@abd3lraouf/app-store-connect-mcp

MCPattested

v1.3.0io.github.abd3lraouf-studiosUnknownUpdated 1mo agonpm GitHub

App Store Connect + StoreKit 2: 1,293 Apple operations behind 11 tools, writes confirmed.

Works in

ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Attested build

A verified provenance attestation binds this artifact to the listed repository. Nobody has claimed the listing yet — this proves where the code was built, not who stands behind it.

1mo agoLast update

Needs 1 credential before it runs

ASC_KEYAPI keyrequired
keychain:<service> (recommended), or a path to your AuthKey .p8

Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.

Package

Authorio.github.abd3lraouf-studios

LicenseUnknown

Version1.3.0

Sourcenpm+mcp-registry

npm@abd3lraouf/app-store-connect-mcp

GitHubabd3lraouf-studios/app-store-connect-mcp

SBOMCycloneDX 1.6 ↓

Trust Status

A

85/100Trusted

✓Listed in Forge index+10/10

✓Identity verified · attested build+20/20

—Ed25519 publish signature+0/5

→ Included automatically when the publisher runs `forge publish`

—Domain verification+0/5

→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }

✓npm Trusted Publishing (Sigstore)+5/5

—npm maintainer match+0/5

→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)

✓CVE scan · clean+30/30

✓Static analysis · clean+20/20

Paste into Claude Code, Cursor, or any AI assistant to fix all gaps

StatusIdentity verified

PublisherUnverified

SignatureUnsigned

Domain—

Provenance✓ Sigstore-verified · 9f89f96

Dependencies✓ 60 resolved+ · none vulnerable

Tool surface19 tools · 3 privileged

Security scan✓ Cleanv1.3.0 · 1mo agoHow well does this scan work?

EvalsNone

IndexedAug 19, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

19 tools · 3 privileged

Statically extracted from the published packagev1.3.0 · 1mo ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

Filter toolsPrivileged only

asc_pricing_getRead subscription pricing across every territory for an app, with the currency resolved and

Read subscription pricing across every territory for an app, with the currency resolved and

No input schema was published for this tool.

asc_pricing_setChange a subscription price. `preserve_current_price` is required and has no default: true keeps

Change a subscription price. `preserve_current_price` is required and has no default: true keeps

No input schema was published for this tool.

asc_preflight_versionAnswer "can this version actually be submitted?" across build state, export compliance, every

Answer "can this version actually be submitted?" across build state, export compliance, every

No input schema was published for this tool.

asc_listing_screenshotsList the screenshot sets and screenshots on a version, with each asset’s delivery state. Uses

List the screenshot sets and screenshots on a version, with each asset’s delivery state. Uses

No input schema was published for this tool.

asc_upload_screenshotprivilegedUpload a screenshot image, performing Apple’s full reserve → upload → commit sequence: reserve a

Upload a screenshot image, performing Apple’s full reserve → upload → commit sequence: reserve a

No input schema was published for this tool.

asc_analytics_reportFetch an analytics report as rows. Walks request → report → instance → every segment, downloads

Fetch an analytics report as rows. Walks request → report → instance → every segment, downloads

No input schema was published for this tool.

asc_upload_iap_screenshotprivilegedUpload the App Store review screenshot for an in-app purchase, performing Apple’s reserve →

Upload the App Store review screenshot for an in-app purchase, performing Apple’s reserve →

No input schema was published for this tool.

asc_availability_setTurn an app’s App Store availability on or off, territory by territory. Apple offers no bulk

Turn an app’s App Store availability on or off, territory by territory. Apple offers no bulk

No input schema was published for this tool.

release-readinessCheck whether an app version can actually be submitted: build state, export compliance, localisations, screenshots and any open submission.

Check whether an app version can actually be submitted: build state, export compliance, localisations, screenshots and any open submission.

No input schema was published for this tool.

appBundle ID, app name, or numeric Apple ID.

Bundle ID, app name, or numeric Apple ID.

No input schema was published for this tool.

pricing-auditReview subscription pricing across territories for one app, and flag anything inconsistent or missing.

Review subscription pricing across territories for one app, and flag anything inconsistent or missing.

No input schema was published for this tool.

review-triageSummarise recent customer reviews into themes and pick out the ones worth answering.

