Appstore Connect Mcp

asc-mcp

Ship an App Store release from your coding agent. An MCP server for App Store Connect: 41 tools that edit version metadata, upload screenshots, attach builds, drive TestFlight, create in-app purchases, submit and release, plus an intelligence layer that audits a version before you submit and summarizes your reviews. 6 slash-command workflows and a bundled Claude Skill. Not another API wrapper.

asc-mcp.pages.dev · npm · Pricing: 7-day free trial, then $9/month, VAT included (sales tax added in the US, Canada and India)

In plain words

You made a toy and you want it in a giant toy store, the App Store. The store has a strict office. Before your toy reaches the shelf, you fill out lots of forms, add pictures, set a price, and wait for a helper to check it all. Forget one thing and they say "no, try again", and days are gone.

asc-mcp is a helper robot for that office. It talks to your AI assistant, so you just say what you want:

• "How is my toy doing?" It tells you whether the store said yes or no, and with Pro, what people wrote about your toy.
• "Is my toy ready?" It checks your forms first, like a teacher reading your homework before you hand it in: "You forgot a picture, and this link is broken."
• "Fix it for me." It fills in forms, adds pictures and sets prices. Before a big move, like changing a price or handing your toy to the store, it stops and asks: are you sure?

Checking whether the store said yes or no is free, with no time limit. Everything else works free for 7 days, no card, then it's $9 a month, VAT included, with sales tax added in the US, Canada and India. The robot checks your homework, and the store still decides.

For the grown-ups: the toy is your app, the office is App Store Connect, and the robot is an MCP server running on your own computer.

Claude Desktop, one click: download the latest asc-mcp.mcpb and open it. Claude asks for your Issuer ID and lets you pick your .p8 with a file picker. No JSON, no restart hunt.

Everything else (Claude Code, Cursor, Windsurf, Cline), one command:

npx @pofky/asc-mcp init --write   # finds your .p8, asks for your Issuer ID, writes your MCP config

Then ask your agent: "start my asc-mcp trial, my email is [email protected]". All 41 tools unlock for 7 days, no card and nothing to cancel, and the trial activates in the session you are already in, so whatever you were blocked on works on the very next call. After that Pro is $9 a month (VAT included; in the US, Canada and India sales tax is added at checkout). Six tools stay free, and two of those (the setup check and the playbook) need nothing but Node. The Pro tools that only read (reviews, sales, builds, TestFlight groups, preflight, briefing, keywords, competitors, metadata diff, release notes) also work 5 times in total on your machine with no license, as a preview.

No context switching. No portal. Just ask.

What Makes This Different

Maintained successor to JoshuaRileyDev/app-store-connect-mcp-server (archived Feb 2026). Different angle, same API surface plus more.

Other ASC MCP servers wrap the API and give you 80 to 982 raw endpoints. This one gives you 41 opinionated tools, 6 slash-command Prompts, and a Claude Skill that all think. The read tools summarize and audit; the Pro control tools actually drive App Store Connect, from editing metadata to submitting and releasing, with the same API key. Two tools use MCP Sampling: your own client's model does the LLM work, so there is no extra cost from this server.

Why full control is possible without fastlane: fastlane's deliver and pilot are just calls to the same App Store Connect REST API this server authenticates against with your .p8. So nearly everything you would script with fastlane is a tool here, no Ruby toolchain required. The only step that needs your Mac is building and signing the binary, which build_and_archive and upload_binary drive via Xcode.

Setup (3 minutes)

Step 1. Create an API key in App Store Connect > Integrations > App Store Connect API (Admin or App Manager role), then grab three things from that same page:

• Issuer ID (ASC_ISSUER_ID): the UUID shown at the top of the page, with a copy button next to it.
• Key ID (ASC_KEY_ID): the 10-character ID next to your key, also in the filename AuthKey_XXXXXXXXXX.p8.
• .p8 file (ASC_PRIVATE_KEY_PATH): click Download and point this at the saved file. Apple lets you download it only once, so keep it safe.

Step 2. Install:

npm install -g @pofky/asc-mcp

No global install needed if you prefer npx (see the manual config below).

Fastest setup (recommended). Drop your .p8 into Apple's standard path ~/.appstoreconnect/private_keys/ (the file is named AuthKey_XXXXXXXXXX.p8, and the Key ID is in the filename). Then run:

npx @pofky/asc-mcp init --write     # auto-detects the key, asks for your Issuer ID, and writes the config for you# or: npx @pofky/asc-mcp init       # same, but prints the block to paste yourself

init --write finds your Claude Desktop / Claude Code config, backs it up, and merges in the server block, so there's no JSON editing. The server also auto-discovers the .p8 path at runtime, so you only ever need ASC_ISSUER_ID (and ASC_LICENSE_KEY for Pro).

