Storebridge Mcp

io.github.IsaiahDupreePublished by GitHub account IsaiahDupreev1.0.0Updated Oct 27, 2026

Remote MCP connector for App Store + Google Play data via StoreBridge API. No auth required.

VerifiedStreamable HTTPWeb executableData & AnalyticsBusiness & Commerce

Overview

AI-generated overview

Remote MCP connector exposing Apple App Store and Google Play data — app search, details, reviews, charts, developer pages and ASO keyword/rank estimates.

What you can do
  • Search apps across the Apple App Store, Google Play or both, with price and result-count filters
  • Fetch app details, batch-resolve apps by bundle ID or ID list, and list similar or related apps
  • Read paginated app reviews and Google Play permissions and data-safety sections
  • List top charts by type and category, list store categories, and look up developer records with their published apps
  • Get autocomplete suggestions for partial queries and directional ASO keyword ideas and point-in-time keyword ranks
When to use it
Useful for app-market research, competitor and ASO analysis, review mining, chart tracking and store metadata lookups where an assistant should query live App Store and Google Play data instead of relying on memory.
Requirements
A remote streamable-HTTP endpoint; no account, OAuth or API key is needed from the caller. The connector makes its own outbound calls to an upstream StoreBridge API, and the README notes that upstream deployment currently sits behind a proxy-secret guard, so results may fail until that is resolved.
Before you install
All 13 tools are read-only and return public store metadata, but the README states the connector applies a soft per-IP rate limit (default 30 tool calls per hour) and that upstream calls are metered through a paid listing. ASO keyword and rank results are labeled as estimates, and Apple review access is capped at 500 per app per country.

Installation

In SourceWeft

  1. Open Storebridge Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.IsaiahDupree%2Fstorebridge-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "storebridge": {
      "type": "http",
      "url": "https://storebridge-mcp.vercel.app/mcp"
    }
  }
}

README

storebridge-mcp

A remote MCP (Model Context Protocol) connector for StoreBridge API — the unified Apple App Store + Google Play data API (search, app details, reviews, similar apps, charts, categories, developer portfolios, autocomplete, and a directional ASO keyword/rank suite).

Live: https://storebridge-mcp.vercel.app/mcp (Vercel project storebridge-mcp, team isaiahduprees-projects) — 13 tools, verified against real production data. Since the upstream StoreBridge deployment is metered (RapidAPI/Apify), this connector authenticates its own outbound calls with the same Apify-actor bearer (STOREBRIDGE_APIFY_BEARER) and applies a soft per-IP rate limit (STOREBRIDGE_MCP_RATE_LIMIT, default 30 tool-calls/hour, in-memory) so the free MCP tier stays a discovery channel rather than an unmetered bypass of the paid listing — see lib/ratelimit.js.

What this is, and why it's a separate connector

StoreBridge API is a plain REST API. Any HTTP client can already call it directly. This repo exists because MCP clients (Claude, ChatGPT, and other MCP-aware agents) don't consume arbitrary REST APIs — they consume MCP tools. storebridge-mcp is a thin adapter layer that:

  • Exposes each StoreBridge endpoint as a discoverable, typed MCP tool (name, description, zod input schema, annotations) that an LLM can reason about and call directly, instead of having to be taught the REST surface out-of-band.
  • Speaks the MCP streamable-HTTP transport at a single /mcp endpoint, so it can be registered as a connector in Claude, ChatGPT, or any other MCP client with one URL.
  • Does nothing else. It has no business logic of its own — every tool call is a pass-through fetch to StoreBridge, and the JSON response StoreBridge returns is handed back verbatim as the tool result.

Authentication: None (deliberate)

Unlike this org's other MCP connectors (NotesBridge, GapRadar, EtsyOps, etc.), which require OAuth because they act on a signed-in user's private Mac/shop/account data, StoreBridge's data has no per-user dimension at all — it's public app-store metadata (listings, reviews, charts, developer pages). There is nothing to gate per-caller, so this connector intentionally ships with:

  • No OAuth, no login, no bearer tokens
  • No Supabase / database
  • No billing, no plans, no usage metering
  • No demo-vs-real account split — every caller gets the same real, live data

This makes the connector dramatically simpler than the org's OAuth-based connectors: api/mcp.js builds a fresh, stateless McpServer per request and serves it with zero auth checks.

Known caveat (see below): the production StoreBridge API deployment (https://storebridge-api.vercel.app) currently sits behind a RapidAPI proxy-secret guard on /v1/* (see "Upstream auth caveat"). That's an upstream deployment/monetization detail, not a reason to add auth to this connector — it just means the upstream base URL needs to be pointed at an open deployment (or the guard needs to be relaxed / the proxy secret injected server-side) before this connector's default config serves real production traffic end-to-end.

