io.github.mikusnuz/app-publish
NPM · APP-PUBLISH-MCP · SCANNED SEP 20
MCP server for App Store Connect & Google Play Console — iOS/Android app management
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security89
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects uuid 9.0.1, reached via google-auth-library > gaxios > uuid. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 48 of 130 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 44 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 5005 tokens (~53/item across 93 items; 91 tools + 2 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 84% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 13 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "apple_delete_screenshot" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 92 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.mikusnuz/app-publish MCP server?
io.github.mikusnuz/app-publish runs locally as an npm package, launched with npx -y app-publish-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · app-publish-mcp
claude mcp add mikusnuz-app-publish -- npx -y app-publish-mcp
{
"mcpServers": {
"mikusnuz-app-publish": {
"command": "npx",
"args": [
"-y",
"app-publish-mcp"
]
}
}
} {
"servers": {
"mikusnuz-app-publish": {
"command": "npx",
"args": [
"-y",
"app-publish-mcp"
]
}
}
} codex mcp add mikusnuz-app-publish -- npx -y app-publish-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mikusnuz-app-publish": {
"type": "local",
"command": [
"npx",
"-y",
"app-publish-mcp"
],
"enabled": true
}
}
} openclaw mcp add mikusnuz-app-publish --command npx --arg -y --arg app-publish-mcp
mcp_servers:
mikusnuz-app-publish:
command: "npx"
args: ["-y", "app-publish-mcp"] {
"McpServers": {
"mikusnuz-app-publish": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"app-publish-mcp"
]
}
}
} assistant mcp add mikusnuz-app-publish -t stdio -c npx -a -y app-publish-mcp
{
"mcpServers": {
"mikusnuz-app-publish": {
"command": "npx",
"args": [
"-y",
"app-publish-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 −3
- Stability: pass → 0.83 functional
- 17 Sept 26 +1
- Stability: 0.97 → pass security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 −3
- Stability: pass → 0.77 functional
- 9 Sept 26 +1
- Stability: 0.97 → pass security
- 7 Sept 26 +1
- Security disclosure: unverified → fail ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/app-publish-mcp@0.3.1
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-w5hq-g745-h8pq | CVE-2026-41907 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 130 packages
| Packages resolved | 130 |
|---|---|
| Deprecated | 1 |
| Stale | 47 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
apple_update_app_info_localization ~74
Update app name, subtitle, or privacy policy URL for a locale
| Name | Type | Req | Description |
|---|---|---|---|
| localizationId | string | yes | AppInfo Localization ID |
| name | string | – | App name |
| privacyPolicyText | string | – | – |
| privacyPolicyUrl | string | – | – |
| subtitle | string | – | App subtitle |
No output schema declared.
No examples provided.
apple_update_category ~59
Update app primary/secondary category
| Name | Type | Req | Description |
|---|---|---|---|
| appInfoId | string | yes | AppInfo ID |
| primaryCategoryId | string | – | Primary category ID (e.g. SOCIAL_NETWORKING) |
| secondaryCategoryId | string | – | Secondary category ID |
No output schema declared.
No examples provided.
apple_update_device ~44
Update device name or status
| Name | Type | Req | Description |
|---|---|---|---|
| deviceId | string | yes | Device ID |
| name | string | – | New device name |
| status | string | – | New status |
No output schema declared.
No examples provided.
apple_update_review_detail ~109
Update app review info (contact info, notes, demo account for reviewer)
| Name | Type | Req | Description |
|---|---|---|---|
| contactEmail | string | – | – |
| contactFirstName | string | – | – |
| contactLastName | string | – | – |
| contactPhone | string | – | – |
| demoAccountName | string | – | – |
| demoAccountPassword | string | – | – |
| demoAccountRequired | boolean | – | – |
| notes | string | – | Notes for the reviewer |
| versionId | string | yes | App Store Version ID |
No output schema declared.
No examples provided.
apple_update_version_localization ~84
Update localization fields (description, keywords, whatsNew, etc)
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| keywords | string | – | Comma-separated keywords |
| localizationId | string | yes | Localization ID |
| marketingUrl | string | – | – |
| promotionalText | string | – | – |
| supportUrl | string | – | – |
| whatsNew | string | – | – |
No output schema declared.
