Interact with Apple's App Store Connect API
SaferSkills independently audited app-store-connect-mcp (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.gjeltep/app-store-connect-mcp -->
Talk to App Store Connect about your app. Modular tools, async I/O, and OpenAPI‑driven typing so your agent stays accurate as Apple evolves.
httpx client, server‑side filtering, and smart pagination to keep payloads lean.#### From PyPI
pip install app-store-connect-mcp#### From Source
git clone https://github.com/gjeltep/app-store-connect-mcp.git
cd app-store-connect-mcp
uv pip install -e ".[dev]"Set these environment variables:
# Required
export APP_STORE_KEY_ID="YOUR_KEY_ID"
export APP_STORE_ISSUER_ID="YOUR_ISSUER_ID"
export APP_STORE_PRIVATE_KEY_PATH="/path/to/AuthKey_XXXXX.p8"
# Optional
export APP_STORE_APP_ID="YOUR_APP_ID"
export APP_STORE_KEY_TYPE="team" # or "individual"Run with your environment variables set (recommended):
app-store-connect-mcpOr use a .env file during development:
# Copy and configure .env file
cp .env.example .env
# Edit .env with your credentials
# Run with --env-file flag
app-store-connect-mcp-dev --env-file .env
# Validate configuration without starting server
app-store-connect-mcp-dev --env-file .env --validate-onlyUse with any MCP‑compatible client; the server announces tools and handles calls over stdio.
Models are generated from Apple's official OpenAPI spec (fetched automatically from Apple's developer site). You can override the source with APP_STORE_CONNECT_OPENAPI_URL to point to a local JSON file.
uv pip install -e .[dev]
python scripts/generate_models.pyFor development setup, testing, and contribution guidelines, see CONTRIBUTING.md.
Tools use a resource-first naming convention (resource.verb) with category tags for discoverability.
#### App Tools
rating, territory, appStoreVersion).#### TestFlight Tools
device_model, os_version, app_platform, device_platform, build_id, tester_id).appPlatform, deviceModel, osVersion)created_since_days, created_after, created_before).#### Analytics Tools Requests:
access_type).Reports:
name, category).granularity, processing_date).Segments:
#### Xcode Cloud Tools Products & Workflows:
product_type).is_enabled).Builds:
execution_progress, completion_status, is_pull_request_build).Build Artifacts & Results:
SCM Integration:
graph TD
%% Entry Point
subgraph "Entry Point"
SERVER[server.py<br/>MCP stdio server]
end
%% Domain Implementations
subgraph "Domain Handlers"
TESTFLIGHT[testflight/handlers.py<br/>TestFlight crash<br/>management]
APP[app/handlers.py<br/>App Store review<br/>management]
ANALYTICS[analytics/handlers.py<br/>Analytics report<br/>management]
XCODE_CLOUD[xcode_cloud/handlers.py<br/>Xcode Cloud CI/CD<br/>management]
end
%% Core Architecture
subgraph "Core Components"
subgraph "Core Framework"
PROTOCOLS[protocols.py<br/>Abstract interfaces]
BASE_HANDLER[base_handler.py<br/>Abstract base class]
QUERY_BUILDER[query_builder.py<br/>Fluent query construction]
FILTERS[filters.py<br/>Chainable filter engine]
RESPONSE_HANDLER[response_handler.py<br/>API response processing]
CONTAINER[container.py<br/>Dependency injection]
ERRORS[errors.py<br/>Structured error handling]
end
subgraph "API Layer"
ASC_CLIENT[app_store_connect.py<br/>App Store Connect client<br/>with JWT auth]
HTTP_CLIENT[http_client.py<br/>Base HTTP client]
MODELS[app_store_connect_models.py<br/>Auto-generated Pydantic<br/>models from OpenAPI spec]
end
subgraph "Data & Tools"
OPENAPI[app_store_connect_api_openapi.json<br/>Apple's OpenAPI spec]
GENERATE_SCRIPT[scripts/generate_models.py<br/>Model generation script]
end
end
%% Vertical Stack Relationships
SERVER -->|"routes to"| ANALYTICS
ANALYTICS -->|"uses"| ASC_CLIENT
%% Styling
classDef entry fill:#f3e5f5,stroke:#4a148c,stroke-width:2px
classDef core fill:#fff3e0,stroke:#e65100,stroke-width:2px
classDef domain fill:#fce4ec,stroke:#880e4f,stroke-width:2px
class SERVER entry
class PROTOCOLS,BASE_HANDLER,QUERY_BUILDER,FILTERS,RESPONSE_HANDLER,CONTAINER,ERRORS,ASC_CLIENT,HTTP_CLIENT,MODELS,OPENAPI,GENERATE_SCRIPT core
class TESTFLIGHT,APP,ANALYTICS,XCODE_CLOUD domainBuilt on the official Model Context Protocol Python SDK — see the docs and examples in the python‑sdk README.
See CONTRIBUTING.md if you'd like to help.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.