App Store Connect MCP Server

A Model Context Protocol (MCP) server for Apple's App Store Connect API. Manage your iOS, macOS, tvOS, and visionOS apps directly from Claude, Cursor, or any MCP-compatible client.

Features

• Any API Operation - Call any of the 1,303 App Store Connect API operations through asc_api_request, validated against Apple's OpenAPI spec, with asc_api_search and asc_api_describe to find and inspect them
• Submission & Release - Edit version metadata (copyright, version string, release type), attach builds, App Review details, review submissions, phased and manual release, export compliance
• App Info - Categories, age rating declaration, app info localizations, custom EULA
• App Store Localizations - Full CRUD for version descriptions, keywords, and what's new
• App Management - List and inspect apps across all platforms
• Version Control - Create and manage app store versions
• TestFlight - Groups, build access, testers and invitations, What to Test notes, beta app localizations, beta review submissions
• Screenshots & Previews - Upload, reorder, and delete screenshots and app previews; review screenshots for subscriptions and in-app purchases
• Customer Reviews - Read reviews and publish or remove responses
• Bundle ID Management - Full CRUD for bundle identifiers
• Device Management - List and inspect registered devices
• User Management - List and inspect team users
• Build Management - List and inspect app builds
• Category & Pricing - Browse categories, check pricing and availability
• Pricing & PPP - Set per-territory pricing with Purchase Power Parity support
• Subscriptions - Groups, subscriptions, localizations, pricing & PPP, availability, promotional, introductory and win-back offers, offer codes
• In-App Purchases - Create and manage one-time purchases (lifetime/non-consumable, consumable, non-renewing): metadata, localization, pricing & PPP, availability, offer codes, review screenshots, and review submission
• Custom Product Pages - Pages, versions, and per-locale promotional text
• Analytics Reports - Request and download app analytics reports (engagement, commerce, usage, performance)
• Sales & Finance - Download sales, trends, and financial reports
• Performance & Diagnostics - App/build power & performance metrics and diagnostic logs
• Toolsets & Read-Only Mode - Expose only the tool groups you need, or block every write with ASC_READ_ONLY=1
• Secure by Default - ES256 JWT auth with automatic token refresh, credential redaction in logs

Table of Contents

• Quick Start
• Installation
• Configuration
• Available Tools
• Usage Examples
• Security
• Troubleshooting
• Development
• License

Quick Start

1. Get an App Store Connect API key (see Prerequisites).
2. Add the server to your MCP client with npx -y asc-mcp@latest and your credentials (see MCP Client Configuration).
3. Restart the client. New releases are picked up on each restart.

Installation

npx (recommended)

npx -y asc-mcp@latest

Your MCP client runs this command itself (see MCP Client Configuration). npx fetches the newest release whenever the client starts, so you stay up to date.

Global install

npm install -g asc-mcp

Then use "command": "asc-mcp" in your client config. A global install does not update by itself: run npm install -g asc-mcp@latest to update.

Updating

• npx: restart your MCP client. A running client keeps the version it started with.
• Global install: npm install -g asc-mcp@latest, then restart the client.
• Pin a version for stability with [email protected] (or any version) instead of asc-mcp@latest.

Once a day the server asks npm for the latest version in the background, without delaying startup. If yours is older, the next time the server starts it tells your assistant, which mentions it to you once. It sends nothing but that request, and installs nothing. Set ASC_DISABLE_UPDATE_CHECK=1 to turn it off.

From Source

git clone https://github.com/SardorbekR/appstore-connect-mcp.git
cd appstore-connect-mcp
npm install
npm run build

Configuration

Prerequisites: Get Your Apple API Credentials

1. Sign in to App Store Connect
2. Go to Users and Access → Integrations → App Store Connect API
3. Click Generate API Key (or use existing)
4. Select appropriate role (Admin or App Manager recommended)
5. Download the .p8 file - you can only download it once!
6. Note your Key ID (shown in the keys list)
7. Note your Issuer ID (shown at the top of the page)

Environment Variables

*One of P8_PATH or P8_CONTENT is required.

