Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.mikusnuz/app-publish

NPM · APP-PUBLISH-MCP

MCP server for App Store Connect & Google Play Console — iOS/Android app management

Available components

−3 this week 73 Trust /100

Last scanned (5 hours ago)

Scores higher than 46% of npm servers

Category Developer Tools

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security80
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • Dependency health was assessed across the 162 of 163 dependencies we could resolve, so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability77
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Tool/resource definitions use about 12627 tokens (~66/item across 190 items; 188 tools + 2 resources), lean.Pass
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
  • Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage87
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 62% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 24 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "apple_delete_placement" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 189 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

  • 3 Nov 26 −4
    • Stability: fail → 0.67 functional
  • 31 Oct 26 0
    • CVE-2026-118773 affects this package: high ▼ security
    • CVE-2026-118764 affects this package: high ▼ security
  • 28 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 92 to 95.

  • 27 Oct 26 −1

    No change was recorded against any check on this day. Stability & Change Management went from 95 to 92.

  • 24 Oct 26 −5
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: partial → fail ▼ security
  • 20 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 19 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Schema quality: 9848 → 12627 ▼ functional
    • Tool coverage: 69% → 62% ▼ functional
    • Package version: 0.6.0 → 0.7.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/app-publish-mcp@0.7.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 3 findings
ID CVE Severity Vector Fix available
GHSA-3g3m-2fjr-6pw4 CVE-2026-118773 medium yes
GHSA-g3hv-75wg-m249 CVE-2026-118764 medium yes
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 162 packages
Packages resolved 162
Deprecated 2
Stale 51
Tree resolution Partial

The dependency tree was only partially resolved, so these counts may be incomplete.

Background: SBOMs and build attestations, explained →

MCP tools · 188 exposed · ~12,583 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
apple_list_treatment_localizations ~38

List localizations of a treatment; their IDs are the targets for apple_create_placement

NameTypeReqDescription
treatmentIdstringyes–

No output schema declared.

No examples provided.

apple_list_version_localizations ~31

List all localizations for a version

NameTypeReqDescription
versionIdstringyesApp Store Version ID

No output schema declared.

No examples provided.

apple_list_versions ~65

List all App Store versions for an app

NameTypeReqDescription
appIdstringyesApp ID
platformstring––
statestring–Filter by current appVersionState (e.g. PREPARE_FOR_SUBMISSION, READY_FOR_DISTRIBUTION)

No output schema declared.

No examples provided.

apple_list_win_back_offers ~41

List win-back offers configured for a subscription (offers to bring back churned/expired subscribers)

NameTypeReqDescription
subscriptionIdstringyesSubscription ID

No output schema declared.

No examples provided.

apple_register_device ~42

Register a new device

NameTypeReqDescription
namestringyesDevice name
platformstringyesPlatform
udidstringyesDevice UDID

No output schema declared.

No examples provided.

apple_release_version ~42

Irreversibly request release of an approved version that is in PENDING_DEVELOPER_RELEASE

NameTypeReqDescription
versionIdstringyesApproved App Store Version ID

No output schema declared.

No examples provided.

apple_remove_beta_testers_from_group ~46

Remove beta testers from a group

NameTypeReqDescription
betaGroupIdstringyesBeta Group ID
betaTesterIdsarrayyesArray of beta tester IDs

No output schema declared.

No examples provided.

apple_reorder_placements ~71

Set the complete display order for one localization and placement group, then read back and verify the order. In-app event localizations are not orderable.

NameTypeReqDescription
localizationIdstringyes–
placementGroup–yes–
placementIdsarrayyes–
targetTypestring––

No output schema declared.

No examples provided.

apple_respond_to_review ~38

Respond to a customer review

NameTypeReqDescription
responseBodystringyesResponse text
reviewIdstringyesCustomer Review ID

No output schema declared.

No examples provided.

apple_revoke_certificate ~25

Revoke a certificate

NameTypeReqDescription
certificateIdstringyesCertificate ID

No output schema declared.

No examples provided.

apple_set_build_encryption ~61

Set a processed build's usesNonExemptEncryption answer before submission; true may also require an app encryption declaration or supporting export-compliance documentation

NameTypeReqDescription
buildIdstringyesBuild ID
usesNonExemptEncryptionbooleanyes–

No output schema declared.

