v2.0.0

Profiles are curated, not derived

Breaking change — every profile changed. Which tool belonged to which profile was read off the URL, so every relationship hanging off an app landed in app-info and eight of eleven profiles could not reach their own resources from an app. Membership is hand-curated in spec/profiles.csv now and generated into the code.

• 13 profiles, up from 11. New: access, app-clips, testflight.
• user-management is gone, split into four. A config still naming it starts anyway, with a single tool explaining the split.
• Every profile changed size — app-info goes from 112 tools to 57. Check your config; the tool you reached for may be in another profile now.

Sub-profiles

32 sub-profiles across five profiles. A profile narrows with a colon: take monetization at 204 tools, or monetization:subscription-pricing at 24.
Some tools belong to more than one, so reaching a single tool no longer means loading a whole profile. The setup picker unfolds a checked profile's sub-profiles under the cursor, all on, and writes the argument for you; asc__status reports which are loaded and roughly what they cost.

Any tool in the profile, on any client

asc__describe + asc__call are present from the start, so nothing depends on a client refreshing its tool list mid-session.
asc__call is read-only; writes keep their own names and their confirmation gate.
asc__load adds a sub-profile mid-session for clients that do refresh.

Setup registers with every client you have installed

setup knew one command, claude mcp add, and left the rest to the user on a machine with Codex and Cursor.

• It detects the clients on the machine and asks which to install into: Claude Code, Claude Desktop, Codex, Antigravity, Cursor, Windsurf, VS Code.
• The vendor's own command writes where one exists (claude, codex, code --add-mcp); plain JSON configs are backed up and edited. One that cannot be parsed is left untouched and reported with a block to paste. A client failing never stops the others.
• register is the same work without a terminal, for an agent installing on your behalf: asc-mcp register monetization:subscription-pricing analytics. It only adds; removing is setup's job.

Note

ChatGPT's own connectors accept only remote HTTPS servers, so Heimdall cannot appear there; it runs on your machine over stdio, which is why the private key never leaves it. The Codex entry covers the CLI, the IDE extension and the Codex side of the ChatGPT desktop app — the three share one config file.

Fixed

• A misspelled filter changed which app you were editing. filter[bundleId] was dropped silently, ran unfiltered and returned the account's first app. Both spellings are accepted now.
• The binary exited 0 with no output when invoked through a symlink.
• Tool search returned nothing for queries in any language but English, and never said why. It returns results in every language now, and an empty result explains itself.
• Tool search offered tools the server refuses to load.

Added for contributors

An agent-experience harness: a 50-intent corpus with adversarial goals run n times rather than once, a contract check across all 982 operations for unstamped risk levels and readOnly disagreeing with the HTTP method, and a live write-path probe that creates and deletes a TestFlight group on a throwaway app — the only check that exercises token to POST to Apple's answer, since every other one runs --dry-run. tests/gate.test.ts proves the write gate fires end to end over stdio rather than merely classifying correctly.

v1.3.0

Safety and usability release: every write is now schema-checked locally, previewed before confirmation, and never silently resent.

• Writes are never auto-retried into duplicates. Reads still retry on 408/429/5xx; writes retry only on 429 (rejected before processing). A write that dies without a response reports an explicit unknown outcome — "Apple may or may not have processed it, verify before resending" — instead of being resent. Retry-After HTTP-date form supported.
• Fail-closed confirmation. On clients without elicitation support, writes are now blocked with an error instead of silently proceeding; opt in explicitly with --allow-unconfirmed-writes / ASC_ALLOW_UNCONFIRMED_WRITES=1.
• Real request-body schemas. All 355 body-taking operations carry a resolved JSON Schema (attributes, relationships, enums, required fields, closed-world objects) instead of a generic "JSON:API body" hint, and every write body is validated locally — a typo'd field or wrong enum fails with a field path before anything reaches Apple.
• Impact preview, risk levels and typed confirmation. The confirmation prompt shows the operation, target ids, account, a summary of the changes and a reversibility note. Every mutating operation carries a hand-reviewed risk level (low / public / release / revenue / destructive / infrastructure / access); revenue, destructive, infrastructure and access writes require typing CONFIRM instead of ticking a box.
• --dry-run / ASC_DRY_RUN=1: mutating calls validate and return what would have been sent (method, path, body, risk) — nothing reaches Apple. For CI and agent rehearsals.
• Reviews-AI hardening: reviews travel to the model as untrusted JSON data (prompt-injection defense), statistics are computed deterministically with a previous-period trend comparison, truncation is reported honestly (fetched vs analyzed), drafts reply in the review's language, and brand voice / banned phrases / support URL come from ASC_REVIEWS_* env vars. Tools hide on clients without sampling support.
• ASC_BASE_URL points the whole server at a local fixture for testing; host-pinning follows the override.
• asc__status gains check_expirations — certificates and provisioning profiles expiring within 30 days.
• Actionable hints on 403 (role lacks permission) and 409 (resource-state lock) errors, alongside the existing 401 hint.
• GUIDE: multi-account patterns with existing mechanisms (per-server env, ASC_CONFIG_DIR).

Güvenlik ve kullanılabilirlik sürümü: her yazma artık yerelde şema kontrolünden geçiyor, onaydan önce önizleniyor ve asla sessizce yeniden gönderilmiyor.

• Yazmalar otomatik retry ile çiftlenmiyor. Okumalar 408/429/5xx'te retry olmaya devam ediyor; yazmalar yalnız 429'da (işlenmeden reddedildi). Cevapsız ölen yazma, yeniden gönderilmek yerine açık bir belirsiz-sonuç hatası veriyor — "Apple işlemiş olabilir, göndermeden önce doğrula". Retry-After HTTP-date formatı destekleniyor.
• Fail-closed onay. Elicitation desteklemeyen client'larda yazmalar artık sessizce geçmek yerine hata ile engelleniyor; açık opt-in: --allow-unconfirmed-writes / ASC_ALLOW_UNCONFIRMED_WRITES=1.
• Gerçek request-body şemaları. Body alan 355 operasyonun tamamı, genel bir "JSON:API body" ipucu yerine çözülmüş JSON Schema taşıyor (attribute'lar, ilişkiler, enum'lar, zorunlu alanlar, kapalı-dünya objeler) ve her yazma body'si yerelde doğrulanıyor — yazım hatalı alan veya yanlış enum, Apple'a hiçbir şey gitmeden field path ile düşüyor.

v1.2.0

Confirm before writes. Mutating tools — changing a price, submitting for review, deleting a resource — now ask you to approve through your client before they run, via MCP elicitation. A misread instruction can no longer execute unchecked. On by default; opt out with ASC_CONFIRM_WRITES=0 or --no-confirm. Clients without elicitation support fall back to their own per-call approval.

Docs reorganised. Community health files moved to .github/; docs/ is now just the Guide and Changelog. NOTICE folded into the README licence section. The README leads with what you can ask the server, and the AI review tools finally have a section of their own.

Full changelog: https://github.com/erayendes/app-store-connect-mcp/blob/main/docs/CHANGELOG.md

v1.1.4

First npm release carrying the lazy private-key parsing from 1.1.3 — the server boots without valid credentials, so tool discovery and introspection work before setup. Funding simplified to Buy Me a Coffee only (Patreon removed). No API changes.

Full changelog: https://github.com/erayendes/app-store-connect-mcp/blob/main/docs/CHANGELOG.md