Skip to content

zelentsov-dev/asc-mcp

v3.12.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-tools app-store-connect claude in-app-purchase ios macos
+6 more
mcp model-context-protocol subscriptions swift testflight xcode-cloud

Summary

AI summary

Reject blank or whitespace-padded required identifiers before returning misleading success.

Full changelog

Changed

  • Beta App localization creates and updates preserve the same three states for all five nullable Apple feedback, marketing, privacy, tvOS privacy, and description attributes.
  • Beta submission inspection uses Apple's build relationship endpoint as a bounded fallback when neither primary linkage nor an included Build resource is available.

Fixed

  • Reject blank or whitespace-padded required identifiers and inconsistent primary, included, or fallback Build linkage before returning a misleading success.
  • Mark malformed or invalid-identity successful create responses and post-create lineage validation failures as committed, and network, HTTP 408, or 5xx outcomes as commit-unknown; all remain unsafe to retry until the submission is inspected.
  • Validate Beta App localization and review-submission continuation URLs against the concrete collection path, complete originating query, effective page size, exact query-name allowlist, and Apple's non-empty cursor.
  • Emit fallback-specific output only when the relationship endpoint was actually required, keeping the public response lineage consistent with the operation manifest.

Compatibility

  • No public MCP tool or required input was added, removed, or renamed; existing concrete update values and scalar filters remain valid.
  • Passing null to a nullable Beta App localization attribute now forwards an explicit JSON null to Apple; omitting the input continues to leave that attribute absent from the request.
  • Required identifiers with empty values or surrounding whitespace now fail locally before network access.
  • The operation manifest now maps 366 Apple operations, explicitly defers 534, and scopes out 363; the optional-input pin remains fully classified at 2,154 total with 0 unclassified.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track zelentsov-dev/asc-mcp

Get notified when new releases ship.

Sign up free

About zelentsov-dev/asc-mcp

App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.

All releases →

Related context

Earlier breaking changes

  • v3.1.0 `app_versions_set_review_details.attachment_file_id` replaced by separate `review_attachments_upload` call.
  • v3.1.0 Moved app-level TestFlight contact and policy metadata from `builds_set_beta_localization` to corresponding `beta_app_*_localization` tools.
  • v3.1.0 `builds_update_beta_detail` no longer accepts read-only fields `internal_build_state` or `external_build_state`.
  • v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.

Beta — feedback welcome: [email protected]