No examples provided.

apple_set_price ~88

Replace the complete manual app price schedule. Call apple_get_pricing first and include every current and future manual price entry that must be preserved.

NameTypeReqDescription
appIdstringyesApp ID
baseTerritoryIdstringyesBase territory ID for that price point, e.g. USA
manualPricesarrayyesComplete desired manual schedule, including existing entries that must remain

No output schema declared.

No examples provided.

apple_submit_for_review ~96

Create or resume an App Store review submission, attach the version idempotently, and submit it while preserving the submission ID for safe recovery

NameTypeReqDescription
appIdstringyesApp ID
platformstring–Platform of the version being submitted
submissionIdstring–Existing READY_FOR_REVIEW submission ID to resume after an interrupted call
versionIdstringyesApp Store Version ID to submit

No output schema declared.

No examples provided.

apple_submit_review_submission ~87

Submit an inspected review draft containing assets, custom pages or experiments. itemIds must exactly match all review item IDs returned by apple_get_review_submission, to avoid submitting unexpected items. This starts App Review; saving or attaching an item does not.

NameTypeReqDescription
appIdstringyes–
itemIdsarrayyes–
platformstring––
submissionId–yes–

No output schema declared.

No examples provided.

apple_update_accessibility_declaration ~118

Update an existing accessibility nutrition label declaration

NameTypeReqDescription
declarationIdstringyesAccessibility Declaration ID
supportsAudioDescriptionsboolean––
supportsCaptionsboolean––
supportsDarkInterfaceboolean––
supportsDifferentiateWithoutColorAloneboolean––
supportsLargerTextboolean––
supportsReducedMotionboolean––
supportsSufficientContrastboolean––
supportsVoiceControlboolean––
supportsVoiceoverboolean––

No output schema declared.

No examples provided.

apple_update_age_rating ~314

Update the current App Store age-rating questionnaire. Prefer NONE, INFREQUENT, or FREQUENT for frequency fields; legacy values remain accepted by Apple for compatibility.

NameTypeReqDescription
advertisingboolean|null––
ageAssuranceboolean|null––
ageRatingIdstringyesAge Rating Declaration ID
ageRatingOverrideV2–––
alcoholTobaccoOrDrugUseOrReferences–––
contests–––
developerAgeRatingInfoUrl–––
gamblingboolean|null––
gamblingSimulated–––
gunsOrOtherWeapons–––
healthOrWellnessTopicsboolean|null––
horrorOrFearThemes–––
kidsAgeBand–––
koreaAgeRatingOverride–––
lootBoxboolean|null––
matureOrSuggestiveThemes–––
medicalOrTreatmentInformation–––
messagingAndChatboolean|null––
parentalControlsboolean|null––
profanityOrCrudeHumor–––
sexualContentGraphicAndNudity–––
sexualContentOrNudity–––
socialMediaboolean|null––
socialMediaAgeRestrictedboolean|null––
unrestrictedWebAccessboolean|null––
userGeneratedContentboolean|null––
violenceCartoonOrFantasy–––
violenceRealistic–––
violenceRealisticProlongedGraphicOrSadistic–––

No output schema declared.

No examples provided.

apple_update_app ~47

Update app-level submission settings: the content-rights declaration and primary locale

NameTypeReqDescription
appIdstringyesApp ID
contentRightsDeclaration–––
primaryLocale–––

No output schema declared.

No examples provided.

apple_update_app_info_localization ~74

Update app name, subtitle, or privacy policy URL for a locale

NameTypeReqDescription
localizationIdstringyesAppInfo Localization ID
namestring–App name
privacyPolicyTextstring––
privacyPolicyUrlstring––
subtitlestring–App subtitle

No output schema declared.

No examples provided.

apple_update_category ~59

Update app primary/secondary category

NameTypeReqDescription
appInfoIdstringyesAppInfo ID
primaryCategoryIdstring–Primary category ID (e.g. SOCIAL_NETWORKING)
secondaryCategoryIdstring–Secondary category ID

No output schema declared.

No examples provided.

apple_update_custom_product_page ~51

Rename a custom product page or switch its visibility (a hidden page stops serving its URL)

NameTypeReqDescription
namestring––
pageIdstringyes–
visibleboolean––

No output schema declared.