Optional settings:

MCP Client Configuration

{
  "mcpServers": {
    "app-store-connect": {
      "command": "npx",
      "args": ["-y", "asc-mcp@latest"],
      "env": {
        "APP_STORE_CONNECT_KEY_ID": "YOUR_KEY_ID",
        "APP_STORE_CONNECT_ISSUER_ID": "YOUR_ISSUER_ID",
        "APP_STORE_CONNECT_P8_PATH": "/absolute/path/to/AuthKey.p8"
      }
    }
  }
}

{
  "mcpServers": {
    "app-store-connect": {
      "command": "npx",
      "args": ["-y", "asc-mcp@latest"],
      "env": {
        "APP_STORE_CONNECT_KEY_ID": "YOUR_KEY_ID",
        "APP_STORE_CONNECT_ISSUER_ID": "YOUR_ISSUER_ID",
        "APP_STORE_CONNECT_P8_PATH": "/absolute/path/to/AuthKey.p8"
      }
    }
  }
}

{
  "mcpServers": {
    "app-store-connect": {
      "command": "npx",
      "args": ["-y", "asc-mcp@latest"],
      "env": {
        "APP_STORE_CONNECT_KEY_ID": "YOUR_KEY_ID",
        "APP_STORE_CONNECT_ISSUER_ID": "YOUR_ISSUER_ID",
        "APP_STORE_CONNECT_P8_PATH": "/absolute/path/to/AuthKey.p8"
      }
    }
  }
}

{
  "mcpServers": {
    "app-store-connect": {
      "command": "npx",
      "args": ["-y", "asc-mcp@latest"],
      "env": {
        "APP_STORE_CONNECT_KEY_ID": "YOUR_KEY_ID",
        "APP_STORE_CONNECT_ISSUER_ID": "YOUR_ISSUER_ID",
        "APP_STORE_CONNECT_P8_CONTENT": "-----BEGIN PRIVATE KEY-----\nMIGT...your key here...AB12\n-----END PRIVATE KEY-----"
      }
    }
  }
}

Available Tools

Apps

Versions

Version Localizations

App Info Localizations

Beta Testing (TestFlight)

Screenshots

Bundle IDs

Devices

Users

Builds

Categories & Pricing

Pricing (PPP)

In-App Purchases (Lifetime / Non-Consumable)

One-time purchases via Apple's In-App Purchases v2 API. create_in_app_purchase defaults to NON_CONSUMABLE — a "lifetime" unlock. To ship one: create → add a localization → set a price → set availability → submit for review.

Note: App Review usually requires a review screenshot on the in-app purchase. Uploading IAP review screenshots is not yet covered by these tools — add one in App Store Connect if submit_in_app_purchase_for_review is rejected for a missing screenshot.

Analytics Reports

Sales & Finance

Performance & Diagnostics

Any API Operation (generic)

Subscriptions

Version Admin & App Review Details

Release & Export Compliance

App Review Submissions

App Info: Categories, Age Rating, EULA

Media: Screenshot Sets, App Previews, Review Screenshots

TestFlight Groups

TestFlight Builds & Beta Review

Customer Reviews

Subscription Offers (Introductory & Win-Back)

Subscription Offer Codes

In-App Purchase Offer Codes

Custom Product Pages

Usage Examples

List Your Apps

"Show me all my apps in App Store Connect"

Claude will use list_apps to retrieve and display your apps.

Update App Description

"Update the English description for version 2.0 of MyApp to: 'A revolutionary app that simplifies your daily tasks.'"

Claude will:

1. Find the app using list_apps
2. Get the version using list_app_versions
3. Find the English localization using list_version_localizations
4. Update it using update_version_localization

Add Japanese Localization

"Add Japanese localization to MyApp version 2.0 with description '素晴らしいアプリです' and keywords 'アプリ,便利,簡単'"

Claude will use create_version_localization with locale ja.

