app-store-connect-mcp

# App Store Connect MCP Server

**Give Claude your App Store Connect account without giving it the keys to your pricing.**
An MCP server covering the App Store Connect API *and* the App Store Server API
(StoreKit 2) — 1,293 operations behind 13 tools, for Claude Code, Claude Desktop,
Cursor and anything else that speaks [Model Context Protocol](https://modelcontextprotocol.io).

[![npm](https://img.shields.io/npm/v/@abd3lraouf/app-store-connect-mcp?logo=npm&color=cb3837)](https://www.npmjs.com/package/@abd3lraouf/app-store-connect-mcp)
[![CI](https://github.com/abd3lraouf-studios/app-store-connect-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/abd3lraouf-studios/app-store-connect-mcp/actions/workflows/ci.yml)
[![Tests](https://img.shields.io/badge/tests-300%20passing-brightgreen?logo=vitest&logoColor=white)](#receipts)
[![Coverage](https://img.shields.io/badge/line%20coverage-93%25-brightgreen)](#receipts)
[![Licence](https://img.shields.io/badge/licence-BUSL--1.1-orange)](LICENSE)

[![Operations](https://img.shields.io/badge/Apple%20API%20operations-1%2C293-0b5fff)](#keeping-current-with-apple)
[![Tools](https://img.shields.io/badge/MCP%20tools-11-0b5fff)](#the-eleven-tools)
[![MCP](https://img.shields.io/badge/protocol-MCP%202025--11--25-8a3ffc?logo=anthropic&logoColor=white)](#receipts)
[![Node](https://img.shields.io/badge/node-%E2%89%A522.19-339933?logo=nodedotjs&logoColor=white)](package.json)
[![Platform](https://img.shields.io/badge/macOS%20%C2%B7%20Linux%20%C2%B7%20Windows-lightgrey?logo=apple&logoColor=white)](#known-limits)
[![Install size](https://img.shields.io/badge/tarball-276%20kB-lightgrey)](#install)

```
1,293 operations · 13 tools · key never on disk · Apple signatures verified
```

```mermaid
flowchart LR
    A["Claude<br/>Cursor · any MCP client"] -->|"search · call · write"| B["app-store-connect-mcp<br/>13 tools"]
    B --> C{"risk tier"}
    C -->|"READ · 811 ops"| D["Apple<br/>App Store Connect API"]
    C -->|"WRITE · 482 ops"| E["ask a human first"]
    E -->|approved| D
    E -->|declined| F["nothing is sent"]
    B --> G["App Store Server API<br/>StoreKit 2 · signatures verified"]

    style E fill:#ffe8b3,stroke:#c98a00,color:#000
    style F fill:#ffd6d6,stroke:#c00,color:#000
    style D fill:#d6f5d6,stroke:#2a2,color:#000
    style G fill:#d6f5d6,stroke:#2a2,color:#000
```

---

## Don't install this

Genuinely. There are cheaper ways to spend your afternoon, and several kinds of
person should close the tab now:

**You want an agent that just does things.** This one stops and asks before it
changes a price, deletes anything, or touches who can access your account — and
it asks *you*, not itself. If that sounds like friction, it is. That is the
product.

**You want every endpoint as its own tool.** Some servers register 890. Yours
would spend six figures of context on tool definitions before answering a single
question. This registers 11 and finds the rest by searching.

```text
tool definitions loaded into context, before you ask anything

  one tool per endpoint   ███████████████████████████████████   >100k tokens
  this server             ▌                                       ~1k tokens
```

**You're on Windows or Linux and wanted Keychain.** Keychain storage is macOS
only. You can use a file path elsewhere, but the best part of this is
macOS-shaped.

**You want it to write your App Store copy.** It will fetch your reviews and
your localisations. It will not invent marketing prose and push it live, and
there is no flag to make it.

**You're evaluating this for a product you sell.** Read [the licence](LICENSE)
first. Internal use is free; reselling it isn't.

Still here? Then the rest is probably for you.

---

## What it refuses to do

Most of the engineering here went into restraint, so it is the honest place to
start.

**It won't run generated code.** The elegant way to cover a huge API is to let
the model write JavaScript and `eval` it in a sandbox. Node's `vm` is not a
sandbox — its own documentation says so — and any host object handed in leaks
the whole realm back through its prototype chain:

```js
spec.constructor.constructor('return process.env.HOME')()   // → /Users/you
```

That is a reproduction of a real shipping MCP server's sandbox, and it returns
your home directory. Its 15-second timeout doesn't help either: it bounds only
*synchronous* code, so an `async` loop runs forever. This server dispatches
**parameters**, not code. Same coverage, same token cost, nothing to escape.

**It won't let a write pretend to be a read.** Reads and writes are separate
tools. `asc_write` carries `_meta["anthropic/requiresUserInteraction"]`, which
Claude Code honours **even under `bypassPermissions`**. There is no flag that
turns that off, because a safety you can disable is a safety you will disable.

**It won't decide your pricing intent for you.** `preserve_current_price` is a
required parameter with no default. Apple defaults it to `false` — meaning your
existing subscribers get moved to the new price. Making it required forces that
decision into the open, where a person can see it.