As a Claude Code plugin. One line installs the server and the review-triage skill together, and Claude Code asks for your Issuer ID when it enables the plugin:

/plugin install asc-mcp --marketplace pofky/asc-mcp

The plugin lives in plugin/, and its README says what it runs and sends.

Running it from an agent, or any pipe. There is no terminal to answer questions in, so pass what would have been asked:

npx @pofky/asc-mcp init --write --issuer <your-issuer-uuid>   # add --config <path> if you keep several client configs

It prints the paste-ready block either way, and it never invents a value: if the Issuer ID is missing it says so instead of writing a config that fails at Apple's auth. --key-path, --key-id and --license are there for the same reason, and every one of them also reads from the matching ASC_* environment variable.

Stuck? Run npx @pofky/asc-mcp doctor (or ask your agent to call asc_setup_check). It checks your key, Issuer ID, a live connection to App Store Connect, and your license, and prints the exact fix for anything wrong. In your agent, the /asc-start command walks a first-time user through all of this.

Manual setup. Add to your agent's MCP config (Claude Desktop config, or ~/.claude.json for Claude Code). Use npx for zero-install, or asc-mcp if you installed globally:

{  "mcpServers": {    "appstore-connect": {      "command": "npx",      "args": ["-y", "@pofky/asc-mcp"],      "env": {        "ASC_ISSUER_ID": "YOUR_ISSUER_ID"      }    }  }}

With the .p8 in ~/.appstoreconnect/private_keys/, ASC_ISSUER_ID is the only required env var (Key ID and key path are auto-detected). Add ASC_LICENSE_KEY to unlock Pro.

Step 3. Ask your agent: "List my App Store Connect apps"

Step 4, to try the paid half. Ask your agent: "start my asc-mcp trial, my email is [email protected]". It calls asc_start_trial, which unlocks all 41 tools for 7 days with no card and nothing to cancel. The key activates in the running session, so whatever you were blocked on works on the very next call, and it is saved on your machine, in ~/.asc-mcp/license.json and in any MCP client config that already has an asc-mcp entry, so it survives a restart. One trial per Apple developer account.

Works with Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible client.

Tools

Free (no signup, no license key)

Pro (free 7-day trial, then $9/month)

$9 per month, VAT included; in the US, Canada and India sales tax is added at checkout, before you pay. Cancel any time.

Control & Ship (Pro)

These tools write to App Store Connect. Every outward-facing action (submit, release, upload binary) requires an explicit confirm: true, so nothing leaves your machine by accident.

The whole flow chains: setup_app_store_signing to build_and_archive to upload_binary to wait_for_build (blocks until VALID) to attach_build to update_version_metadata to upload_screenshots to set_app_metadata/set_app_price/set_app_availability/set_age_rating/set_review_contact to release_preflight to submit_for_review to release_version. The /asc-ship-release slash command drives it for you.

release_preflight is the check to run before you submit: it reads every API-addressable field, loads the support, privacy and terms links in the record, and with project_path checks privacy manifests, required-reason APIs, listed SDKs and purpose strings on your machine. Every rule ends in PASS, WARN, FAIL or UNKNOWN, and any UNKNOWN withholds the clean verdict. Project files are checked only with project_path, and the verdict says when they were not. It ends with the manual steps for the few things Apple only allows in the website (first-IAP bundling, App Privacy nutrition labels, EU trader status). It is not a prediction of App Review's decision.

Get Pro | Retrieve your license key

What stays manual (and why)

A handful of things Apple does not expose to API keys. The MCP never pretends otherwise: it either returns the exact website steps plus a deep link, or detects the case and aborts so nothing is half-done. Full detail in LIMITATIONS.md (and asc_guide topic:limitations):

• Create an app record / App Group. POST /v1/apps is forbidden for API keys; do it once in the website.
• App Privacy nutrition label. Not in the API (/v1/appDataUsages still 404s, re-probed 2026-10-31). set_privacy_nutrition returns the checklist plus a deep link, and release_preflight with project_path lists the data types your manifests declare to check it against.
• EU DSA trader status. Not in the API. set_eu_trader_status returns the steps. Legal decision.
• An app's first IAPs/subscriptions. Must be submitted with the version in the website; submit_for_review aborts rather than orphan the version. Later products submit via the API.
• Certificate creation / cloud signing. Least-privilege keys can't; setup_app_store_signing uses manual-signing profiles instead.
• Compiling the binary. Needs Xcode on your Mac (build_and_archive runs it locally).
• Posting a public review reply. draft_review_response writes it; you paste it in the website.

How Sampling works (zero extra cost)

triage_reviews and draft_review_response use the MCP Sampling primitive. When you call one of these tools, this server sends a sampling/createMessage request back to your own MCP client. Your client runs the LLM locally (Claude Desktop uses your account; Claude Code uses its session). We never call Anthropic from our side.

Outcome: review clustering and reply drafting cost you exactly what you would pay for any other Claude request, not a penny more from this server.

