app-store-connect — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited app-store-connect (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img width="20%" src=".github/assets/logo.webp" alt="mcp-appstore-connect" /> </p> <p align="center"> <h1 align="center">App Store Connect MCP</h1> </p> <p align="center"> App Store Connect in your AI agent. MCP server for the official App Store Connect API. </p> <div align="center">
</div>
A Model Context Protocol (MCP) server that connects Cursor, Claude Desktop, and other MCP clients to the official App Store Connect API—so you can manage iOS/macOS apps, TestFlight, in-app subscriptions, and store metadata via chat or automated tool calls instead of clicking through the App Store Connect UI.
Use it to: list and inspect apps, builds, and beta groups · manage TestFlight testers and review submissions · create and update subscription groups and prices · edit App Store version localizations and "What's New" · download sales and finance reports · list Xcode schemes and CI products. All with JWT auth and the same API Apple's own tools use.
Cursor (install link):
Other clients (Claude Desktop, etc.):
npx add-mcp mcp-ascAdd the server to your MCP config and set these environment variables:
| Variable | Required | Description |
|---|---|---|
APP_STORE_CONNECT_KEY_ID | Yes | API Key ID from App Store Connect |
APP_STORE_CONNECT_ISSUER_ID | Yes | Issuer ID from App Store Connect |
APP_STORE_CONNECT_P8_PATH | Yes | Path to your .p8 private key file |
APP_STORE_CONNECT_VENDOR_NUMBER | For reports | Needed for sales/finance reports |
Create an API key at App Store Connect → Users and Access → Integrations → App Store Connect API. Download the .p8 and note Key ID and Issuer ID.
Example (stdio):
{
"mcpServers": {
"app-store-connect": {
"command": "npx",
"args": ["-y", "mcp-asc"],
"env": {
"APP_STORE_CONNECT_KEY_ID": "YOUR_KEY_ID",
"APP_STORE_CONNECT_ISSUER_ID": "YOUR_ISSUER_ID",
"APP_STORE_CONNECT_P8_PATH": "/path/to/AuthKey_XXXXX.p8",
"APP_STORE_CONNECT_VENDOR_NUMBER": "YOUR_VENDOR_NUMBER_OPTIONAL"
}
}
}
}Example (HTTP SSE): Run npm run build then npm run start:http. Point your client at http://localhost:3001/mcp with the same env vars.
Tools are exposed in kebab-case. Use your MCP client to list them and see parameters. Summary by area:
Apps & metadata
list-apps, get-app, list-app-infos, get-app-info, get-app-availabilitylist-app-store-versions, get-app-store-version, create-app-store-version, update-app-store-versionlist-app-store-version-localizations, list-app-categories, list-app-encryption-declarations, list-nominationsTestFlight / Beta
list-beta-groups, get-beta-group, list-beta-testers, get-beta-tester, add-beta-testers-to-group, remove-beta-testers-from-grouplist-builds, get-build, list-build-beta-details, list-pre-release-versions, get-pre-release-versionlist-beta-app-localizations, list-beta-app-review-details, list-beta-app-review-submissions, list-beta-license-agreements, get-beta-license-agreement, update-beta-license-agreementSubscriptions
list-subscription-groups, list-subscription-group-subscriptions, get-subscription, create-subscription-group, create-subscriptioncreate-subscription-availability, list-subscription-price-points, create-subscription-price, create-subscription-localizationStore & review
list-review-submissions, get-review-submission, submit-for-review, list-customer-reviews, create-customer-review-responseget-app-store-review-detail, update-app-store-review-detailOther
list-bundle-ids, get-bundle-id · list-certificates, get-certificate · list-profiles · list-devices, get-devicelist-users, get-user, list-user-invitations · list-territories · list-actors, get-actorget-eula, update-eula · get-phased-release, create-phased-release · update-age-rating-declarationlist-schemes (Xcode), list-ci-products (Xcode Cloud)download-sales-report, download-finance-report (require APP_STORE_CONNECT_VENDOR_NUMBER)Built with xmcp. One tool per file under src/tools/; each file exports metadata and a default handler.
npm install
npm run build
npm run start:stdio # or npm run start:http for HTTP transport
npm run dev # watch + runNode 20+.
This repository now includes Open Plugins-compatible metadata and layout:
.plugin/plugin.json for plugin metadata.mcp.json for MCP server wiringskills/app-store-connect/SKILL.md for installable skill contextOpen Plugins standard: open-plugins.com
You can test locally by loading the plugin directory in a compatible host, for example:
claude --plugin-dir .To add this server to the official MCP Registry, Cursor MCP Directory, cursor.store, and other catalogs, see docs/REGISTRY.md.
MIT.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.