
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@chrischall/app-store-connect-mcp
Advanced tools
App Store Connect MCP server for Claude — apps, TestFlight, customer reviews, sales reports, and team users
A Model Context Protocol server that connects Claude to App Store Connect, giving you natural-language access to your apps, builds, TestFlight beta groups and testers, customer reviews, sales/finance reports, and team users.
[!WARNING] AI-developed project. This codebase was entirely built and is actively maintained by Claude Code. No human has audited the implementation. Review all code and tool permissions before use.
Ask Claude things like:
.p8 file, Key ID, and Issuer ID) — admin or higher access required to createnpx -y @chrischall/app-store-connect-mcp
Add to your Claude config (.mcp.json or Claude Desktop config):
{
"mcpServers": {
"app-store-connect": {
"command": "npx",
"args": ["-y", "@chrischall/app-store-connect-mcp"],
"env": {
"APP_STORE_CONNECT_KEY_ID": "ABC1234567",
"APP_STORE_CONNECT_ISSUER_ID": "57246542-96fe-1a63-e053-0824d011072a",
"APP_STORE_CONNECT_PRIVATE_KEY_PATH": "/absolute/path/to/AuthKey_ABC1234567.p8"
}
}
}
}
git clone https://github.com/chrischall/app-store-connect-mcp.git
cd app-store-connect-mcp
npm install
npm run build
Add to Claude Desktop config:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json{
"mcpServers": {
"app-store-connect": {
"command": "node",
"args": ["/absolute/path/to/app-store-connect-mcp/dist/bundle.js"],
"env": {
"APP_STORE_CONNECT_KEY_ID": "ABC1234567",
"APP_STORE_CONNECT_ISSUER_ID": "57246542-96fe-1a63-e053-0824d011072a",
"APP_STORE_CONNECT_PRIVATE_KEY_PATH": "/absolute/path/to/AuthKey_ABC1234567.p8"
}
}
}
}
Developer is enough for read-only browsing; App Manager for TestFlight management; Admin for user invites and most write operations..p8 file (you can only download it once) and note the Key ID and Issuer ID.APP_STORE_CONNECT_PRIVATE_KEY_PATH at the saved .p8, or paste the PEM contents into APP_STORE_CONNECT_PRIVATE_KEY (newline-escaped is fine).The key signs short-lived (20-minute) ES256 JWTs on demand. No external token storage; nothing is sent to anyone but Apple.
| Tool | What it does |
|---|---|
list_apps | List apps in your account (filter by bundleId/name) |
get_app | Get a single app by ID |
list_app_store_versions | List App Store releases for an app |
get_app_infos | Age rating and store-state info for an app |
list_builds | Recent builds (newest first), filter by app/state/version |
get_build | Single build details |
list_beta_groups | TestFlight internal/external beta groups |
list_beta_testers | Beta testers, filter by app/group/email |
invite_beta_tester | Add a new tester, optionally to groups/builds |
delete_beta_tester | Remove a tester from your team |
add_testers_to_beta_group | Add existing testers to a group |
remove_testers_from_beta_group | Remove testers from a group |
submit_build_for_beta_review | Send a build for TestFlight beta review |
list_customer_reviews | App Store reviews, filter by rating/territory |
get_customer_review | Single review with developer response |
respond_to_review | Post or update a developer reply |
download_sales_report | Daily/weekly/monthly/yearly units & sales TSV |
download_finance_report | Region finance/proceeds TSV |
list_users | App Store Connect team users |
list_user_invitations | Pending team invitations |
invite_user | Invite a new team member with roles |
asc_healthcheck | Verify credentials and upstream reachability; reports failures as data, not exceptions |
| Variable | Required | Notes |
|---|---|---|
APP_STORE_CONNECT_KEY_ID | yes | 10-character Key ID (e.g. ABC1234567) |
APP_STORE_CONNECT_ISSUER_ID | yes | Team Issuer ID (UUID) |
APP_STORE_CONNECT_PRIVATE_KEY | one of | Full PEM contents of your .p8. Newline-escapes (\n) are accepted. |
APP_STORE_CONNECT_PRIVATE_KEY_PATH | one of | Absolute path to the .p8 file |
npm install
npm test # vitest run
npm run test:watch # watch mode
npm run build # tsc + esbuild bundle
npm run dev # node --env-file=.env dist/index.js
Tests mock client.request / client.requestRaw; no real App Store Connect calls are made.
MIT
FAQs
App Store Connect MCP server for Claude — apps, TestFlight, customer reviews, sales reports, and team users
The npm package @chrischall/app-store-connect-mcp receives a total of 41 weekly downloads. As such, @chrischall/app-store-connect-mcp popularity was classified as not popular.
We found that @chrischall/app-store-connect-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.