Tool list

One tool per StoreBridge endpoint (from storebridge-api/openapi.yaml):

ToolStoreBridge endpointDescription
search_appsGET /v1/searchSearch apps on Apple App Store, Google Play, or both.
get_apps_batchGET /v1/appsResolve an Apple app by bundle id, or batch-fetch many apps by comma-separated ids.
get_appGET /v1/apps/{id}Full app details (description, version, rating histogram, screenshots, size, installs, etc).
get_app_reviewsGET /v1/apps/{id}/reviewsPaginated reviews for an app.
get_similar_appsGET /v1/apps/{id}/similar"Customers also bought" / related apps.
get_app_permissionsGET /v1/apps/{id}/permissionsGoogle Play declared permissions (Google only).
get_app_datasafetyGET /v1/apps/{id}/datasafetyGoogle Play "Data safety" section (Google only).
get_chartsGET /v1/chartsTop-chart rankings (free/paid/grossing, by category).
get_categoriesGET /v1/categoriesCategory / genre list for a store.
get_developerGET /v1/developers/{id}A developer's record plus their published apps.
autocomplete_suggestGET /v1/suggestAutocomplete completions for a partial query.
get_aso_keywordsGET /v1/aso/keywordsDirectional keyword ideas + difficulty (estimated, from live search — not panel data).
get_aso_rankGET /v1/aso/rankPoint-in-time rank of an app across up to 20 keywords (estimated).

All 13 tools are read-only and annotated { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true } — none of them write anything, and all of them reflect live, externally-changing app-store data.

(The build brief sketched ~9-10 illustrative tool names; StoreBridge's actual verified openapi.yaml surface has 13 GET endpoints, so this build maps 1:1 to all 13 rather than dropping three real ones to hit a round number.)

How it wraps storebridge-api

Each tool handler does a plain fetch(\${STOREBRIDGE_API_BASE_URL}${path}`, ...)` against the real StoreBridge REST API and returns the parsed JSON as MCP tool-result content:

js
{ content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }

Upstream HTTP errors (4xx/5xx) are caught and surfaced as a typed MCP error result via an asError helper rather than crashing the request.

STOREBRIDGE_API_BASE_URL (env var) controls the upstream base URL. It defaults to https://storebridge-api.vercel.app.

Project layout

api/mcp.js       MCP endpoint (StreamableHTTPServerTransport, stateless, no auth)api/health.js    GET /api/healthlib/tools.js     All 13 tool definitions (zod schemas + fetch-and-forward handlers)local-server.js  Plain-Node http server for local dev / smoke testing (not deployed)test/smoke.mjs   Real end-to-end smoke test (initialize, tools/list, tools/call)vercel.json      Routes /mcp -> api/mcp.js, /health -> api/health.js

There is no .well-known / OAuth-metadata surface in this repo on purpose: the 401 + WWW-Authenticate: Bearer resource_metadata=... dance and /.well-known/oauth-protected-resource / /.well-known/oauth-authorization-server endpoints in this org's other connectors exist purely to support the OAuth discovery flow. An MCP streamable-HTTP server with no auth has nothing for a client to discover or authorize — it just accepts POST requests. Skipping OAuth metadata entirely is correct here, not an oversight.

Local development

bash
npm installnpm run dev          # starts local-server.js on http://localhost:3900

Endpoints locally: POST http://localhost:3900/mcp, GET http://localhost:3900/health.

To point at a self-hosted / open StoreBridge instance instead of production (useful while the production RapidAPI guard is active — see below):

bash
STOREBRIDGE_API_BASE_URL=http://localhost:8080 npm run dev

Smoke test

bash
npm run dev &                 # terminal 1npm run smoke                 # terminal 2

test/smoke.mjs drives the running server over real HTTP/JSON-RPC and verifies:

  1. GET /health returns { ok: true, ... }
  2. initialize succeeds and reports serverInfo.name === "storebridge"
  3. tools/list returns all 13 tools with their zod-derived JSON schemas
  4. tools/call for search_apps with { term: "notes", store: "apple", limit: 3 } returns real app results fetched live (not mocked)

Upstream auth caveat (read before deploying)

While building this, I read storebridge-api's own server.js / src/guard.js: the production deployment gates every /v1/* route behind a RapidAPI proxy-secret (rapidApiGuard), and only opens up when RAPIDAPI_PROXY_SECRET is unset (self-host/dev mode). That means, as currently deployed, https://storebridge-api.vercel.app/v1/search?... returns 403 forbidden without a valid X-RapidAPI-Proxy-Secret header — it is not actually open on the live URL today, even though the data itself is public information (app-store listings) and the long-term intent (per the org's product line) is a fully public, keyless API.

