Appstore Connect Mcp

asc-mcp

Ship an App Store release from your coding agent. An MCP server for App Store Connect: 41 tools that edit version metadata, upload screenshots, attach builds, drive TestFlight, create in-app purchases, submit and release, plus an intelligence layer that audits a version before you submit and summarizes your reviews. 6 slash-command workflows and a bundled Claude Skill. Not another API wrapper.

asc-mcp.pages.dev · npm · Pricing: 7-day free trial, then $9/month

Claude Desktop, one click: download the latest asc-mcp.mcpb and open it. Claude asks for your Issuer ID and lets you pick your .p8 with a file picker. No JSON, no restart hunt.

Everything else (Claude Code, Cursor, Windsurf, Cline), one command:

npx @pofky/asc-mcp init --write   # finds your .p8, asks for your Issuer ID, writes your MCP config

Then ask your agent: "start my asc-mcp trial, my email is you@example.com". All 41 tools unlock for 7 days, no card and nothing to cancel, and the trial activates in the session you are already in, so whatever you were blocked on works on the very next call. After that Pro is $9 a month. Six tools stay free, and three of those need nothing but Node.

No context switching. No portal. Just ask.

What Makes This Different

Maintained successor to JoshuaRileyDev/app-store-connect-mcp-server (archived Feb 2026). Different angle, same API surface plus more.

Other ASC MCP servers wrap the API and give you 80 to 982 raw endpoints. This one gives you 41 opinionated tools, 6 slash-command Prompts, and a Claude Skill that all think. The read tools summarize and audit; the Pro control tools actually drive App Store Connect, from editing metadata to submitting and releasing, with the same API key. Two tools use MCP Sampling: your own client's model does the LLM work, so there is no extra cost from this server.

Why full control is possible without fastlane: fastlane's deliver and pilot are just calls to the same App Store Connect REST API this server authenticates against with your .p8. So nearly everything you would script with fastlane is a tool here, no Ruby toolchain required. The only step that needs your Mac is building and signing the binary, which build_and_archive and upload_binary drive via Xcode.

Setup (3 minutes)

Step 1. Create an API key in App Store Connect > Integrations > App Store Connect API (Admin or App Manager role), then grab three things from that same page:

• Issuer ID (ASC_ISSUER_ID): the UUID shown at the top of the page, with a copy button next to it.
• Key ID (ASC_KEY_ID): the 10-character ID next to your key, also in the filename AuthKey_XXXXXXXXXX.p8.
• .p8 file (ASC_PRIVATE_KEY_PATH): click Download and point this at the saved file. Apple lets you download it only once, so keep it safe.

Step 2. Install:

npm install -g @pofky/asc-mcp

No global install needed if you prefer npx (see the manual config below).

Fastest setup (recommended). Drop your .p8 into Apple's standard path ~/.appstoreconnect/private_keys/ (the file is named AuthKey_XXXXXXXXXX.p8, and the Key ID is in the filename). Then run:

npx @pofky/asc-mcp init --write     # auto-detects the key, asks for your Issuer ID, and writes the config for you
# or: npx @pofky/asc-mcp init       # same, but prints the block to paste yourself

init --write finds your Claude Desktop / Claude Code config, backs it up, and merges in the server block, so there's no JSON editing. The server also auto-discovers the .p8 path at runtime, so you only ever need ASC_ISSUER_ID (and ASC_LICENSE_KEY for Pro).

Running it from an agent, or any pipe. There is no terminal to answer questions in, so pass what would have been asked:

npx @pofky/asc-mcp init --write --issuer <your-issuer-uuid>   # add --config <path> if you keep several client configs

It prints the paste-ready block either way, and it never invents a value: if the Issuer ID is missing it says so instead of writing a config that fails at Apple's auth. --key-path, --key-id and --license are there for the same reason, and every one of them also reads from the matching ASC_* environment variable.

Stuck? Run npx @pofky/asc-mcp doctor (or ask your agent to call asc_setup_check). It checks your key, Issuer ID, a live connection to App Store Connect, and your license, and prints the exact fix for anything wrong. In your agent, the /asc-start command walks a first-time user through all of this.

Manual setup. Add to your agent's MCP config (Claude Desktop config, or ~/.claude.json for Claude Code). Use npx for zero-install, or asc-mcp if you installed globally:

{
  "mcpServers": {
    "appstore-connect": {
      "command": "npx",
      "args": ["-y", "@pofky/asc-mcp"],
      "env": {
        "ASC_ISSUER_ID": "YOUR_ISSUER_ID"
      }
    }
  }
}

With the .p8 in ~/.appstoreconnect/private_keys/, ASC_ISSUER_ID is the only required env var (Key ID and key path are auto-detected). Add ASC_LICENSE_KEY to unlock Pro.

Step 3. Ask your agent: "List my App Store Connect apps"

Step 4, to try the paid half. Ask your agent: "start my asc-mcp trial, my email is you@example.com". It calls asc_start_trial, which unlocks all 41 tools for 7 days with no card and nothing to cancel. The key activates in the running session, so whatever you were blocked on works on the very next call, and it is written into your MCP config so it survives a restart. One trial per Apple developer account.

Works with Claude Code, Cursor, Windsurf, Cline, and any MCP-compatible client.

