Mcp Googleplay Reviews — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Googleplay Reviews (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A small, reviews-only MCP server for Google Play, backed by the Android Publisher API v3. It lets an agent read user reviews and reply to them — and deliberately nothing else.
The capability boundary is the trust guarantee. This server exposes only the two review tools below. There is intentionally no release, track, listing, image, in-app-product, subscription, or APK/AAB upload tool, so the service account you give it can't be used to ship a release or change your store listing. Scope the service account itself narrowly too — grant only the Reply to reviews permission in Play Console.
It is also dependency-free — pure Node 18+ (fetch + built-in crypto), no third-party packages — so there is no supply chain to audit beyond this one file (index.mjs).
| Tool | Description |
|---|---|
list_reviews | List recent user reviews for an app, including any existing developer reply. Args: packageName, maxResults, translationLanguage, startToken; returns nextPageToken for paging. |
reply_to_review | Reply to a review (packageName, reviewId, replyText, max 350 chars). Replying again edits the existing reply. |
Note: Google Play only returns reviews where the user left text, and typically only from the last week — this is an API limitation, not a limitation of this server.
Create a Google Cloud service account with a JSON key, enable the Google Play Android Developer API, and in Play Console → Users and permissions invite the service account's email with only the Reply to reviews permission.
| Env var | What |
|---|---|
GOOGLE_APPLICATION_CREDENTIALS | Path to the service-account JSON key file |
The key is read only to sign a short-lived RS256 JWT, which is exchanged for an OAuth access token scoped to androidpublisher; the key is never logged, copied, or sent anywhere but Google's token endpoint.
GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json \
npx -y github:ForgeHQ-Agents/mcp-googleplay-reviewsThe agent passes the app's package name (e.g. com.example.app) as packageName.
npm test # node --test, zero dependenciesMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.