# asc-mcp MCP server for Apple's App Store Connect API - manage iOS, macOS, tvOS, and visionOS apps with AI - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 2.0.3 - **Author:** SardorbekR - **License:** MIT - **npm:** asc-mcp - **Source:** https://github.com/SardorbekR/appstore-connect-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-10-21T13:44:00.456Z - **Version scanned:** 2.0.4 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `create_analytics_report_request` — Create a new analytics report request for an app. Use ONGOING for continuous reports or ONE_TIME_SNAPSHOT for a single snapshot. Reports take time to generate a - `list_analytics_report_requests` — List all analytics report requests for an app. Shows whether each request is active or stopped due to inactivity. - `get_analytics_report_request` — Get details of a specific analytics report request. - `delete_analytics_report_request` — Delete an analytics report request. This stops report generation and removes access to existing reports. - `list_analytics_reports` — List analytics reports available for a report request. Can filter by category (APP_STORE_ENGAGEMENT, COMMERCE, APP_USAGE, FRAMEWORKS_USAGE, PERFORMANCE). - `list_analytics_report_instances` — List report instances (dated snapshots) for an analytics report. Each instance represents data for a specific processing date. Can filter by granularity (DAILY, - `list_analytics_report_segments` — List downloadable segments for a report instance. Each segment contains a URL for downloading the report data, along with its checksum and size. - `download_analytics_report_segment` — Download and parse an analytics report segment from its pre-signed URL. The segment data is gzip-compressed TSV. Returns parsed headers and rows (as key-value o - `asc_api_request` — HTTP method (default GET) - `asc_api_search` — Search the App Store Connect API operation index by keywords (matches paths, operation IDs, resource types), e.g. 'phased release', 'customer reviews', 'offer c - `asc_api_describe` — Describe one App Store Connect API operation: query parameters with allowed values, body attributes (types, enums, required), relationships, and a minimal body - `get_app_info_categories` — Get the primary and secondary App Store categories and subcategories of an app info record. Unset slots are null. - `set_app_categories` — Set or clear App Store categories and subcategories on an app info record. Only the slots provided are changed (at least one); pass null to clear a slot, e.g. r - `list_app_subcategories` — List the subcategories of an App Store category, for example the subcategories of GAMES. - `get_age_rating_declaration` — Get the age rating questionnaire answers for an app info record. - `update_age_rating_declaration` — Update age rating questionnaire answers. Only the attributes provided are changed; socialMedia cannot be true while userGeneratedContent is false. - `create_app_info_localization` — Create an app info localization (name, subtitle, privacy links) for a locale. The name is required. - `delete_app_info_localization` — Delete an app info localization. - `get_eula` — Get the custom end user license agreement for an app. Returns null when the app has none. - `create_eula` — Create a custom end user license agreement for an app, applied to the given territories (e.g. USA, GBR). - `update_eula` — Update an app's custom EULA text and/or territories. Only the fields provided are changed; territories replaces the current list. - `delete_eula` — Delete an app's custom end user license agreement. - `list_app_infos` — List app info records for an app. Use this to get the appInfoId needed for localization operations. - `list_app_info_localizations` — List all localizations for an app info. Returns app name, subtitle, and privacy policy info for each locale. - `update_app_info_localization` — Update an app info localization. Use this to change app name, subtitle, or privacy policy URL for a locale. - `list_apps` — List all apps in your App Store Connect account. Returns app IDs, names, bundle IDs, and SKUs. - `get_app` — Get detailed information about a specific app by its ID. - `list_beta_groups` — List all beta groups for an app. Returns group names, public link info, and settings. - `list_beta_testers` — List all beta testers in a specific beta group. - `add_beta_tester` — Add a new beta tester to a beta group by email address. - `remove_beta_tester` — Remove a beta tester from a beta group. - `list_builds` — List all builds for an app. - `get_build` — Get details of a specific build. - `list_bundle_ids` — List all bundle IDs registered in App Store Connect. Can filter by platform. - `get_bundle_id` — Get details of a specific bundle ID. - `create_bundle_id` — Register a new bundle ID in App Store Connect. The identifier must be unique and follow reverse-domain notation (e.g., com.example.app). - `update_bundle_id` — Update a bundle ID's name. Note: The identifier cannot be changed. - `delete_bundle_id` — Delete a bundle ID. Note: This cannot be undone and may affect apps using this bundle ID. - `list_app_categories` — List all app categories available in the App Store. Can filter by platform. - `get_app_price_schedule` — Get the price schedule for an app, including pricing information. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"asc\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"asc-mcp\"\n ]\n }\n }\n}" ``` ## Blast radius Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on your machine. - Floor 40, ceiling 64 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/asc-mcp - Install plan: https://forgeregistry.com/api/v1/packages/asc-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/asc-mcp - HTML page: https://forgeregistry.com/registry/asc-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.