This release includes breaking changes for platform teams planning a safe upgrade.
Published 6d
MCP SaaS Integrations
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
ai-tools
app-store-connect
claude
in-app-purchase
ios
macos
+6 more
mcp
model-context-protocol
subscriptions
swift
testflight
xcode-cloud
Summary
AI summaryReject blank or whitespace-padded required identifiers before returning misleading success.
Full changelog
Changed
- Beta App localization creates and updates preserve the same three states for all five nullable Apple feedback, marketing, privacy, tvOS privacy, and description attributes.
- Beta submission inspection uses Apple's build relationship endpoint as a bounded fallback when neither primary linkage nor an included Build resource is available.
Fixed
- Reject blank or whitespace-padded required identifiers and inconsistent primary, included, or fallback Build linkage before returning a misleading success.
- Mark malformed or invalid-identity successful create responses and post-create lineage validation failures as committed, and network, HTTP 408, or 5xx outcomes as commit-unknown; all remain unsafe to retry until the submission is inspected.
- Validate Beta App localization and review-submission continuation URLs against the concrete collection path, complete originating query, effective page size, exact query-name allowlist, and Apple's non-empty cursor.
- Emit fallback-specific output only when the relationship endpoint was actually required, keeping the public response lineage consistent with the operation manifest.
Compatibility
- No public MCP tool or required input was added, removed, or renamed; existing concrete update values and scalar filters remain valid.
- Passing null to a nullable Beta App localization attribute now forwards an explicit JSON null to Apple; omitting the input continues to leave that attribute absent from the request.
- Required identifiers with empty values or surrounding whitespace now fail locally before network access.
- The operation manifest now maps 366 Apple operations, explicitly defers 534, and scopes out 363; the optional-input pin remains fully classified at 2,154 total with 0 unclassified.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About zelentsov-dev/asc-mcp
App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.
Related context
Related tools
Earlier breaking changes
- v3.1.0 `app_versions_set_review_details.attachment_file_id` replaced by separate `review_attachments_upload` call.
- v3.1.0 Moved app-level TestFlight contact and policy metadata from `builds_set_beta_localization` to corresponding `beta_app_*_localization` tools.
- v3.1.0 `builds_update_beta_detail` no longer accepts read-only fields `internal_build_state` or `external_build_state`.
- v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.
Beta — feedback welcome: [email protected]