No examples provided.

apple_update_custom_product_page_localization ~40

Change the promotional text of a custom product page localization

NameTypeReqDescription
localizationIdstringyes–
promotionalTextstringyes–

No output schema declared.

No examples provided.

apple_update_custom_product_page_version ~40

Change the deep link of an editable custom product page version

NameTypeReqDescription
deepLinkstringyes–
versionIdstringyes–

No output schema declared.

No examples provided.

apple_update_device ~44

Update device name or status

NameTypeReqDescription
deviceIdstringyesDevice ID
namestring–New device name
statusstring–New status

No output schema declared.

No examples provided.

apple_update_experiment ~82

Rename a test, change its traffic share, or start it (started=true). New visuals in a test go through App Review before it runs.

NameTypeReqDescription
experimentIdstringyes–
namestring––
startedboolean–Start the test; a running test cannot be un-started
trafficProportioninteger––

No output schema declared.

No examples provided.

apple_update_experiment_treatment ~45

Rename a treatment or change its alternate icon

NameTypeReqDescription
appIconNamestring––
namestring––
treatmentIdstringyes–

No output schema declared.

No examples provided.

apple_update_phased_release ~54

Pause, resume, or complete an existing phased release; COMPLETE immediately releases the update to all users

NameTypeReqDescription
phasedReleaseIdstringyesApp Store Version Phased Release ID
statestringyes–

No output schema declared.

No examples provided.

apple_update_review_detail ~109

Update app review info (contact info, notes, demo account for reviewer)

NameTypeReqDescription
contactEmailstring––
contactFirstNamestring––
contactLastNamestring––
contactPhonestring––
demoAccountNamestring––
demoAccountPasswordstring––
demoAccountRequiredboolean––
notesstring–Notes for the reviewer
versionIdstringyesApp Store Version ID

No output schema declared.

No examples provided.

apple_update_territory_availability ~78

Change availability, release date, or pre-order state for one existing territory availability record returned by apple_list_availability

NameTypeReqDescription
availableboolean|null––
preOrderEnabledboolean|null––
releaseDate–––
territoryAvailabilityIdstringyesTerritory Availability resource ID, not the territory code

No output schema declared.

No examples provided.

apple_update_version ~82

Update an existing App Store version's version, copyright, or release timing

NameTypeReqDescription
copyrightstring|null––
earliestReleaseDate––ISO 8601 date-time with timezone; required for SCHEDULED releases
releaseTypestring––
versionIdstringyesApp Store Version ID
versionStringstring––

No output schema declared.

No examples provided.

apple_update_version_localization ~84

Update localization fields (description, keywords, whatsNew, etc)

NameTypeReqDescription
descriptionstring––
keywordsstring–Comma-separated keywords
localizationIdstringyesLocalization ID
marketingUrlstring––
promotionalTextstring––
supportUrlstring––
whatsNewstring––

No output schema declared.

No examples provided.

apple_upload_asset ~138

Upload an image or video once to the App Asset Library, commit uploaded=true, and verify processing against a specId from apple_get_asset_specs. Create placements separately to reuse it across localizations.

NameTypeReqDescription
assetLibraryIdstringyes–
categorystring––
expectedSpecIdstringyesSpecification ID from apple_get_asset_specs; checked after processing
filePath–yes–
mediaTypestringyes–
pollIntervalSecondsinteger––
previewFrameTimeCode–––
referenceName–––
timeoutSecondsinteger––
waitForProcessingboolean––

No output schema declared.

No examples provided.

apple_upload_build ~209

Upload a signed IPA through the App Store Connect Build Uploads API: verify its SHA-256 locally, reserve the upload and file, send every presigned range, commit its MD5 transfer checksum, and optionally wait for import

NameTypeReqDescription
appIdstringyesApp ID
buildNumberstringyesCFBundleVersion, e.g. 42
expectedFileSizeinteger–Optional expected IPA size in bytes; checked locally before any API request
expectedSha256string–Optional expected SHA-256 hex digest; checked locally before any API request
filePathstringyesLocal path to a signed .ipa file
platformstring––
pollIntervalSecondsinteger––
timeoutSecondsinteger––
versionStringstringyesCFBundleShortVersionString, e.g. 1.2.0
waitForProcessingboolean–Wait for the Build Upload to reach COMPLETE or FAILED

No output schema declared.

