AppStore MCP Server

- Curated tools(112) for the common, multi-step, or error-prone workflows — apps & metadata, IAPs, subscriptions & offers, versions, pricing, availability, App Review submission, TestFlight, provisioning, asset uploads, promoted purchases, customer reviews, phased release, users, in-app events, Xcode Cloud, analytics reports, and custom product pages.
- Two generic escape-hatch tools—appstore_requestandappstore_list— that can callanyendpoint with raw JSON:API documents.

Downloadappstore-mcp.mcpbfrom the latest release and open it with Claude Desktop (Settings → Extensions → Install Extension…, or drag the file onto the window). It prompts for yourIssuer ID,Key ID, and.p8 key file. The bundle ships all three platforms' binaries and selects the right one automatically.

/plugin marketplace add forgeopslabs/appstore-mcp /plugin install appstore-mcp@forgeopslabs

Codex configures MCP servers directly (no marketplace). Withappstore-mcpon yourPATH:

codex mcp add appstore \ --env ASC_ISSUER_ID=... --env ASC_KEY_ID=... \ --env ASC_PRIVATE_KEY_PATH=/path/AuthKey_XXXXXX.p8 \ -- appstore-mcp

cargo build --release # -> target/release/appstore-mcp

Generate aTeam Keyin App Store Connect →Users and Access → Integrations → App Store Connect API, and download the.p8file. Then set:

The server starts even without credentials so a client can list its tools; tool calls then return an actionable configuration error until creds are set.

A hundred tool definitions cost context in every session, and a client that sees one flat list can't tell a read from a delete. Two knobs fix that:

ASC_TOOLS=core # 41 tools: generic, apps, versions, assets, testflight, submission ASC_TOOLS=testflight,provisioning # just what a build-distribution agent needs ASC_READ_ONLY=1 # 35 read-only tools; writes are withheld entirely

Groups:generic,apps,iap,subscriptions,versions,pricing,availability,submission,testflight,provisioning,assets,offers,offer-codes,promotions,reviews,users,events,xcode-cloud,analytics,custom-product-pages— plusallandcore. An unrecognised name is warned about on stderr and serves nothing rather than quietly falling back to everything.

In read-only modeappstore_requestis kept but refuses any method other thanGET, so the escape hatch still reaches endpoints without a curated tool without becoming a way around the restriction.

Every served tool advertises MCP annotations (readOnlyHint,destructiveHint,idempotentHint), which clients use to decide what needs confirming. Nine tools are marked destructive: the sevendelete_/remove_tools,expire_build,disable_bundle_id_capability, andappstore_request(which can reach anyDELETEendpoint).

Defaults are chosen so a tool call can't hang and a single response can't swamp an agent's context. All of these are optional.

Retries.A429is replayed for any method, since Apple rejected the request without applying it. A5xxor a mid-flight timeout is replayed only forGET/PATCH/PUT/DELETE— neverPOST, which could otherwise create a duplicate resource (and Apple permanently reserves identifiers like a product ID). Backoff is exponential with jitter and honoursRetry-After.

Response shaping.Results are serialized compactly — indented JSON measured 1.72× the bytes for identical content, so the same budget now carries about 40% more of the data you asked for. Per-resourceselflinks and link-only relationships are stripped: no addressable content is lost, andlinks.nextsurvives for pagination. If a response still exceeds the budget,includedis dropped first, then trailingdataitems, and the result carries a_truncatedkey saying what went missing and how to narrow the query. Note that followinglinks.nextafter a trim would skip the dropped items — re-request with a smallerlimitinstead.

cargo build --release ASC_ISSUER_ID=... ASC_KEY_ID=... ASC_PRIVATE_KEY_PATH=/path/AuthKey_XXX.p8 \ ./target/release/appstore-mcp

The server speaks MCP overstdio. Logs go tostderr; stdout is the protocol channel.

Example client config (e.g. Claude Desktop'smcpServers):

{ "mcpServers": { "appstore": { "command": "/absolute/path/to/appstore-mcp/target/release/appstore-mcp", "env": { "ASC_ISSUER_ID": "00000000-0000-0000-0000-000000000000", "ASC_KEY_ID": "ABCD123456", "ASC_PRIVATE_KEY_PATH": "/absolute/path/to/AuthKey_ABCD123456.p8" } } } }

npx @modelcontextprotocol/inspector ./target/release/appstore-mcp

- IDs are opaque.List/get first to resolve app, IAP, subscription, set, and price-point IDs, then pass them to create/update tools.
- Pricing needs a price point.Uselist_iap_price_points/list_subscription_price_pointsto get theidforset_iap_price_schedule/set_subscription_price.
- Asset uploads(upload_) take a local file path and run the full reserve → chunked upload → MD5 commit flow in one call. The file is streamed, so peak memory is one chunk rather than the size of the asset, and a chunk that fails is retried on its own. Screenshots/previews require an existingappScreenshotSet/appPreviewSet; create those with the generic tools if needed.
- Pagination.appstore_listreturns one page by default. Passmax_pages(up to 20) to followlinks.nextand merge the pages into one result —meta.hasMoretells you whether anything is left.
- Analytics data.request_analytics_report→list_analytics_reports→list_analytics_report_instances→list_analytics_report_segmentsgets you a presigned segment URL;download_analytics_segmentfetches it, gunzips it, and returns the rows as JSON. Apple can take up to 48 hours to generate the first report for a new request.
- Anything not listedis reachable viaappstore_request(raw method + path + JSON:API body) orappstore_list(paginated GET). Example:appstore_request { "method": "GET", "path": "/v1/apps/123/customerReviews" }.
- Not covered:sales/finance report endpoints return gzipped TSV (not JSON:API) and are out of scope for these tools.

cargo build --release # Credentials via env (ASC_ISSUER_ID/ASC_KEY_ID/ASC_PRIVATE_KEY_PATH) or local # appstore-connect.txt + AuthKey_.p8 in the repo root (both gitignored). python3 scripts/integration_test.py --app <APP_ID> # read-only sweep python3 scripts/integration_test.py --app <APP_ID> --write # + write lifecycle

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Clix MCP Server for assisting Clix SDK/API integrations with semantic search across Clix docs and SDK source (iOS, Android, Flutter, React Native).

One shared context layer for AI agents and humans — live API specs, DB schemas, and versioned contracts across repos so every agent and teammate works from the same source of truth.

The MCP server for Bitrix24 provides AI assistants with structured access to the Bitrix24 API. It delivers up-to-date method descriptions, parameters, and valid values, allowing assistants to work with precise data instead of guesswork. This reduces code errors and accelerates Bitrix24 integration development.

Extentos is a multi-vendor development platform for adding smart-glasses capabilities to existing iOS and Android apps. The simplest analogy is Stripe for smart glasses

An MCP server tailored for React Native–first development using Gluestack UI

Tool platform by IBM to build, test and deploy tools for any data source

One remote MCP server for 500+ production APIs — Stripe, HubSpot, Postgres, Gmail, and more. OAuth and API key auth, credential management, and a CLI.

MCP Server for PGYER platform, supports uploading, querying apps, etc.

An MCP server for interacting with the Postman API, requiring an API key.