This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+2 more
Summary
AI summaryAdded local read-only webhook receiver helpers for Apple App Store Connect.
Full changelog
Summary
v2.4.0 adds local, read-only webhook receiver helpers on top of the existing App Store Connect webhook management tools.
Added
webhooks_verify_signatureverifies Applex-apple-signatureHMAC-SHA256 values against the exact raw request body.webhooks_parse_payloadparses webhook envelopes and direct Apple event payloads, including nested event payload JSON.webhooks_triage_eventproduces severity, next steps, and recommended MCP tool calls for build, version, beta feedback, and delivery failure scenarios.
Changed
- WebhooksWorker now exposes 11 tools; the server exposes 348 tools across 36 worker domains.
- Read-only mode now explicitly allows local
*_verify,*_parse, and*_triagetools. - README, CHANGELOG, SECURITY, runtime server version, coverage matrix, and generated OpenAPI coverage report are aligned to v2.4.0.
Verification
swift buildswift build -c releasewith zerowarning:linesswift test— 498 tests passedgit diff --check
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About zelentsov-dev/asc-mcp
App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.
Related context
Related tools
Earlier breaking changes
- v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.
Beta — feedback welcome: [email protected]