# app-store-connect-mcp [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/chrischall/app-store-connect-mcp  
**GitHub Stars:** 1  
**npm Downloads (last month):** 1380  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/app-store-connect-mcp-2

## Description
App Store Connect MCP: apps, TestFlight, reviews, sales reports, and team users.

## Tools
Capabilities this server exposes over MCP:

- **list_apps** — List apps in your account (filter by bundleId/name)
- **get_app** — Get a single app by ID
- **list_app_store_versions** — List App Store releases for an app
- **get_app_infos** — Age rating and store-state info for an app
- **list_builds** — Recent builds (newest first), filter by app/state/version
- **get_build** — Single build details
- **list_beta_groups** — TestFlight internal/external beta groups
- **list_beta_testers** — Beta testers, filter by app/group/email
- **invite_beta_tester** — Add a new tester, optionally to groups/builds
- **delete_beta_tester** — Remove a tester from your team
- **add_testers_to_beta_group** — Add existing testers to a group
- **remove_testers_from_beta_group** — Remove testers from a group
- **submit_build_for_beta_review** — Send a build for TestFlight beta review
- **list_customer_reviews** — App Store reviews, filter by rating/territory
- **get_customer_review** — Single review with developer response
- **respond_to_review** — Post or update a developer reply
- **download_sales_report** — Daily/weekly/monthly/yearly units & sales TSV
- **download_finance_report** — Region finance/proceeds TSV; `Total_*` trailer lines in a separate `summary
- **list_users** — App Store Connect team users
- **list_user_invitations** — Pending team invitations
- **invite_user** — Invite a new team member with roles; app visibility is explicit (`allAppsVisible: true` or a non-empty `visibleAppIds`, no all-apps default)
- **asc_healthcheck** — Verify credentials and upstream reachability; reports failures as data, not exceptions

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "app-store-connect-mcp": {
    "command": "npx",
    "args": ["-y","@chrischall/app-store-connect-mcp"],
    "env": {
      "APP_STORE_CONNECT_KEY_ID": "",
      "APP_STORE_CONNECT_ISSUER_ID": "",
      "APP_STORE_CONNECT_PRIVATE_KEY": "",
      "APP_STORE_CONNECT_PRIVATE_KEY_PATH": ""
    }
  }
}
```

**Requires environment variables:** `APP_STORE_CONNECT_KEY_ID`, `APP_STORE_CONNECT_ISSUER_ID`, `APP_STORE_CONNECT_PRIVATE_KEY`, `APP_STORE_CONNECT_PRIVATE_KEY_PATH` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What app-store-connect-mcp does

app-store-connect-mcp exposes App Store Connect operations as Model Context Protocol tools. It covers app discovery, release metadata, build status, TestFlight groups and testers, customer reviews, sales and finance reports, and team users. Agents can use it to answer questions such as which builds are available, who belongs to a beta group, how an app is rated in a territory, or which team invitations remain pending.

The server also supports selected write operations. It can invite or remove TestFlight testers, modify beta-group membership, submit builds for beta review, publish review responses, and invite team members with explicit role and app-visibility settings.

## How it works

The server runs as a local MCP process, commonly through `npx` or a built Node.js bundle. It uses an App Store Connect API key consisting of a Key ID, Issuer ID, and `.p8` private key. The private key can be loaded from a file or supplied as PEM content. Short-lived ES256 JWTs are generated when requests are made, without external token storage.

Before performing a write, the server uses a confirmation flow. Clients with confirmation-prompt support can display the exact request. Other clients receive a preview containing the method, path, request body, and a single-use confirmation token; the operation proceeds only after a matching follow-up call. Confirmation behavior can be adjusted with environment variables.

## Setup and configuration

Node.js 22 or later is required. Install with the npm package through `npx`, or clone the repository, run `npm install`, build it, and point an MCP client at the generated bundle. Claude Desktop and Claude Code are documented client options.

Set these authentication variables:

- `APP_STORE_CONNECT_KEY_ID`
- `APP_STORE_CONNECT_ISSUER_ID`
- Either `APP_STORE_CONNECT_PRIVATE_KEY_PATH` or `APP_STORE_CONNECT_PRIVATE_KEY`

The API key must have permissions appropriate to the requested operations. Developer access is described as sufficient for read-only browsing, while App Manager access covers TestFlight management and Admin access is used for user invitations and many write operations. A `.p8` file can only be downloaded once from App Store Connect, so it should be stored securely.

Optional confirmation controls include `MCP_CONFIRM_MODE`, `MCP_CONFIRM_ELICITATION`, `MCP_CONFIRM_TTL_SECONDS`, and `MCP_CONFIRM_SECRET`. The latter is useful when confirmation tokens need to remain valid across a process restart.

## Tools and capabilities

App and build inspection includes `list_apps`, `get_app`, `list_app_store_versions`, `get_app_infos`, `list_builds`, and `get_build`. Build and app lists support filters such as bundle ID, name, state, or version where applicable.

TestFlight operations include listing beta groups and testers, inviting and deleting testers, changing group membership, and submitting a build for beta review. Review tools list or retrieve customer reviews and post or update developer responses, with rating and territory filtering available when listing reviews.

Reporting tools download sales data by day, week, month, or year and retrieve regional finance and proceeds data in TSV form. Team administration includes listing users, viewing pending invitations, and inviting users with roles and explicit app visibility. `asc_healthcheck` checks credentials and upstream reachability while returning failures as data.

## Limitations and notes

Write access depends on the App Store Connect role assigned to the API key. Every write operation is confirmation-gated, including tester changes, beta-review submissions, review responses, and team invitations.

The project states that its code was produced and maintained by Claude Code and has not received a human audit. Review the implementation and requested tool permissions before using it with production App Store Connect accounts. Tests mock request methods rather than making live App Store Connect calls.

_Full upstream README: https://allmcps.com/mcp/app-store-connect-mcp-2/readme_