Appstore Connect (mgcrea) MCP Server
@mgcrea/mcp-appstore-connect
npm
v0.23.0
Source verified
Published by mgcrea — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
Model Context Protocol server for the Apple App Store Connect API
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 3 = 97. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 87
Each tool and what it can reach — statically extracted from the published source.
app_store_connect_download_analytics_report_segmentingests untrusted inputapp_store_connect_download_certificateingests untrusted inputapp_store_connect_download_finance_reportingests untrusted inputapp_store_connect_download_sales_reportingests untrusted inputapp_store_connect_get_analytics_statusingests untrusted inputapp_store_connect_get_appingests untrusted inputapp_store_connect_list_analytics_report_instancesingests untrusted inputapp_store_connect_list_analytics_report_requestsingests untrusted inputapp_store_connect_list_analytics_report_segmentsingests untrusted inputapp_store_connect_list_certificatesingests untrusted input
Show 77 more tools ↓
app_store_connect_list_live_versionsingests untrusted inputapp_store_connect_add_tester_to_groupno sensitive capabilityapp_store_connect_apply_listingno sensitive capabilityapp_store_connect_auth_statusno sensitive capabilityapp_store_connect_cancel_review_submissionno sensitive capabilityapp_store_connect_create_analytics_report_requestno sensitive capabilityapp_store_connect_create_beta_groupno sensitive capabilityapp_store_connect_create_bundle_idno sensitive capabilityapp_store_connect_create_certificateno sensitive capabilityapp_store_connect_create_iap_localizationno sensitive capabilityapp_store_connect_create_versionno sensitive capabilityapp_store_connect_delete_iap_localizationno sensitive capabilityapp_store_connect_delete_screenshotno sensitive capabilityapp_store_connect_delete_screenshot_setno sensitive capabilityapp_store_connect_disable_capabilityno sensitive capabilityapp_store_connect_enable_capabilityno sensitive capabilityapp_store_connect_export_listingno sensitive capabilityapp_store_connect_get_age_rating_declarationno sensitive capabilityapp_store_connect_get_analytics_reportno sensitive capabilityapp_store_connect_get_app_info_localizationno sensitive capabilityapp_store_connect_get_app_price_scheduleno sensitive capabilityapp_store_connect_get_app_store_review_detailno sensitive capabilityapp_store_connect_get_bundle_idno sensitive capabilityapp_store_connect_get_iap_availabilityno sensitive capabilityapp_store_connect_get_iap_price_scheduleno sensitive capabilityapp_store_connect_get_iap_review_screenshotno sensitive capabilityapp_store_connect_get_in_app_purchaseno sensitive capabilityapp_store_connect_get_screenshotno sensitive capabilityapp_store_connect_get_vendor_numberno sensitive capabilityapp_store_connect_get_versionno sensitive capabilityapp_store_connect_get_version_localizationno sensitive capabilityapp_store_connect_invite_beta_testerno sensitive capabilityapp_store_connect_list_analytics_reportsno sensitive capabilityapp_store_connect_list_app_categoriesno sensitive capabilityapp_store_connect_list_app_info_localizationsno sensitive capabilityapp_store_connect_list_app_infosno sensitive capabilityapp_store_connect_list_app_price_pointsno sensitive capabilityapp_store_connect_list_appsno sensitive capabilityapp_store_connect_list_beta_feedbackno sensitive capabilityapp_store_connect_list_beta_groupsno sensitive capabilityapp_store_connect_list_beta_testersno sensitive capabilityapp_store_connect_list_buildsno sensitive capabilityapp_store_connect_list_bundle_idsno sensitive capabilityapp_store_connect_list_customer_reviewsno sensitive capabilityapp_store_connect_list_devicesno sensitive capabilityapp_store_connect_list_iap_localizationsno sensitive capabilityapp_store_connect_list_iap_price_pointsno sensitive capabilityapp_store_connect_list_in_app_purchasesno sensitive capabilityapp_store_connect_list_review_submissionsno sensitive