appstore-connect-mcp

mcp
Guvenlik Denetimi
Uyari
Health Uyari
  • No license — Repository has no license file
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 11 GitHub stars
Code Uyari
  • process.env — Environment variable access in src/lib/client.ts
  • crypto private key — Private key handling in src/lib/client.ts
  • process.env — Environment variable access in src/lib/reports-api.ts
Permissions Gecti
  • Permissions — No dangerous permissions requested
Purpose
This server connects AI clients like Cursor and Claude to the official Apple App Store Connect API. It allows developers to manage iOS apps, TestFlight, subscriptions, and financial reports via natural language prompts rather than the standard web interface.

Security Assessment
Overall Risk: Medium. The server requires highly sensitive Apple developer credentials to function, specifically your API Key ID, Issuer ID, and a `.p8` private key file. The code reads these via environment variables and handles the private key locally to generate JWT authentication tokens for Apple. While this is the expected behavior for this type of integration, exposing financial and app management capabilities to an AI agent inherently carries significant risk. There are no hardcoded secrets, and the tool does not execute arbitrary shell commands. It only makes network requests directly to Apple's official API endpoints.

Quality Assessment
The project is active and recently updated, with code written in TypeScript. It has a small but present community backing with 11 GitHub stars. However, the rule-based scan detected a missing repository license file, though an MIT license badge is referenced in the documentation. Operating without a clearly defined software license means the legal terms of use are ambiguous, which may be a concern for enterprise or commercial projects.

Verdict
Use with caution. The code itself is safe, but granting an AI agent access to your Apple developer account and financial data should be strictly limited to trusted, private environments.
SUMMARY

App Store Connect API as MCP tools for Cursor & Claude. Apps, TestFlight, subscriptions, localizations, reports.

README.md

mcp-appstore-connect

App Store Connect MCP

App Store Connect in your AI agent. MCP server for the official App Store Connect API.

npm version
License

A Model Context Protocol (MCP) server that connects Cursor, Claude Desktop, and other MCP clients to the official App Store Connect API—so you can manage iOS/macOS apps, TestFlight, in-app subscriptions, and store metadata via chat or automated tool calls instead of clicking through the App Store Connect UI.

Use it to: list and inspect apps, builds, and beta groups · manage TestFlight testers and review submissions · create and update subscription groups and prices · edit App Store version localizations and "What's New" · download sales and finance reports · list Xcode schemes and CI products. All with JWT auth and the same API Apple's own tools use.

Install

Cursor (install link):

Install MCP Server

Other clients (Claude Desktop, etc.):

npx add-mcp mcp-asc

Configure

Add the server to your MCP config and set these environment variables:

Variable Required Description
APP_STORE_CONNECT_KEY_ID Yes API Key ID from App Store Connect
APP_STORE_CONNECT_ISSUER_ID Yes Issuer ID from App Store Connect
APP_STORE_CONNECT_P8_PATH Yes Path to your .p8 private key file
APP_STORE_CONNECT_VENDOR_NUMBER For reports Needed for sales/finance reports

Create an API key at App Store Connect → Users and Access → Integrations → App Store Connect API. Download the .p8 and note Key ID and Issuer ID.

Example (stdio):

{
  "mcpServers": {
    "app-store-connect": {
      "command": "npx",
      "args": ["-y", "mcp-asc"],
      "env": {
        "APP_STORE_CONNECT_KEY_ID": "YOUR_KEY_ID",
        "APP_STORE_CONNECT_ISSUER_ID": "YOUR_ISSUER_ID",
        "APP_STORE_CONNECT_P8_PATH": "/path/to/AuthKey_XXXXX.p8",
        "APP_STORE_CONNECT_VENDOR_NUMBER": "YOUR_VENDOR_NUMBER_OPTIONAL"
      }
    }
  }
}

Example (HTTP SSE): Run npm run build then npm run start:http. Point your client at http://localhost:3001/mcp with the same env vars.

Tools

Tools are exposed in kebab-case. Use your MCP client to list them and see parameters. Summary by area:

Apps & metadata

  • list-apps, get-app, list-app-infos, get-app-info, get-app-availability
  • list-app-store-versions, get-app-store-version, create-app-store-version, update-app-store-version
  • list-app-store-version-localizations, list-app-categories, list-app-encryption-declarations, list-nominations

TestFlight / Beta

  • list-beta-groups, get-beta-group, list-beta-testers, get-beta-tester, add-beta-testers-to-group, remove-beta-testers-from-group
  • list-builds, get-build, list-build-beta-details, list-pre-release-versions, get-pre-release-version
  • list-beta-app-localizations, list-beta-app-review-details, list-beta-app-review-submissions, list-beta-license-agreements, get-beta-license-agreement, update-beta-license-agreement

Subscriptions

  • list-subscription-groups, list-subscription-group-subscriptions, get-subscription, create-subscription-group, create-subscription
  • create-subscription-availability, list-subscription-price-points, create-subscription-price, create-subscription-localization

Store & review

  • list-review-submissions, get-review-submission, submit-for-review, list-customer-reviews, create-customer-review-response
  • get-app-store-review-detail, update-app-store-review-detail

Other

  • list-bundle-ids, get-bundle-id · list-certificates, get-certificate · list-profiles · list-devices, get-device
  • list-users, get-user, list-user-invitations · list-territories · list-actors, get-actor
  • get-eula, update-eula · get-phased-release, create-phased-release · update-age-rating-declaration
  • list-schemes (Xcode), list-ci-products (Xcode Cloud)
  • download-sales-report, download-finance-report (require APP_STORE_CONNECT_VENDOR_NUMBER)

Development

Built with xmcp. One tool per file under src/tools/; each file exports metadata and a default handler.

npm install
npm run build
npm run start:stdio   # or npm run start:http for HTTP transport
npm run dev            # watch + run

Node 20+.

Listing in MCP catalogs

To add this server to the official MCP Registry, Cursor MCP Directory, cursor.store, and other catalogs, see docs/REGISTRY.md.

License

MIT.

Links

Yorumlar (0)

Sonuc bulunamadi