Add a Beta Tester

"Add [email protected] as a beta tester to the Internal Testing group for MyApp"

Claude will:

1. Find the app and beta group using list_beta_groups
2. Add the tester using add_beta_tester

Set PPP Pricing

"Show me the equivalent prices for my $9.99 tier in India, Brazil, and Turkey"

Claude will:

1. Find the $9.99 price point using list_app_price_points
2. Get equivalent prices using get_price_point_equalizations
3. Show you the PPP-adjusted prices in each territory

"Set my app to $9.99 in the US and use PPP pricing for India and Brazil"

Claude will use set_app_prices with the appropriate price point IDs for each territory.

Create a Lifetime Purchase

"Add a $99.99 lifetime unlock to MyApp with PPP pricing for India and Brazil"

Claude will:

1. Create a non-consumable IAP with create_in_app_purchase
2. Add a display name with create_in_app_purchase_localization
3. Find the $99.99 tier with list_in_app_purchase_price_points, then PPP equivalents with get_in_app_purchase_price_point_equalizations
4. Apply per-territory pricing with set_in_app_purchase_price and open availability with set_in_app_purchase_availability
5. Confirm the result with list_in_app_purchase_prices

Check Version Status

"What's the status of all versions of MyApp?"

Claude will use list_app_versions to show version states (PREPARE_FOR_SUBMISSION, IN_REVIEW, READY_FOR_SALE, etc.)

Prepare and Submit a Version

"Set the copyright of MyApp 2.1 to '2026 Example Inc.', attach build 42, add review notes, and submit it for review"

Claude will use update_app_version, set_app_version_build (only VALID builds attach), update_review_detail, then create_review_submission, add_review_submission_item, and submit_review_submission, which refuses if the submission holds anything besides the items you expect.

Anything Without a Dedicated Tool

"Turn on Game Center for MyApp's next version"

Claude will use asc_api_search to find the operation, asc_api_describe to see its body, and asc_api_request to call it.

Security

Credential Handling

• Private keys are never logged or exposed in error messages
• JWT tokens are automatically redacted from any error output
• Issuer ID is redacted from error messages and details; demo account passwords are never returned and are redacted from errors
• Read-only mode (ASC_READ_ONLY=1) blocks writes in the HTTP client itself, not just in the tool list
• Generic requests only reach relative /v1-/v3 paths on the App Store Connect host, with .., encoded, and absolute paths rejected; they must match Apple's spec unless allowUnknown is set. Demo account passwords and webhook secrets are masked in responses
• Offer code CSVs are written only to new files (savePath, owner-only permissions), never over existing ones
• Token caching minimizes key usage (15-min tokens, refreshed at 10 min)

Path Validation

• P8 file paths are validated against directory traversal attacks (.. not allowed)
• Only absolute paths are resolved

Best Practices

1. Never commit credentials - Use environment variables or a secrets manager
2. Restrict API key permissions - Use minimal required role (App Manager for most operations)
3. Rotate keys periodically - Generate new API keys and revoke old ones
4. Secure your .p8 file - Set file permissions to 600 (owner read/write only)

chmod 600 /path/to/AuthKey.p8

Troubleshooting

"Configuration error: APP_STORE_CONNECT_KEY_ID environment variable is required"

Ensure all required environment variables are set:

• APP_STORE_CONNECT_KEY_ID
• APP_STORE_CONNECT_ISSUER_ID
• APP_STORE_CONNECT_P8_PATH or APP_STORE_CONNECT_P8_CONTENT

"Failed to read private key"

1. Verify the path in APP_STORE_CONNECT_P8_PATH is correct and absolute
2. Check file permissions: ls -la /path/to/AuthKey.p8
3. Ensure the file is a valid .p8 from Apple (starts with -----BEGIN PRIVATE KEY-----)