Summarise recent customer reviews into themes and pick out the ones worth answering.

No input schema was published for this tool.

daysHow far back to look. Default 14.

How far back to look. Default 14.

No input schema was published for this tool.

testflight-statusReport which builds are with which tester groups, and what is blocked.

Report which builds are with which tester groups, and what is blocked.

No input schema was published for this tool.

asc_statusVerify credentials and report what this server can reach, including the remaining rate-limit budget.

Verify credentials and report what this server can reach, including the remaining rate-limit budget.

No input schema was published for this tool.

asc_search_endpointsNo description published

This tool published no description. Forge does not invent one.

asc_describe_endpointFull detail for one operation: every parameter, the request body schema with real field names,

Full detail for one operation: every parameter, the request body schema with real field names,

No input schema was published for this tool.

asc_callRead from Apple. Handles both APIs, path and query parameters, and pagination.

Read from Apple. Handles both APIs, path and query parameters, and pagination.

No input schema was published for this tool.

asc_writeprivilegedChange something in App Store Connect: create, update or delete.

Change something in App Store Connect: create, update or delete.

No input schema was published for this tool.

18 of 19 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

App Store Connect + StoreKit 2: 1,293 Apple operations behind 11 tools, writes confirmed.

Keywords

mcp

Alternatives

Comparing tool surfaces…

Tools exposed

19 tools · 3 privileged · observed 2026-09-01 by static extraction. A tool surface is what one scan read on one day, not a live capability list.

asc_pricing_get
asc_pricing_set
asc_preflight_version
asc_listing_screenshots
asc_upload_screenshotpriv
asc_analytics_report
asc_upload_iap_screenshotpriv
asc_availability_set
release-readiness
app
pricing-audit
review-triage
days
testflight-status
asc_status
asc_search_endpoints
asc_describe_endpoint
asc_call
asc_writepriv

Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.

Dependency tree

What one Forge scan resolved from npm metadata on 2026-09-01 — observed resolution, not a publisher declaration.

60 packages resolved · 4 direct · none carrying advisories Resolution stops at depth 4 and 60 packages.

express4.22.2+11 not drawn20 dependencies
- qs6.15.3incomplete
- depd2.0.0
- etag1.8.1
- send0.19.2incomplete
- vary1.1.2
- debug2.6.9incomplete
- fresh0.5.2
- cookie0.7.2
- accepts1.3.8incomplete
- methods1.1.2
- type-is1.6.18incomplete
- parseurl1.3.3
- statuses2.0.2
- encodeurl2.0.0
- proxy-addr2.0.7incomplete
- body-parser1.20.6incomplete
- escape-html1.0.3
- http-errors2.0.1incomplete
- on-finished2.4.1incomplete
- safe-buffer5.2.1
jsonwebtoken9.0.3+10 not drawn
@modelcontextprotocol/sdk1.30.0+17 not drawn
@apple/app-store-server-library3.1.0incomplete+5 not drawn1 dependency
- jsonwebtoken9.0.3shown above+10 not drawn

The crawl stopped at the 60-package limit. The rest of the tree was never resolved.

36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)

Declared but not resolved

107 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.

package cap reached: 107

zod-to-json-schema ^3.25.1 — required by @modelcontextprotocol/sdk@1.30.0package cap reached
@types/jsonwebtoken ^9.0.5 — required by @apple/app-store-server-library@3.1.0package cap reached
@types/jsrsasign ^10.5.12 — required by @apple/app-store-server-library@3.1.0package cap reached
@types/node ^25.4.0 — required by @apple/app-store-server-library@3.1.0package cap reached
@types/node-fetch ^2.6.13 — required by @apple/app-store-server-library@3.1.0package cap reached
base64url ^3.0.1 — required by @apple/app-store-server-library@3.1.0package cap reached
jsrsasign ^11.0.0 — required by @apple/app-store-server-library@3.1.0package cap reached
node-fetch ^2.7.0 — required by @apple/app-store-server-library@3.1.0package cap reached
side-channel ^1.1.1 — required by qs@6.15.3package cap reached
es-define-property ^1.0.1 — required by qs@6.15.3package cap reached
ms 2.1.3 — required by send@0.19.2package cap reached
depd 2.0.0 — required by send@0.19.2package cap reached

+95 more not listed. The counts by reason above cover all of them.

Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.