**It won't create ongoing commitments to answer a question.** Fetching analytics
needs a report request, and `accessType: ONGOING` is a standing obligation on
your account, not a query. The tool reads reports; it will not create one
silently.

**It won't pretend it sanitised your reviews.** Customer review text is written
by strangers and lands in your model's context verbatim. Results carrying it
*lead* with a note saying it is data to report on, not instructions to follow.
It is deliberately not filtered for injection phrases — that is a game attackers
iterate against, and passing such a filter would imply a safety it cannot
deliver.

**It won't tell you a signature is fine when it hasn't checked.** See below.

---

## Install

**Claude Code, one line:**

```bash
claude mcp add --scope user app-store-connect \
  --env ASC_KEY=keychain:my-asc-key \
  --env ASC_BUNDLE_ID=com.example.app \
  --env ASC_APP_APPLE_ID=1234567890 \
  -- npx -y @abd3lraouf/app-store-connect-mcp
```

Nothing to clone or build. Or from source, if you'd rather read it first:

```bash
git clone https://github.com/abd3lraouf-studios/app-store-connect-mcp
cd app-store-connect-mcp && npm install && npm run build
```

Or, for Claude Desktop, Cursor and friends:

```json
{
  "mcpServers": {
    "app-store-connect": {
      "command": "npx",
      "args": ["-y", "@abd3lraouf/app-store-connect-mcp"],
      "env": {
        "ASC_KEY": "keychain:my-asc-key",
        "ASC_BUNDLE_ID": "com.example.app",
        "ASC_APP_APPLE_ID": "1234567890"
      }
    }
  }
}
```

Then ask it *"check the App Store Connect connection"* — that runs `asc_status`,
which verifies your credentials with one lightweight request and tells you
exactly what is missing if anything is.

### Your key belongs in the Keychain

Apple lets you download a `.p8` **exactly once**. A plaintext copy on disk is a
copy that can leak.

```bash
ASC_KEY=keychain:my-asc-key          # recommended
ASC_KEY=/path/to/AuthKey.p8          # works, but plaintext
ASC_PRIVATE_KEY='-----BEGIN…'        # discouraged: ps -E exposes it
```

Store it as base64 JSON so the identifiers travel *with* the key material —
`ASC_KEY_ID` then cannot drift out of sync with the key it names, a mismatch
that surfaces only as an opaque 401:

```bash
security add-generic-password -s my-asc-key -a api -w "$(
  jq -nc --arg i "$ISSUER" --arg k "$KEYID" --arg p "$(cat AuthKey.p8)" \
    '{issuerID:$i,keyID:$k,privateKeyPEM:$p}' | base64
)"
```

---

## The thirteen tools

**Five core**, covering everything:

| Tool | |
|---|---|
| `asc_status` | Credentials, reachability, remaining rate-limit budget. Run this first when anything fails — it separates a bad key from a bad request. |
| `asc_search_endpoints` | Search 1,293 operations across both APIs by keyword, method, tag or risk tier. |
| `asc_describe_endpoint` | Parameters, request-body schema with real field names, risk tier. |
| `asc_call` | **Reads.** Path and query parameters, pagination, both APIs. |
| `asc_write` | **Everything that changes data.** Confirmation, `dry_run`. |

**Eight composite**, for chains the raw API cannot express in a single call. A
tool that merely saved one request was left out — it would need keeping in step
with Apple forever and buys nothing `asc_call` doesn't already do:

| Tool | What it collapses |
|---|---|
| `asc_pricing_get` | ~175 lookups → a handful, for subscriptions **and** one-time purchases. The **currency lives on the territory**, not the price row, so reading prices by hand gives ambiguous numbers. |
| `asc_pricing_set` | The same chain plus the write, with the subscriber decision forced into the open. |
| `asc_preflight_version` | Six resources → **GO / NO-GO**, each gap naming the operation that fixes it. |
| `asc_listing_screenshots` | A request per locale → four, via `included`. |
| `asc_upload_screenshot` | Apple's reserve → PUT-at-offsets → commit-with-MD5 sequence, across two hosts. |
| `asc_upload_iap_screenshot` | The same sequence for an in-app purchase's review screenshot — the field that keeps an IAP in `MISSING_METADATA`. |
| `asc_availability_set` | One PATCH per territory (up to 175; Apple has no bulk endpoint), then **re-reads every one** and reports what did not take. |
| `asc_analytics_report` | Five hops → signed URL → gunzip → rows, with **every segment stitched**. |

<details>
<summary><b>Why <code>asc_upload_screenshot</code> cannot be one API call</b></summary>

Apple's asset flow spans two hosts and ends in a checksum that fails *silently*
if you get it wrong — the upload simply sits in `AWAITING_UPLOAD` looking like
nothing happened. `uploadOperations` appears in Apple's OpenAPI document only as
a value in a `fields[]` enum, so an agent reading the spec can see the field
exists and still have no idea it must act on it.

```mermaid
sequenceDiagram
    participant M as C