"Authentication failed"

This usually means:

1. The API key was revoked in App Store Connect
2. The Key ID or Issuer ID doesn't match the .p8 file
3. The .p8 file is corrupted or incomplete

"Rate limit exceeded"

The server includes built-in rate limiting (50 requests/minute). If you hit Apple's limits:

1. Wait for the indicated retry time
2. Batch your operations when possible
3. The server automatically retries with exponential backoff

Tools Not Appearing in Claude

1. Verify the server is running: check Claude Desktop logs
2. Ensure the config file path is correct for your OS
3. Restart Claude Desktop after config changes

Development

Prerequisites

• Node.js 20+
• npm or pnpm

Setup

# Clone the repository
git clone https://github.com/SardorbekR/appstore-connect-mcp.git
cd appstore-connect-mcp

# Install dependencies
npm install

# Build
npm run build

# Run tests
npm test

# Lint
npm run lint

# Type check
npm run typecheck

Project Structure

src/
├── index.ts          # MCP server entry point
├── auth/
│   └── jwt.ts        # JWT token generation & caching
├── api/
│   ├── client.ts     # HTTP client with retry logic and read-only guard
│   ├── upload.ts     # Shared asset upload (reserve, upload chunks, commit, poll)
│   └── types.ts      # TypeScript interfaces
├── openapi/
│   ├── schema-index.json  # Operation index generated from spec/openapi.oas.json
│   └── index.ts           # Match, search, and describe operations
├── tools/
│   ├── index.ts      # Tool registry (toolsets, read-only filtering)
│   ├── api.tools.ts  # Generic asc_api_* tools
│   ├── apps.tools.ts
│   ├── versions.tools.ts
│   ├── localizations.tools.ts
│   ├── app-info.tools.ts
│   ├── beta.tools.ts
│   ├── screenshots.tools.ts
│   ├── bundle-ids.tools.ts
│   ├── devices.tools.ts
│   ├── users.tools.ts
│   ├── builds.tools.ts
│   ├── categories.tools.ts
│   └── ...           # One file per domain (subscriptions, release, media, ...)
└── utils/
    ├── errors.ts     # Error classes with redaction
    └── validation.ts # Zod schemas

OpenAPI Spec

spec/openapi.oas.json is Apple's App Store Connect OpenAPI spec, pinned (see spec/README.md). Tests check every request a tool sends against it.

npm run check-openapi   # fail if src/openapi/schema-index.json is stale
npm run update-openapi  # download Apple's latest spec and regenerate the index
npx tsx scripts/spec-sheet.ts "PATCH /v1/appInfos/{id}"  # print an operation's resolved shape

Running Locally

# Development mode with auto-reload
npm run dev

# Or run the built version
npm start

Releasing

Releases publish from GitHub Actions (.github/workflows/publish.yml) when a version tag is pushed. npm uses trusted publishing (OIDC, no token, provenance attached) and the MCP Registry uses GitHub OIDC.

1. Set the new version in package.json and package-lock.json (npm version X.Y.Z --no-git-tag-version), both fields in server.json, and SERVER_VERSION in src/index.ts
2. Merge to main
3. git tag vX.Y.Z && git push origin vX.Y.Z

The workflow refuses to publish if any version field differs from the tag, or if typecheck, lint, tests, or the OpenAPI index check fail.

Contributing

1. Fork the repository
2. Create a feature branch: git checkout -b feature/my-feature
3. Make your changes and add tests
4. Run npm test and npm run lint
5. Submit a pull request

Acknowledgements

The generic API tools, the OpenAPI index format, and several workflow details (review submissions, asset uploads, offer pricing) follow rorkai/App-Store-Connect-CLI (MIT).

License

MIT License - see LICENSE for details.

Links

• Security Policy
• App Store Connect API Documentation
• Model Context Protocol