No examples provided.

apple_upload_screenshot ~102

Legacy: upload and commit a screenshot while preserving its ID for recovery. Deprecated by Apple; prefer apple_upload_asset and apple_create_placement.

NameTypeReqDescription
fileNamestringyesFile name (e.g. screen1.png)
filePathstringyesLocal path to the screenshot image
fileSizeinteger–Expected file size in bytes; the actual file size is always used
screenshotSetIdstringyesScreenshot Set ID

No output schema declared.

No examples provided.

apple_wait_for_asset ~69

Resume waiting for an uploaded asset to become ready; optionally check that Apple matched the intended specification

NameTypeReqDescription
assetIdstringyes–
expectedSpecId–––
mediaTypestringyes–
pollIntervalSecondsinteger––
timeoutSecondsinteger––

No output schema declared.

No examples provided.

apple_wait_for_build_upload ~60

Wait until a Build Uploads API operation completes or fails, returning the imported build relationship on success

NameTypeReqDescription
buildUploadIdstringyesBuild Upload ID
pollIntervalSecondsinteger––
timeoutSecondsinteger––

No output schema declared.

No examples provided.

google_activate_purchase_option ~61

Activate a one-time product purchase option so it becomes available for purchase

NameTypeReqDescription
packageNamestringyesAndroid package name
productIdstringyesOne-time product ID
purchaseOptionIdstringyesPurchase option ID to activate

No output schema declared.

No examples provided.

google_activate_subscription_base_plan ~76

Activate a subscription base plan so it becomes purchasable. Base plans default to DRAFT after creation; this is required to make them ACTIVE.

NameTypeReqDescription
basePlanIdstringyesBase plan id to activate
packageNamestringyesAndroid package name
productIdstringyesSubscription product ID

No output schema declared.

No examples provided.

google_commit_edit ~107

Commit all pending changes. By default, fail safely instead of canceling changes that are already in review.

NameTypeReqDescription
changesInReviewBehaviorstring–Safe default is ERROR_IF_IN_REVIEW. Choose cancellation only when intentionally replacing a review.
changesNotSentForReviewboolean–Keep rejected changes out of review until they are explicitly sent from Play Console.
editIdstringyesEdit ID from google_create_edit
packageNamestringyesAndroid package name

No output schema declared.

No examples provided.

google_create_edit ~44

Create a new edit session. Required before making any changes to a Google Play listing.

NameTypeReqDescription
packageNamestringyesAndroid package name (e.g. com.example.app)

No output schema declared.

No examples provided.

google_create_iap ~138

Create a new in-app product (managed product)

NameTypeReqDescription
defaultDescriptionstringyesDefault product description
defaultLanguagestringyesDefault language (e.g. en-US)
defaultPriceCurrencyCodestringyesCurrency code (e.g. USD)
defaultPriceMicrosstringyesPrice in micros (e.g. 990000 for $0.99)
defaultTitlestringyesDefault product title
packageNamestringyesAndroid package name
purchaseTypestring––
skustringyesProduct SKU (unique identifier)
statusstring––

No output schema declared.

No examples provided.

google_create_one_time_product ~166

Create a new one-time product (buy or rent) on Google Play. Inspect the returned purchase-option state and call google_activate_purchase_option when it is DRAFT.

NameTypeReqDescription
listingsarrayyesAt least one localization is required
offerTagsarray––
packageNamestringyesAndroid package name (e.g. com.example.app)
productIdstringyesOne-time product ID, e.g. com.example.app.remove_ads
purchaseOptionsarrayyesAt least one purchase option (buy or rent) is required
regionsVersionstring–Google Play regions version. Default 2022/02 matches Google API expectations.
restrictedPaymentCountriesarray––
taxAndComplianceSettingsobject––

No output schema declared.

No examples provided.

google_create_release ~194

Create or update one release with an explicit version-code set. Google Play retains fallback releases; send only the desired change.

