App Store Connect

appstore-mcp

An MCP server, written in Rust, that exposes the Apple App Store Connect API to AI agents. It covers the full product lifecycle — apps & metadata, in-app purchases, subscriptions and their offers, pricing & availability, App Store versions, App Review submission, TestFlight, provisioning & signing, asset uploads, promoted purchases, customer reviews, phased release, users & access, in-app events, Xcode Cloud, and analytics reports — across 114 tools, and can reach *any* other App Store Connect endpoint through two generic JSON:API tools.

Built on the official rmcp SDK over stdio.

📖 [Full tool reference → docs/TOOLS.md](docs/TOOLS.md) — every tool's purpose and parameters.

Every tool is labelled with MCP annotations, so a client can tell list_apps from remove_user. You can serve only the domains you need (ASC_TOOLS) or only the tools that cannot write (ASC_READ_ONLY) — see Choosing which tools to serve.

Design: hybrid coverage

The App Store Connect API has hundreds of endpoints but is uniformly JSON:API. Rather than a tool per endpoint, this server is hybrid:

• Curated tools (112) for the common, multi-step, or error-prone workflows — apps & metadata, IAPs, subscriptions & offers, versions, pricing, availability, App Review submission, TestFlight, provisioning, asset uploads, promoted purchases, customer reviews, phased release, users, in-app events, Xcode Cloud, analytics reports, and custom product pages.
• Two generic escape-hatch tools — appstore_request and appstore_list — that can call *any* endpoint with raw JSON:API documents.

Tools

See [docs/TOOLS.md](docs/TOOLS.md) for each tool's description and parameters. Custom product page images are uploaded with the existing upload_app_screenshot / upload_app_preview tools.

Install

Prebuilt binaries for macOS (universal), Linux (x86-64), and Windows (x86-64) are attached to every GitHub Release. Pick the channel for your client; all of them need credentials (see Credentials).

Claude Desktop — one-click bundle

Download appstore-mcp.mcpb from the latest release and open it with Claude Desktop (Settings → Extensions → Install Extension…, or drag the file onto the window). It prompts for your Issuer ID, Key ID, and .p8 key file. The bundle ships all three platforms' binaries and selects the right one automatically.

Claude Code — plugin marketplace

/plugin marketplace add forgeopslabs/appstore-mcp

/plugin install appstore-mcp@forgeopslabs

The plugin launches the appstore-mcp binary from your PATH, so install it first — download the binary for your OS from the latest release and put it on your PATH, or cargo install --git https://github.com/forgeopslabs/appstore-mcp. Set ASC_ISSUER_ID, ASC_KEY_ID, and ASC_PRIVATE_KEY_PATH in the environment you start Claude Code from.

Codex

Codex configures MCP servers directly (no marketplace). With appstore-mcp on your PATH:

codex mcp add appstore \

--env ASC_ISSUER_ID=... --env ASC_KEY_ID=... \ --env ASC_PRIVATE_KEY_PATH=/path/AuthKey_XXXXXX.p8 \ -- appstore-mcp

or in ~/.codex/config.toml:

[mcp_servers.appstore]

command = "appstore-mcp" args = [] env = { ASC_ISSUER_ID = "...", ASC_KEY_ID = "...", ASC_PRIVATE_KEY_PATH = "/path/AuthKey_XXXXXX.p8" }

MCP Registry

Published as io.github.forgeopslabs/appstore-mcp (metadata in server.json) so any MCP-aware client can discover it.

From source

cargo build --release    # -> target/release/appstore-mcp

Credentials

Generate a Team Key in App Store Connect → *Users and Access → Integrations → App Store Connect API*, and download the .p8 file. Then set:

See .env.example. The server authenticates each request with a short-lived ES256 JWT signed by your key (cached and refreshed automatically).

The server starts even without credentials so a client can list its tools;

tool calls then return an actionable configuration error until creds are set.

Choosing which tools to serve

A hundred tool definitions cost context in every session, and a client that sees one flat list can't tell a read from a delete. Two knobs fix that:

ASC_TOOLS=core                     # 41 tools: generic, apps, versions, assets, testflight, submission

ASC_TOOLS=testflight,provisioning # just what a build-distribution agent needs ASC_READ_ONLY=1 # 35 read-only tools; writes are withheld entirely ASC_TOOL_DISCOVERY=1 # 3 visible tools; discover domain tools on demand

Groups: generic, apps, iap, subscriptions, versions, pricing, availability, submission, testflight, provisioning, assets, offers, offer-codes, promotions, reviews, users, events, xcode-cloud, analytics, custom-product-pages — plus all and core. An unrecognised name is warned about on stderr and serves nothing rather than quietly falling back to everything.

In read-only mode appstore_request is kept but refuses any method other than GET, so the escape hatch still reaches endpoints without a curated tool without becoming a way around the restriction.

Every served tool advertises MCP annotations (readOnlyHint, destructiveHint, idempotentHint), which clients use to decide what needs confirming. Nine tools are marked destructive: the seven delete_*/remove_* tools, expire_build, disable_bundle_id_capability, and appstore_request (which can reach any DELETE endpoint).

Discovery mode. Search by task, inspect a matching tool's full input schema and safety annotations, then pass its exact name and arguments to call_discovered_tool. ASC_TOOLS and ASC_READ_ONLY filter the private catalog before search or execution. Direct calls to hidden tool names fail. This is server-side discovery: inspected schemas appear in tool results, not as new first-class MCP tools injected by the host. The generic execution tool is marked destructive whenever writes are enabled; hosts cannot apply distinct approval rules to each hidden tool. Inspect the underlying tool and approve writes before calling it. Default mode preserves the existing individually annotated tool surface.

Tuning

Defaults are chosen so a tool call can't hang and a single response can't swamp an agent's context. All of these are optional.

Retries. A 429 is replayed for any method, since Apple rejected the request without applying it. A 5xx or a mid-flight timeout is replayed only for GET/PATCH/PUT/DELETE — never POST, which could otherwise create a duplicate resource (and Apple permanently reserves identifiers like a product ID). Backoff is exponential with jitter and honours Retry-After.

Response shaping. Results are serialized compactly