No examples provided.
apple_upload_screenshot ~77
Upload a screenshot (reserves slot, then uploads binary)
| Name | Type | Req | Description |
|---|---|---|---|
| fileName | string | yes | File name (e.g. screen1.png) |
| filePath | string | yes | Local path to the screenshot image |
| fileSize | number | yes | File size in bytes |
| screenshotSetId | string | yes | Screenshot Set ID |
No output schema declared.
No examples provided.
google_archive_subscription ~47
Archive a subscription (remove from Google Play but retain for existing subscribers)
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name |
| productId | string | yes | Subscription product ID to archive |
No output schema declared.
No examples provided.
google_commit_edit ~48
Commit all pending changes in an edit session. This publishes the changes.
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID from google_create_edit |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_create_edit ~44
Create a new edit session. Required before making any changes to a Google Play listing.
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name (e.g. com.example.app) |
No output schema declared.
No examples provided.
google_create_iap ~138
Create a new in-app product (managed product)
| Name | Type | Req | Description |
|---|---|---|---|
| defaultDescription | string | yes | Default product description |
| defaultLanguage | string | yes | Default language (e.g. en-US) |
| defaultPriceCurrencyCode | string | yes | Currency code (e.g. USD) |
| defaultPriceMicros | string | yes | Price in micros (e.g. 990000 for $0.99) |
| defaultTitle | string | yes | Default product title |
| packageName | string | yes | Android package name |
| purchaseType | string | – | – |
| sku | string | yes | Product SKU (unique identifier) |
| status | string | – | – |
No output schema declared.
No examples provided.
google_create_release ~120
Create a release on a track with optional version codes and release notes
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
| releaseName | string | – | Release name/label |
| releaseNotes | array | – | Release notes per language |
| status | string | – | – |
| track | string | yes | Target track |
| userFraction | number | – | Staged rollout fraction (0.0-1.0, only for production) |
| versionCodes | array | – | Version codes to include |
No output schema declared.
No examples provided.
google_delete_all_images ~61
Delete all images of a specific type for a language
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| imageType | string | yes | Image type |
| language | string | yes | Language code |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_delete_edit ~39
Discard an edit session without committing changes
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_delete_iap ~38
Delete an in-app product
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name |
| sku | string | yes | Product SKU to delete |
No output schema declared.
No examples provided.
google_delete_image ~67
Delete a specific uploaded image
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| imageId | string | yes | Image ID to delete |
| imageType | string | yes | Image type |
| language | string | yes | Language code |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_delete_listing ~57
Delete a store listing for a specific language
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| language | string | yes | Language code to delete (e.g. ko-KR) |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_get_country_availability ~60
Get country availability for a specific track
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
| track | string | yes | Track name (e.g. production, beta, alpha, internal) |
No output schema declared.
No examples provided.
google_get_details ~44
Get app details (default language, contact email/phone/website)
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_get_iap ~39
Get details of a specific in-app product
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name |
| sku | string | yes | Product SKU |
No output schema declared.
No examples provided.
google_get_listing ~61
Get store listing for a specific language
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| language | string | yes | Language code (e.g. ko-KR, en-US, ja-JP) |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_get_review ~37
Get a specific review with details
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name |
| reviewId | string | yes | Review ID |
No output schema declared.
No examples provided.
google_get_subscription ~38
Get details of a specific subscription
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name |
| productId | string | yes | Subscription product ID |
No output schema declared.
No examples provided.
google_get_testers ~56
Get tester configuration for a track
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
| track | string | yes | Track name (e.g. internal, alpha, beta) |
No output schema declared.
No examples provided.
google_get_track ~47
Get details of a specific release track
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
| track | string | yes | Track name |
No output schema declared.
No examples provided.
google_halt_release ~46
Halt an ongoing staged rollout
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
| track | string | yes | Track name |
No output schema declared.
