Skip to content

zelentsov-dev/asc-mcp

v3.10.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-tools app-store-connect claude in-app-purchase ios macos
+6 more
mcp model-context-protocol subscriptions swift testflight xcode-cloud

Affected surfaces

auth

Summary

AI summary

Fixed URL validation bugs that rejected continuation controls on Xcode Cloud list tools.

Full changelog

[3.10.0] - 2026-07-20

Changed

  • Xcode Cloud build-run build listings now expose Apple's build-number, expiration, processing-state, beta-review-state, encryption, pre-release version and platform, audience, app, beta-group, App Store version, build-ID, and multi-field sort controls; scalar and array inputs use Apple's comma-separated query encoding.
  • Product build-run listings now expose Apple's related-build filter, and both product and workflow build-run listings accept one or multiple build IDs.
  • Xcode Cloud build-run build listings now return Apple's /meta/paging/total value.
  • Bound or explicitly classified all 31 previously unclassified optional Apple inputs associated with the audited Xcode Cloud workflows: 16 bound and 15 intentionally omitted with reviewed reasons.

Fixed

  • Validate every next_url across all 16 Xcode Cloud list tools against its concrete parent path, a non-empty cursor, and the complete originating query, including filters, includes, sort order, and effective page size.
  • Reject missing or changed continuation controls, wrong parent paths, unexpected or duplicate query names, empty cursors, and duplicate boolean filter values before network access.

Compatibility

  • No public MCP tool or required input was added, removed, or renamed; this release adds 16 optional inputs across two existing tools and widens the existing workflow build filter from a scalar to scalar-or-array input.
  • Existing first-page calls remain valid. Continuation calls must preserve the complete originating query and Apple's non-empty cursor in next_url.
  • The strict contract pin records 2,154 optional Apple inputs: 788 bound, 38 internally controlled, 1,265 intentionally omitted, and 63 still queued for domain review.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track zelentsov-dev/asc-mcp

Get notified when new releases ship.

Sign up free

About zelentsov-dev/asc-mcp

App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.

All releases →

Related context

Earlier breaking changes

  • v3.1.0 `app_versions_set_review_details.attachment_file_id` replaced by separate `review_attachments_upload` call.
  • v3.1.0 Moved app-level TestFlight contact and policy metadata from `builds_set_beta_localization` to corresponding `beta_app_*_localization` tools.
  • v3.1.0 `builds_update_beta_detail` no longer accepts read-only fields `internal_build_state` or `external_build_state`.
  • v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.

Beta — feedback welcome: [email protected]