zelentsov-dev/asc-mcp

v3.13.0 Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 6d MCP SaaS Integrations

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

ai-tools app-store-connect claude in-app-purchase ios macos

+6 more

mcp model-context-protocol subscriptions swift testflight xcode-cloud

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Continuation URL validation is stricter, rejecting changes to parent resource, filters, projections, cursors, or non‑canonical encodings.

Full changelog

Bind all 55 reviewed public and internal pagination scopes to their exact App Store Connect collection path and originating effective query.
Require Apple's continuation URLs to preserve every active filter, include, field projection, relationship identifier, and effective page size while adding a non-empty cursor.

Reject continuation URLs that change a parent resource, collection path, filter value, projection, include set, limit, origin, port, or URL authority before sending the continuation request.
Reject missing or blank cursors, duplicate query names, unexpected query parameters, credentials, fragments, and non-canonical path encodings across the affected workers.
Apply the same validation to internal multi-page aggregation loops so server-provided links cannot silently cross query scopes.

No public MCP tool or required input was added, removed, or renamed.
Existing valid Apple continuation URLs remain accepted; manually supplied next_url values must now match the complete originating request scope exactly.
The Apple 4.4.1 operation mapping and fully classified optional-input pin remain unchanged.

Continuation URLs must preserve every active filter, include, field projection, relationship identifier, effective page size and contain a non‑empty cursor; any change to parent resource, collection path, filter value, projection, include set, limit, origin, port, or URL authority is now rejected.
Missing or blank cursors, duplicate query names, unexpected query parameters, credentials, fragments, and non‑canonical path encodings are now rejected across all workers.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track zelentsov-dev/asc-mcp

Get notified when new releases ship.

About zelentsov-dev/asc-mcp

App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.

v3.1.0 `app_versions_set_review_details.attachment_file_id` replaced by separate `review_attachments_upload` call.
v3.1.0 Moved app-level TestFlight contact and policy metadata from `builds_set_beta_localization` to corresponding `beta_app_*_localization` tools.
v3.1.0 `builds_update_beta_detail` no longer accepts read-only fields `internal_build_state` or `external_build_state`.
v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.