NameTypeReqDescription
countryTargetingobject–Country targeting for an inProgress production rollout
editIdstringyesEdit ID
inAppUpdatePriorityinteger–In-app update priority from 0 (lowest) to 5 (highest); cannot be changed after rollout
packageNamestringyesAndroid package name
releaseNamestring–Release name/label
releaseNotesarray–Release notes per language
statusstring––
trackstringyesTarget track ID, including custom or form-factor tracks returned by google_list_tracks
userFractionnumber–Staged rollout fraction (exclusive range 0-1; not supported for internal)
versionCodesarrayyesComplete version-code set for this release

No output schema declared.

No examples provided.

google_create_subscription ~165

Create a new subscription on Google Play (monetization API). Pass the full subscription body — including listings and at least one base plan with billing details and per-region pricing. Base plans are created in DRAFT state; call google_activate_subscription_base_plan to make them purchasable.

NameTypeReqDescription
basePlansarrayyesAt least one auto-renewing, prepaid, or installments base plan is required
listingsarrayyesAt least one localization is required
packageNamestringyesAndroid package name (e.g. com.example.app)
productIdstringyesSubscription product ID, e.g. com.example.app.pro_monthly
regionsVersionstring–Google Play regions version. Default 2022/02 matches Google API expectations.

No output schema declared.

No examples provided.

google_deactivate_purchase_option ~64

Deactivate a one-time product purchase option so it stops being available for purchase

NameTypeReqDescription
packageNamestringyesAndroid package name
productIdstringyesOne-time product ID
purchaseOptionIdstringyesPurchase option ID to deactivate

No output schema declared.

No examples provided.

google_deactivate_subscription_base_plan ~73

Deactivate a base plan for new subscribers while existing subscribers retain their subscription. Use this instead of the unsupported subscription archive operation.

NameTypeReqDescription
basePlanIdstringyesBase plan id to deactivate
packageNamestringyesAndroid package name
productIdstringyesSubscription product ID

No output schema declared.

No examples provided.

google_delete_all_images ~61

Delete all images of a specific type for a language

NameTypeReqDescription
editIdstringyesEdit ID
imageTypestringyesImage type
languagestringyesLanguage code
packageNamestringyesAndroid package name

No output schema declared.

No examples provided.

google_delete_edit ~39

Discard an edit session without committing changes

NameTypeReqDescription
editIdstringyesEdit ID
packageNamestringyesAndroid package name

No output schema declared.

No examples provided.

google_delete_iap ~38

Delete an in-app product

NameTypeReqDescription
packageNamestringyesAndroid package name
skustringyesProduct SKU to delete

No output schema declared.

No examples provided.

google_delete_image ~67

Delete a specific uploaded image

NameTypeReqDescription
editIdstringyesEdit ID
imageIdstringyesImage ID to delete
imageTypestringyesImage type
languagestringyesLanguage code
packageNamestringyesAndroid package name

No output schema declared.

No examples provided.

google_delete_listing ~57

Delete a store listing for a specific language

NameTypeReqDescription
editIdstringyesEdit ID
languagestringyesLanguage code to delete (e.g. ko-KR)
packageNamestringyesAndroid package name

No output schema declared.

No examples provided.

Install

How do I install the io.github.mikusnuz/app-publish MCP server?

io.github.mikusnuz/app-publish runs locally as an npm package, launched with npx -y app-publish-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · app-publish-mcp

# add to Claude Code
claude mcp add mikusnuz-app-publish -- npx -y app-publish-mcp
Common questions

What is the io.github.mikusnuz/app-publish MCP server?

io.github.mikusnuz/app-publish is an MCP server listed in the public MCP registry as io.github.mikusnuz/app-publish. MCP server for App Store Connect & Google Play Console, iOS/Android app management. This page covers its npm package (app-publish-mcp).

Is the io.github.mikusnuz/app-publish MCP server safe to use?

io.github.mikusnuz/app-publish scores 73 out of 100 on VerifyMCP. We recorded 3 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.mikusnuz/app-publish MCP server expose?

io.github.mikusnuz/app-publish exposes 188 tools: apple_get_asset_library, apple_get_asset_specs, apple_list_assets, apple_get_asset, apple_wait_for_asset, and 183 more. Their descriptions and schemas cost roughly 12,583 tokens of context every time the server is loaded.

Is the io.github.mikusnuz/app-publish MCP server still maintained?

io.github.mikusnuz/app-publish is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.mikusnuz/app-publish MCP server under?

io.github.mikusnuz/app-publish declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.