Tools

Free (no signup, no license key)

Pro (free 7-day trial, then $9/month)

Control & Ship (Pro)

These tools write to App Store Connect. Every outward-facing action (submit, release, upload binary) requires an explicit confirm: true, so nothing leaves your machine by accident.

The whole flow chains: setup_app_store_signing to build_and_archive to upload_binary to wait_for_build (blocks until VALID) to attach_build to update_version_metadata to upload_screenshots to set_app_metadata/set_app_price/set_app_availability/set_age_rating/set_review_contact to release_preflight to submit_for_review to release_version. The /asc-ship-release slash command drives it for you.

release_preflight is the single source of truth for "is this submittable": it checks every API-addressable field and ends with a tailored "Manual steps to finish" list for the few things Apple only allows in the website (first-IAP bundling, App Privacy nutrition labels, EU trader status).

Get Pro | Retrieve your license key

What stays manual (and why)

A handful of things Apple does not expose to API keys. The MCP never pretends otherwise: it either returns the exact website steps plus a deep link, or detects the case and aborts so nothing is half-done. Full detail in LIMITATIONS.md (and asc_guide topic:limitations):

• Create an app record / App Group. POST /v1/apps is forbidden for API keys; do it once in the website.
• App Privacy nutrition label. Not in the API. set_privacy_nutrition returns the checklist plus a deep link.
• EU DSA trader status. Not in the API. set_eu_trader_status returns the steps. Legal decision.
• An app's first IAPs/subscriptions. Must be submitted with the version in the website; submit_for_review aborts rather than orphan the version. Later products submit via the API.
• Certificate creation / cloud signing. Least-privilege keys can't; setup_app_store_signing uses manual-signing profiles instead.
• Compiling the binary. Needs Xcode on your Mac (build_and_archive runs it locally).
• Posting a public review reply. draft_review_response writes it; you paste it in the website.

How Sampling works (zero extra cost)

triage_reviews and draft_review_response use the MCP Sampling primitive. When you call one of these tools, this server sends a sampling/createMessage request back to your own MCP client. Your client runs the LLM locally (Claude Desktop uses your account; Claude Code uses its session). We never call Anthropic from our side.

Outcome: review clustering and reply drafting cost you exactly what you would pay for any other Claude request, not a penny more from this server.

If your MCP client does not support Sampling yet, both tools return a structured degraded: true result with a clear explanation. Upgrade Claude Desktop or Claude Code to a recent version for full functionality.

Slash Commands (Prompts)

Type these in Claude Desktop or Claude Code and the agent runs a pre-built multi-tool workflow:

These are MCP Prompts per the spec. Zero other App Store Connect MCP ships with them.

Claude Skill (one-line install)

After installing the MCP, run:

npx @pofky/asc-mcp install-skill

This copies a small asc-review-triage Skill to ~/.claude/skills/ so Claude automatically picks up review-related questions ("any bad reviews lately?", "what do my users say?", "ratings this week?") and calls the right ASC tools without you having to explain the workflow each time.

Works on macOS, Linux, and Windows. To remove: npx @pofky/asc-mcp uninstall-skill.

Real Output Examples

"Run a preflight check before I submit"

Release Preflight: v2.3

State: PREPARE_FOR_SUBMISSION
Platform: IOS

PASS (with 1 warning)

Warnings (recommended):
- Missing screenshot set for APP_IPHONE_67. May be required.

Passing checks: 4
- [en-US] Description OK (3874/4000 chars).
- [en-US] Keywords OK (96/100 chars).
- 2 screenshot set(s) found across 1 locale(s).
- Build 40 attached and valid.

Total: 4 pass, 1 warn, 0 fail

"Morning briefing"

Daily Briefing - 2026-04-13

2 apps in your account

Tempo: Habit Builder
- Latest: v2.3 (IOS) - Waiting for Review
- Action needed: v2.3 is Waiting for Review
- Reviews (last 3d): 5 new, avg 4.2 stars

NightOwl Weather
- Latest: v1.1 (IOS) - Live
- No new reviews in the last 3 days

"Generate release notes from git"

Git History for Release Notes

Since: v2.2.0
Commits: 8
Character limit: 4000 chars for "What's New"

New Features (3)
- feat: add habit streak calendar view
- feat: dark mode support
- add widget for home screen

Bug Fixes (2)
- fix: notification timing off by 1 hour
- fix: crash on iPad when rotating

Instructions: Write user-facing "What's New" text.
Lead with the most impactful change. Keep under 4000 chars.

Why This One Over the Free Alternatives?

Raw wrappers give you endpoints. This gives you answers.

Security

Your credentials never leave your machine:

• The .p8 private key is read locally. JWT tokens are generated on your computer.
• API calls go directly from your machine to api.appstoreconnect.apple.com.
• The license server sees only your license key string. Zero Apple data, zero credentials.
• Fully open source. Read the code.

Works With

• Claude Code (Anthropic)
• Cursor
• Windsurf
• Cline
• Any client supporting the Model Context Protocol

Requirements

• Node.js 18+
• Apple Developer Program membership
• App Store Connect API key (Admin or App Manager role)

Legal

• Privacy Policy
• Terms of Service

This project is not affiliated with, endorsed by, or sponsored by Apple Inc. Apple, App Store, App Store Connect, TestFlight, iOS, and macOS are trademarks of Apple Inc.

License

MIT