App Store Connect MCP Server

Give Claude your App Store Connect account without giving it the keys to your pricing. An MCP server covering the App Store Connect API and the App Store Server API (StoreKit 2) — 1,293 operations behind 13 tools, for Claude Code, Claude Desktop, Cursor and anything else that speaks Model Context Protocol.

1,293 operations · 13 tools · key never on disk · Apple signatures verified

flowchart LR
    A["Claude<br/>Cursor · any MCP client"] -->|"search · call · write"| B["app-store-connect-mcp<br/>13 tools"]
    B --> C{"risk tier"}
    C -->|"READ · 811 ops"| D["Apple<br/>App Store Connect API"]
    C -->|"WRITE · 482 ops"| E["ask a human first"]
    E -->|approved| D
    E -->|declined| F["nothing is sent"]
    B --> G["App Store Server API<br/>StoreKit 2 · signatures verified"]

    style E fill:#ffe8b3,stroke:#c98a00,color:#000
    style F fill:#ffd6d6,stroke:#c00,color:#000
    style D fill:#d6f5d6,stroke:#2a2,color:#000
    style G fill:#d6f5d6,stroke:#2a2,color:#000

Don't install this

Genuinely. There are cheaper ways to spend your afternoon, and several kinds of person should close the tab now:

You want an agent that just does things. This one stops and asks before it changes a price, deletes anything, or touches who can access your account — and it asks you, not itself. If that sounds like friction, it is. That is the product.

You want every endpoint as its own tool. Some servers register 890. Yours would spend six figures of context on tool definitions before answering a single question. This registers 11 and finds the rest by searching.

tool definitions loaded into context, before you ask anything

  one tool per endpoint   ███████████████████████████████████   >100k tokens
  this server             ▌                                       ~1k tokens

You're on Windows or Linux and wanted Keychain. Keychain storage is macOS only. You can use a file path elsewhere, but the best part of this is macOS-shaped.

You want it to write your App Store copy. It will fetch your reviews and your localisations. It will not invent marketing prose and push it live, and there is no flag to make it.

You're evaluating this for a product you sell. Read the licence first. Internal use is free; reselling it isn't.

Still here? Then the rest is probably for you.

What it refuses to do

Most of the engineering here went into restraint, so it is the honest place to start.

It won't run generated code. The elegant way to cover a huge API is to let the model write JavaScript and eval it in a sandbox. Node's vm is not a sandbox — its own documentation says so — and any host object handed in leaks the whole realm back through its prototype chain:

spec.constructor.constructor('return process.env.HOME')()   // → /Users/you

That is a reproduction of a real shipping MCP server's sandbox, and it returns your home directory. Its 15-second timeout doesn't help either: it bounds only synchronous code, so an async loop runs forever. This server dispatches parameters, not code. Same coverage, same token cost, nothing to escape.

It won't let a write pretend to be a read. Reads and writes are separate tools. asc_write carries _meta["anthropic/requiresUserInteraction"], which Claude Code honours even under bypassPermissions. The model cannot talk its way past it; only the operator can, by starting the server with --no-confirm — which drops the flag, the prompt and the token together, for runs where nobody is present to answer.

It won't decide your pricing intent for you. preserve_current_price is a required parameter with no default. Apple defaults it to false — meaning your existing subscribers get moved to the new price. Making it required forces that decision into the open, where a person can see it.

It won't create ongoing commitments to answer a question. Fetching analytics needs a report request, and accessType: ONGOING is a standing obligation on your account, not a query. The tool reads reports; it will not create one silently.

It won't pretend it sanitised your reviews. Customer review text is written by strangers and lands in your model's context verbatim. Results carrying it lead with a note saying it is data to report on, not instructions to follow. It is deliberately not filtered for injection phrases — that is a game attackers iterate against, and passing such a filter would imply a safety it cannot deliver.

It won't tell you a signature is fine when it hasn't checked. See below.

Install

Claude Code, one line:

claude mcp add --scope user app-store-connect \
  --env ASC_KEY=keychain:my-asc-key \
  --env ASC_BUNDLE_ID=com.example.app \
  --env ASC_APP_APPLE_ID=1234567890 \
  -- npx -y @abd3lraouf/app-store-connect-mcp

Nothing to clone or build. Or from source, if you'd rather read it first:

git clone https://github.com/abd3lraouf-studios/app-store-connect-mcp
cd app-store-connect-mcp && npm install && npm run build

Or, for Claude Desktop, Cursor and friends:

{
  "mcpServers": {
    "app-store-connect": {
      "command": "npx",
      "args": ["-y", "@abd3lraouf/app-store-connect-mcp"],
      "env": {
        "ASC_KEY": "keychain:my-asc-key",
        "ASC_BUNDLE_ID": "com.example.app",
        "ASC_APP_APPLE_ID": "1234567890"
      }
    }
  }
}

Then ask it "check the App Store Connect connection" — that runs asc_status, which verifies your credentials with one lightweight request and tells you exactly what is missing if anything is.

Your key belongs in the Keychain

Apple lets you download a .p8 exactly once. A plaintext copy on disk is a copy that can leak.

ASC_KEY=keychain:my-asc-key          # recommended
ASC_KEY=/path/to/AuthKey.p8          # works, but plaintext
ASC_PRIVATE_KEY='-----BEGIN…'        # discouraged: ps -E exposes it

Store it as base64 JSON so the identifiers travel with the key material — ASC_KEY_ID then cannot drift out of sync with the key it names, a mismatch that surfaces only as an opaque 401:

security add-generic-password -s my-asc-key -a api -w "$(
  jq -nc --arg i "$ISSUER" --arg k "$KEYID" --arg p "$(cat AuthKey.p8)" \
    '{issuerID:$i,keyID:$k,privateKeyPEM:$p}' | base64
)"

The thirteen tools

Five core, covering everything:

Eight composite, for chains the raw API cannot express in a single call. A tool that merely saved one request was left out — it would need keeping in step with Apple forever and buys nothing asc_call doesn't already do: