately and opens no browser. Trigger phrases: "rival research", "research rivals", "competitor analysis", "find competing apps", "check competitors", "what apps compete with", "App Store competitors", "rivals for keyword". Returns JSON: ```json { "keyword": "meditation", "country": "us", "fetchedAt": "2026-04-21T10:00:00.000Z", "cached": false, "apps": [ { "rank": 1, "name": "App Name", "appStoreUrl": "https://apps.apple.com/us/app/id123456", "sensorTowerUrl": "https://app.sensortower.com/overview/123456", "downloads": "<5K", "revenue": "<$5K", "rating": { "score": "4.7", "count": "1,234" }, "publisher": "Publisher Name", "categories": "Health & Fitness", "topMarkets": "United States, United Kingdom", "releaseDate": "Jan 1, 2020", "lastUpdated": "Mar 15, 2026", "languages": "English, Spanish", "inAppPurchases": "Monthly · $9.99", "publisherCountry": "United States", "advertisingNetworks": "N/A" } ] } ``` Fields missing or gated behi…
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | yes | Two-letter App Store country code (e.g. us, gb, tr) |
| keyword | string | yes | The keyword to search in the App Store (e.g. psikoloji, meditation) |
No output schema declared.
No examples provided.
search_app_store Search the App Store ~294
Search the App Store for a keyword and return ranked results as a detailed table — instantly, no browser required. Use this when you want to discover which apps rank for a keyword before deciding which ones to analyse in depth. - Follow up with `get_app_details` to fetch SensorTower analytics for specific app IDs. - Use `research_rivals` instead for a single convenience call that searches and fetches analytics together. - Do not use this for Google Play or Android apps — it covers the iOS App Store only. Unlike `research_rivals` and `get_app_details`, this needs no SensorTower account, opens no browser window, and returns in about a second. It also carries no downloads or revenue figures — those only come from the SensorTower tools. Returns markdown (not JSON): one table per result, ranked, with every App Store field available including the numeric app ID that `get_app_details` takes. Unavailable fields read `"N/A"`. A keyword with no matches returns just the header line and no tables.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | yes | Two-letter App Store country code (e.g. us, gb, tr) |
| keyword | string | yes | The keyword to search in the App Store (e.g. meditation, psikoloji) |
| limit | integer | – | Number of results to return (1–25, default 3). Values above 25 are clamped to 25. |
No output schema declared.
No examples provided.
What is the App Store Operator MCP server?
App Store Operator is an MCP server listed in the public MCP registry as io.github.meyusufdemirci/app-store-operator. Free App Store competitive intelligence for Claude, rival downloads, revenue, and ASO keywords. This page covers its npm package (app-store-operator).
What tools does the App Store Operator MCP server expose?
App Store Operator exposes 4 tools: research_rivals, search_app_store, get_app_details, prepare_iae. Their descriptions and schemas cost roughly 2,607 tokens of context every time the server is loaded.
Is the App Store Operator MCP server still maintained?
App Store Operator is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the App Store Operator MCP server under?
App Store Operator declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.