How to Connect Claude Code to App Store Connect via MCP

Short answer

We found no official Apple App Store Connect MCP server as of November 1, 2026, so you need a third-party one. Create a low-privilege API key, keep the .p8 file outside your repo, add a server with claude mcp add, and start read-only. Good starting points are mgcrea/mcp-appstore-connect or idoo/app-store-connect-mcp, which hide write tools by default, though both are young.

OpenASO publishes this guide and has its own MCP server, which covers rankings rather than your listing. We read each project’s README and repo facts below, but we have not run or audited these servers.

Is there an official Apple MCP server?

Not that we can find, and we are fairly confident, not certain. Apple’s GitHub organization, its App Store Connect release notes, the API 4.5.1 notes, and web searches turned up nothing from Apple. Apple could ship one at any time, so check again.

Apple does provide an MCP server in Xcode, added with claude mcp add --transport stdio xcode -- xcrun mcpbridge. It covers your project and Xcode capabilities, such as building. That page doesn’t cover App Store Connect.

Which MCP server should you use?

Pick by how a server handles writes, then by maintenance. Stars show interest, not safety. All facts were checked November 1, 2026.

Skip JoshuaRileyDev/app-store-connect-mcp-server. It has the most stars of the MCP servers we found, at 330, but it is archived. You may not need MCP at all: Claude Code can run rorkai/App-Store-Connect-CLI (8,187 stars) like any command, though its README says usage telemetry is on by default.

How do you create an App Store Connect API key?

Follow Apple’s API key guide:

1. The Account Holder requests API access once, under Users and Access, then Integrations. Apple reviews requests case by case.
2. An Admin or Account Holder generates a team key there. Users with permission can generate an individual key in their profile.
3. Choose the role. You can’t edit a team key’s access later, so a change means a new key.
4. Download the .p8 file and note the Key ID and Issuer ID.

The private key downloads a single time, and “Apple doesn’t keep a copy” (Apple). If it’s lost or exposed, revoke it. Revoked keys can’t be reinstated.

Which role should the key have?

Use the smallest role that does the job. Apple says key roles match user roles, so this table follows its role list. Test it on your own account, since a server may need more.

Apple lists no read-only role, so a read-only server still holds a key that could write. Avoid Admin, which Apple says can create and delete users.

Team keys reach all your apps, while individual keys carry one user’s app access, though they can’t reach sales and finance data. Apple also supports a JWT scope claim that limits a token to named requests, but the server has to set it.

How do you add the server to Claude Code?

Use claude mcp add, as Anthropic’s docs describe. This example combines that syntax with the variables in mgcrea’s README. We have not run it:

claude mcp add \
  --env APP_STORE_CONNECT_KEY_ID=XXXXXXXXXX \
  --env APP_STORE_CONNECT_ISSUER_ID=your-issuer-id \
  --env APP_STORE_CONNECT_P8_PATH=/absolute/path/AuthKey_XXXXXXXXXX.p8 \
  --transport stdio appstore-connect -- npx -y @mgcrea/mcp-appstore-connect

Keep --transport before the name, because the docs warn that --env can otherwise swallow it. Run claude mcp list to confirm the connection, and pin a package version so an update can’t change what runs with your key.

What are the risks of write access?

An agent with write tools can change a live listing, reply publicly to customers, or submit a build by mistake. Customer reviews also reach the model as text, so a stranger’s words can steer it, a threat idoo’s safety notes list first. Anthropic’s docs also warn about prompt injection from servers that fetch outside content.

Keep writes off until you need them, and review every change in App Store Connect.

How do you keep the key out of git?

• Store the .p8 outside any repo, such as ~/.appstoreconnect/private_keys/, and run chmod 600 on it.
• Add *.p8 and .env to .gitignore.
• Use the default local scope, which stores config in ~/.claude.json. Project scope writes .mcp.json, which is meant for git, so use ${APP_STORE_CONNECT_KEY_ID}-style references there.
• Point servers at a file path, and never paste key contents into chat.

What about Apple Ads MCP servers?

They need separate credentials, and the older API has a deadline. Apple says its Campaign Management API will be sunset on January 26, 2027, in favour of the Apple Ads Platform API.

Unless they are updated, the two v5 servers should stop working at the sunset. mgcrea/mcp-apple-ads says it targets the Platform API with writes off by default, but it has 0 stars.

Where do keyword rankings come from?

From a separate source. App Store Connect holds your listing, and these servers manage it rather than track daily keyword ranks. OpenASO’s MCP server fills that gap on a Mac with rankings, Apple Ads popularity, reviews, and competitors. With saved credentials it can also read your metadata and compare drafts, but it cannot publish them. It has no Windows or Google Play support and no bundled AI model.

Next, create a limited key, connect one server, and ask Claude to list your apps. If you want rankings alongside it, follow the OpenASO MCP setup.