App Store Connect MCP

App Store Connect MCP Server

Give Claude your App Store Connect account without giving it the keys to your pricing. An MCP server covering the App Store Connect API *and* the App Store Server API (StoreKit 2) — 1,293 operations behind 13 tools, for Claude Code, Claude Desktop, Cursor and anything else that speaks Model Context Protocol.

1,293 operations · 13 tools · key never on disk · Apple signatures verified

flowchart LR

A["Claude Cursor · any MCP client"] -->|"search · call · write"| B["app-store-connect-mcp 13 tools"] B --> C{"risk tier"} C -->|"READ · 811 ops"| D["Apple App Store Connect API"] C -->|"WRITE · 482 ops"| E["ask a human first"] E -->|approved| D E -->|declined| F["nothing is sent"] B --> G["App Store Server API StoreKit 2 · signatures verified"]

style E fill:#ffe8b3,stroke:#c98a00,color:#000 style F fill:#ffd6d6,stroke:#c00,color:#000 style D fill:#d6f5d6,stroke:#2a2,color:#000 style G fill:#d6f5d6,stroke:#2a2,color:#000

Don't install this

Genuinely. There are cheaper ways to spend your afternoon, and several kinds of person should close the tab now:

You want an agent that just does things. This one stops and asks before it changes a price, deletes anything, or touches who can access your account — and it asks *you*, not itself. If that sounds like friction, it is. That is the product.

You want every endpoint as its own tool. Some servers register 890. Yours would spend six figures of context on tool definitions before answering a single question. This registers 11 and finds the rest by searching.

tool definitions loaded into context, before you ask anything

one tool per endpoint ███████████████████████████████████ >100k tokens this server ▌ ~1k tokens

You're on Windows or Linux and wanted Keychain. Keychain storage is macOS only. You can use a file path elsewhere, but the best part of this is macOS-shaped.

You want it to write your App Store copy. It will fetch your reviews and your localisations. It will not invent marketing prose and push it live, and there is no flag to make it.

You're evaluating this for a product you sell. Read the licence first. Internal use is free; reselling it isn't.

Still here? Then the rest is probably for you.

What it refuses to do

Most of the engineering here went into restraint, so it is the honest place to start.

It won't run generated code. The elegant way to cover a huge API is to let the model write JavaScript and eval it in a sandbox. Node's vm is not a sandbox — its own documentation says so — and any host object handed in leaks the whole realm back through its prototype chain:

spec.constructor.constructor('return process.env.HOME')()   // → /Users/you

That is a reproduction of a real shipping MCP server's sandbox, and it returns your home directory. Its 15-second timeout doesn't help either: it bounds only *synchronous* code, so an async loop runs forever. This server dispatches parameters, not code. Same coverage, same token cost, nothing to escape.

It won't let a write pretend to be a read. Reads and writes are separate tools. asc_write carries _meta["anthropic/requiresUserInteraction"], which Claude Code honours even under `bypassPermissions`. The model cannot talk its way past it; only the operator can, by starting the server with --no-confirm — which drops the flag, the prompt and the token together, for runs where nobody is present to answer.

It won't decide your pricing intent for you. preserve_current_price is a required parameter with no default. Apple defaults it to false — meaning your existing subscribers get moved to the new price. Making it required forces that decision into the open, where a person can see it.

It won't create ongoing commitments to answer a question. Fetching analytics needs a report request, and accessType: ONGOING is a standing obligation on your account, not a query. The tool reads reports; it will not create one silently.

It won't pretend it sanitised your reviews. Customer review text is written by strangers and lands in your model's context verbatim. Results carrying it *lead* with a note saying it is data to report on, not instructions to follow. It is deliberately not filtered for injection phrases — that is a game attackers iterate against, and passing such a filter would imply a safety it cannot deliver.

It won't tell you a signature is fine when it hasn't checked. See below.