If your MCP client does not support Sampling yet, both tools return a structured degraded: true result with a clear explanation. Upgrade Claude Desktop or Claude Code to a recent version for full functionality.

Slash Commands (Prompts)

Type these in Claude Desktop or Claude Code and the agent runs a pre-built multi-tool workflow:

These are MCP Prompts per the spec. Zero other App Store Connect MCP ships with them.

Claude Skill (one-line install)

After installing the MCP, run:

npx @pofky/asc-mcp install-skill

This copies a small asc-review-triage Skill to ~/.claude/skills/ so Claude automatically picks up review-related questions ("any bad reviews lately?", "what do my users say?", "ratings this week?") and calls the right ASC tools without you having to explain the workflow each time.

Works on macOS, Linux, and Windows. To remove: npx @pofky/asc-mcp uninstall-skill.

Real Output Examples

"Run a preflight check before I submit" (real output, on one of our own unfinished apps, shortened)

## Release Preflight: Adaptale
BLOCKED: 13 failures
Auditing v1.0 (iOS), state PREPARE_FOR_SUBMISSION
### Failures
FAIL  shots.required  [en-US]Saw:  This app runs on iPad, going by the build's iPad icon, and there is no APP_IPAD_PRO_3GEN_129 set with images.Rule: required device sizes (Screenshot specifications, verified 2026-10-31)Fix:  upload_screenshots
FAIL  build.attachedSaw:  Build 1 has expired. Upload a new one.Rule: Guideline 2.1(a), final versions (App Review Guidelines, verified 2026-10-31)Fix:  attach_build
FAIL  app.priceSaw:  No price has been set, not even free.Rule: price schedule (App information reference, verified 2026-10-31)Fix:  set_app_price price_usd (0 for free)

Fix what it names, re-run, and the clean line reads: NO BLOCKING ISSUES FOUND: 32 rules checked. This is not a prediction of App Review's decision.

"Morning briefing"

Daily Briefing - 2026-04-13
2 apps in your account
Tempo: Habit Builder- Latest: v2.3 (IOS) - Waiting for Review- Action needed: v2.3 is Waiting for Review- Reviews (last 3d): 5 new, avg 4.2 stars
NightOwl Weather- Latest: v1.1 (IOS) - Live- No new reviews in the last 3 days

"Generate release notes from git"

Git History for Release Notes
Since: v2.2.0Commits: 8Character limit: 4000 chars for "What's New"
New Features (3)- feat: add habit streak calendar view- feat: dark mode support- add widget for home screen
Bug Fixes (2)- fix: notification timing off by 1 hour- fix: crash on iPad when rotating
Instructions: Write user-facing "What's New" text.Lead with the most impactful change. Keep under 4000 chars.

Why This One Over the Free Alternatives?

Raw wrappers give you endpoints. This gives you answers.

Security

Your .p8 private key never leaves your machine:

• The .p8 private key is read locally. JWT tokens are generated on your computer, and name your Key ID and Issuer ID to Apple, as Apple's API requires.
• API calls go directly from your machine to api.appstoreconnect.apple.com.
• The license server is sent your license key string when one is set and, if you start a trial, your email address, a one-way hash of your Issuer ID and the name of the tool you started from. No Apple data and no credentials.
• release_preflight requests the support, marketing and privacy policy addresses in your own App Store Connect record and any link in your description that looks like Terms of Use, following their redirects, from your machine with no key or token, and never one that resolves to a private network. If you pass project_path it reads that folder (on a Mac, nm and plutil on a built app there), writes nothing and runs nothing from the project; its reply carries paths, line numbers and setting names, not file contents.
• ~/.asc-mcp/preview.json holds one number, how many of the 5 free preview calls have been used on this machine. It is never sent anywhere.
• Starting a trial saves the license key in plain text in ~/.asc-mcp/license.json (owner-only permissions on macOS and Linux) and adds it as ASC_LICENSE_KEY to every asc-mcp entry found in your Claude Desktop, Claude Code (~/.claude.json, including per-project entries), ./.mcp.json, Cursor, Windsurf and Cline configs. Nothing else in those files is changed, and each edited file gets a one-time .bak copy beside it, which holds whatever the file held. ~/.asc-mcp/last-verdict.json holds the last license check and a hash of the key. Delete the file and the ASC_LICENSE_KEY lines to remove the key.
• Fully open source. Read the code.

Works With

• Claude Code (Anthropic)
• Cursor
• Windsurf
• Cline
• Any client supporting the Model Context Protocol

Requirements

• Node.js 18+
• Apple Developer Program membership
• App Store Connect API key (Admin or App Manager role)

Legal

• Privacy Policy
• What the server sends, and to whom: the short version
• Terms of Service

This project is not affiliated with, endorsed by, or sponsored by Apple Inc. Apple, App Store, App Store Connect, TestFlight, Xcode, iOS, and macOS are trademarks of Apple Inc.

License

MIT