No examples provided.
google_list_iap ~34
List all in-app products (managed products) for an app
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_list_images ~57
List uploaded images of a specific type
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| imageType | string | yes | Image type |
| language | string | yes | Language code |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_list_listings ~43
List all store listings (all languages) for an app
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_list_reviews ~27
List user reviews for an app
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_list_subscriptions ~28
List all subscriptions for an app
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_list_tracks ~43
List all release tracks (internal, alpha, beta, production)
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_promote_release ~89
Promote a release from one track to another (e.g. beta → production)
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| fromTrack | string | yes | Source track |
| packageName | string | yes | Android package name |
| releaseNotes | array | – | – |
| toTrack | string | yes | Target track |
| userFraction | number | – | Staged rollout fraction for production |
No output schema declared.
No examples provided.
google_reply_to_review ~47
Reply to a user review
| Name | Type | Req | Description |
|---|---|---|---|
| packageName | string | yes | Android package name |
| replyText | string | yes | Reply text |
| reviewId | string | yes | Review ID |
No output schema declared.
No examples provided.
google_update_details ~104
Update app details (default language, contact email/phone/website)
| Name | Type | Req | Description |
|---|---|---|---|
| contactEmail | string | – | User-visible support email |
| contactPhone | string | – | User-visible support phone number |
| contactWebsite | string | – | User-visible website URL |
| defaultLanguage | string | – | Default language code in BCP 47 format (e.g. en-US) |
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_update_iap ~105
Update an existing in-app product
| Name | Type | Req | Description |
|---|---|---|---|
| defaultLanguage | string | – | Default language |
| defaultPriceCurrencyCode | string | – | Currency code |
| defaultPriceMicros | string | – | Price in micros |
| description | string | – | Product description (for default language) |
| packageName | string | yes | Android package name |
| sku | string | yes | Product SKU |
| status | string | – | – |
| title | string | – | Product title (for default language) |
No output schema declared.
No examples provided.
google_update_listing ~106
Update store listing for a specific language (title, descriptions)
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| fullDescription | string | – | Full description (max 4000 chars) |
| language | string | yes | Language code (e.g. ko-KR, en-US) |
| packageName | string | yes | Android package name |
| shortDescription | string | – | Short description (max 80 chars) |
| title | string | – | App title (max 30 chars) |
No output schema declared.
No examples provided.
google_update_testers ~71
Update tester Google Groups for a track
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| googleGroups | array | – | List of Google Group email addresses |
| packageName | string | yes | Android package name |
| track | string | yes | Track name (e.g. internal, alpha, beta) |
No output schema declared.
No examples provided.
google_upload_apk ~51
Upload an APK file
| Name | Type | Req | Description |
|---|---|---|---|
| apkPath | string | yes | Local path to the .apk file |
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_upload_bundle ~55
Upload an Android App Bundle (.aab)
| Name | Type | Req | Description |
|---|---|---|---|
| bundlePath | string | yes | Local path to the .aab file |
| editId | string | yes | Edit ID |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_upload_image ~77
Upload an image (screenshot, icon, feature graphic, etc)
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID |
| imagePath | string | yes | Local path to the image file |
| imageType | string | yes | Image type |
| language | string | yes | Language code |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
google_validate_edit ~49
Validate an edit session without committing. Useful to check for errors before commit.
| Name | Type | Req | Description |
|---|---|---|---|
| editId | string | yes | Edit ID from google_create_edit |
| packageName | string | yes | Android package name |
No output schema declared.
No examples provided.
What is the io.github.mikusnuz/app-publish MCP server?
io.github.mikusnuz/app-publish is an MCP server listed in the public MCP registry as io.github.mikusnuz/app-publish. MCP server for App Store Connect & Google Play Console, iOS/Android app management. This page covers its npm package (app-publish-mcp).
Is the io.github.mikusnuz/app-publish MCP server safe to use?
io.github.mikusnuz/app-publish scores 78 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.mikusnuz/app-publish MCP server expose?
io.github.mikusnuz/app-publish exposes 91 tools: apple_list_apps, apple_get_app, apple_get_app_info, apple_update_category, apple_list_bundle_ids, and 86 more. Their descriptions and schemas cost roughly 4,961 tokens of context every time the server is loaded.
Is the io.github.mikusnuz/app-publish MCP server still maintained?
io.github.mikusnuz/app-publish is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.mikusnuz/app-publish MCP server under?
io.github.mikusnuz/app-publish declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.