Install

Claude Code, one line:

claude mcp add --scope user app-store-connect \

--env ASC_KEY=keychain:my-asc-key \ --env ASC_BUNDLE_ID=com.example.app \ --env ASC_APP_APPLE_ID=1234567890 \ -- npx -y @abd3lraouf/app-store-connect-mcp

Nothing to clone or build. Or from source, if you'd rather read it first:

git clone https://github.com/abd3lraouf-studios/app-store-connect-mcp

cd app-store-connect-mcp && npm install && npm run build

Or, for Claude Desktop, Cursor and friends:

{

"mcpServers": { "app-store-connect": { "command": "npx", "args": ["-y", "@abd3lraouf/app-store-connect-mcp"], "env": { "ASC_KEY": "keychain:my-asc-key", "ASC_BUNDLE_ID": "com.example.app", "ASC_APP_APPLE_ID": "1234567890" } } } }

Then ask it *"check the App Store Connect connection"* — that runs asc_status, which verifies your credentials with one lightweight request and tells you exactly what is missing if anything is.

Your key belongs in the Keychain

Apple lets you download a .p8 exactly once. A plaintext copy on disk is a copy that can leak.

ASC_KEY=keychain:my-asc-key          # recommended

ASC_KEY=/path/to/AuthKey.p8 # works, but plaintext ASC_PRIVATE_KEY='-----BEGIN…' # discouraged: ps -E exposes it

Store it as base64 JSON so the identifiers travel *with* the key material — ASC_KEY_ID then cannot drift out of sync with the key it names, a mismatch that surfaces only as an opaque 401:

security add-generic-password -s my-asc-key -a api -w "$(

jq -nc --arg i "$ISSUER" --arg k "$KEYID" --arg p "$(cat AuthKey.p8)" \ '{issuerID:$i,keyID:$k,privateKeyPEM:$p}' | base64 )"

The thirteen tools

Five core, covering everything:

Eight composite, for chains the raw API cannot express in a single call. A tool that merely saved one request was left out — it would need keeping in step with Apple forever and buys nothing asc_call doesn't already do:

Why asc_upload_screenshot cannot be one API call

Apple's asset flow spans two hosts and ends in a checksum that fails *silently* if you get it wrong — the upload simply sits in AWAITING_UPLOAD looking like nothing happened. uploadOperations appears in Apple's OpenAPI document only as a value in a fields[] enum, so an agent reading the spec can see the field exists and still have no idea it must act on it.

sequenceDiagram

participant M as Claude participant S as this server participant A as App Store Connect participant U as Apple asset host

M->>S: asc_upload_screenshot(set, file) S->>A: POST /v1/appScreenshots (fileName, fileSize) A-->>S: id + uploadOperations[] loop each byte range S->>U: PUT bytes at offset, Apple's headers Note over S,U: pre-signed URL — no bearer token sent end S->>A: PATCH uploaded=true + MD5 checksum A-->>S: assetDeliveryState S-->>M: state, and how to clean up if it failed

Plus four resources (@asc:cookbook, @asc:enums, @asc:risk, @asc:sources) and four workflows as slash commands: /mcp__asc__release-readiness, pricing-audit, review-triage, testflight-status.

Write safety

An HTTP method is a poor proxy for consequence. PATCH /v1/subscriptionPrices and PATCH /v1/appInfos/{id} are both writes; only one changes what customers are charged, and neither is undone by repeating it. So every operation carries a tier (counts are App Store Connect; StoreKit 2 adds 14 reads and 16 writes):

flowchart TD

A["asc_write called"] --> B{"--read-only?"} B -->|yes| Z["blocked"] B -->|no| N{"--no-confirm?"} N -->|yes| S["send it"] N -->|no| C{"risk tier"} C -->|"WRITE"| S["send it"] C -->|"REVENUE · DESTRUCTIVE INFRASTRUCTURE · ACCESS · RELEASE"| D{"client supports elicitation?"} D -->|yes| E["ask the person method · path · body · tier"] D -->|no| F["issue a token<