This doesn't change the architecture of this connector — storebridge-mcp still has zero auth of its own, by design, because there's no per-caller state to protect. It does mean that before storebridge-mcp's default STOREBRIDGE_API_BASE_URL (the production URL) will serve real traffic end-to-end, one of the following needs to happen upstream:

  • Deploy an open (no RAPIDAPI_PROXY_SECRET) StoreBridge instance for this connector to point at, or
  • Relax the guard for a /v1/* traffic class that isn't going through RapidAPI, or
  • Have this connector inject a server-side RapidAPI proxy secret / Apify bearer on outbound requests (would need RAPIDAPI_PROXY_SECRET or APIFY_BEARER added as an env var here and forwarded as a header in lib/tools.js's callStoreBridge).

The smoke test in this repo proves the MCP protocol plumbing and tool-calling mechanics end-to-end against a real, live, self-hosted StoreBridge instance (node server.js in the storebridge-api repo with no RAPIDAPI_PROXY_SECRET set — its guard is explicitly inert in that mode) fetching real Apple App Store data — see the smoke test output in the build report for the exact live response.

Deploy

Not deployed yet (by design — verify first). Once verified:

bash
cd /Users/isaiahdupree/Software/storebridge-mcpnpx vercel --yes --prod

After deploy, the MCP connector URL to register in Claude/ChatGPT/any MCP client is:

https://<deployment-domain>/mcp

Source: README.md at commit 49685f9

Tools

13

search_apps

Search apps

Search apps on the Apple App Store, Google Play, or both. Returns matching apps with store, title, developer, icon, price, rating, category, and url. Use store="both" to fan out to both engines and merge results. Apple limit is clamped to 50; Google supports 1-250. The price filter (free/paid) only applies to Google.

ParameterslangtermrequiredlimitpricestorerequireddevicecountryfullDetail

get_apps_batch

Look up apps by bundle id or batch of ids

Resolve a single Apple app by bundleId (e.g. com.burbn.instagram), or fetch many apps at once with a comma-separated ids batch (Apple up to ~200 ids in one round-trip; Google fans out and coalesces). A batch request returns an "apps" array; a bundleId request returns a single "app". Supports store="both" for batch lookups.

ParametersidslangstorerequiredcountrybundleId

get_app

Get app details

Full details for one app: description, version, release dates, content rating, genres, screenshots, languages, rating (with histogram and current-version stats), version history, size, installs, IAP flag, privacy policy, and store-specific extras. {id} is the Apple trackId (numeric string, e.g. 6448311069) or the Google package name (e.g. com.whatsapp).

Parametersidrequiredlangstorerequiredcountry

get_app_reviews

Get app reviews

Reviews for one app. Apple reviews come from the customerreviews RSS feed and are hard-capped at 500 per app per country (50/page x pages 1-10); page>10 returns an error, and sort="rating" is not supported for Apple. Google reviews are token-paginated and effectively unbounded — pass the nextToken from a prior call's pagination to page forward.

Parametersidrequiredlangpagesortlimitstorerequiredtokencountry

get_similar_apps

Get similar apps

"Customers also bought" / related apps for one app. First-class on both stores.

Parametersidrequiredlanglimitstorerequiredcountry

get_app_permissions

Get app permissions (Google only)

Google Play declared device/data permissions for one app, grouped by permission group. Google only — passing store="apple" returns a not_supported error.

Parametersidrequiredlangstore

get_app_datasafety

Get app data safety (Google only)

Google Play "Data safety" section for one app: data shared, data collected, security practices, and privacy policy URL. Google only — passing store="apple" returns a not_supported error.

Parametersidrequiredlangstore

get_charts

Get top charts

Ranked top-chart entries (App summary plus rank) for a store. type is free/paid/grossing (Apple also supports new/newfree/newpaid). category is an Apple genre id (e.g. 6007) or a Google category constant (e.g. PRODUCTIVITY); omit for the overall chart. Google list() may return an empty array with meta.stale=true when a region is broken.

ParameterstypelimitstorerequiredcountrycategoryfullDetail

get_categories

Get categories / genres

List categories for a store. Apple returns its static 6000/7000-range genre map; Google returns its categories() constants.

Parameterslangstorerequired

get_developer

Get developer portfolio

A developer record plus their published apps. {id} is the Apple artistId (numeric) or the Google developerId string (e.g. "Google LLC").

ParametersidrequiredlanglimitstorerequiredcountryfullDetail

autocomplete_suggest

Autocomplete search suggestions

Up to 5 autocomplete completions for a partial search query. First-class on both stores.

Parameterslangtermrequiredstorerequiredcountry

get_aso_keywords

Get ASO keyword ideas (estimated)

Directional keyword ideas for a seed term, each with a difficulty score/label, traffic score, result count, and top competitors — derived from live search/suggest results, not panel data. Every result is labeled estimated:true.

Parameterslangtermrequiredstorerequiredcountry

get_aso_rank

Get ASO keyword rank (estimated, point-in-time)

Point-in-time rank of one app across up to 20 keywords (one live search per keyword, fan-out capped at 20). Every result is labeled estimated:true. This is a snapshot, not rank tracking over time.

ParameterslangappIdrequiredstorerequiredcountrykeywordsrequired

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.