capabilityapp_store_connect_list_screenshot_setsno sensitive capabilityapp_store_connect_list_screenshotsno sensitive capabilityapp_store_connect_list_usersno sensitive capabilityapp_store_connect_list_version_localizationsno sensitive capabilityapp_store_connect_list_versionsno sensitive capabilityapp_store_connect_register_deviceno sensitive capabilityapp_store_connect_release_versionno sensitive capabilityapp_store_connect_remove_tester_from_groupno sensitive capabilityapp_store_connect_remove_version_from_submissionno sensitive capabilityapp_store_connect_reorder_screenshotsno sensitive capabilityapp_store_connect_revoke_certificateno sensitive capabilityapp_store_connect_set_app_categoriesno sensitive capabilityapp_store_connect_set_app_priceno sensitive capabilityapp_store_connect_set_app_store_review_detailno sensitive capabilityapp_store_connect_set_iap_availabilityno sensitive capabilityapp_store_connect_set_in_app_purchase_priceno sensitive capabilityapp_store_connect_set_version_buildno sensitive capabilityapp_store_connect_submit_in_app_purchase_for_reviewno sensitive capabilityapp_store_connect_submit_version_for_reviewno sensitive capabilityapp_store_connect_update_age_rating_declarationno sensitive capabilityapp_store_connect_update_appno sensitive capabilityapp_store_connect_update_app_info_localizationno sensitive capabilityapp_store_connect_update_iap_localizationno sensitive capabilityapp_store_connect_update_in_app_purchaseno sensitive capabilityapp_store_connect_update_versionno sensitive capabilityapp_store_connect_update_version_localizationno sensitive capabilityapp_store_connect_upload_iap_review_screenshotno sensitive capabilityapp_store_connect_upload_screenshotno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (87 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 10
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.23.0 latest |
A 97/100 | 0 | 1.13.0 | 2026-09-07 |
v0.22.4 |
A 97/100 | 0 | 1.13.0 | 2026-09-06 |
v0.22.3 |
A 97/100 | 0 | 1.13.0 | 2026-09-04 |
v0.22.2 |
A 97/100 | 0 | 1.13.0 | 2026-09-01 |
v0.22.0 |
A 97/100 | 0 | 1.13.0 | 2026-08-31 |
Show 5 more versions ↓
v0.21.0 |
A 97/100 | 0 | 1.13.0 | 2026-08-30 |
v0.20.0 |
A 97/100 | 0 | 1.13.0 | 2026-08-28 |
v0.19.0 |
A 97/100 | 0 | 1.13.0 | 2026-08-27 |
v0.18.0 |
A 97/100 | 0 | 1.12.1 | 2026-08-20 |
v0.16.0 |
A 97/100 | 0 | 1.12.1 | 2026-08-19 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @mgcrea/mcp-appstore-connect --onlineOther implementations of Appstore Connect 6
Independent packages implementing the same tool, scanned with the same engine. Compare all 7 side by side →
MCP server for Apple App Store Connect API
Code Mode MCP server for App Store Connect — 923 endpoints through 2 tools
MCP server for the Apple App Store Connect API — exposes all 1200+ operations as MCP tools. Supports local (stdio) and remote (HTTP) deployment.
Apple Store Connect MCP Server with OAuth authentication support for Claude Desktop/iOS
MCP server for interacting with App Store Connect
A Model Context Protocol (MCP) server for interacting with the App Store Connect API. This server provides tools for managing apps, beta testers, bundle IDs, devices, app metadata, and capabilities in App Store Connect.
More in Business & CRM
Free public tax reference data — GST/VAT, income, company and capital-gains tax rules for 50+ countries.
The approval gate for unattended UCP buying agents — a policy/approval MCP proxy in front of a merchant's UCP checkout endpoint.
Autotask PSA MCP server. Generic entity query/get/create/update across the full REST API plus convenience tools for tickets, companies, contacts, projects, tasks and time entries. AI-safe with readonly mode and destructive-action confirmation. stdio + opt
MCP server for B2C Commerce developer experience tools
Search, compare and contact real-world companies through a public MCP business directory.
Norwegian business register (Brønnøysundregistrene) as an MCP server — companies, roles, subunits and annual accounts, with the register's silent traps encoded as guards.