Skip to content

zelentsov-dev/asc-mcp

v3.5.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-tools app-store-connect claude in-app-purchase ios macos
+6 more
mcp model-context-protocol subscriptions swift testflight xcode-cloud

Affected surfaces

auth rbac

Summary

AI summary

Review‑attachment listing now enforces a 1‑200 page limit, returns total count, includes appStoreReviewDetailId, and rejects malformed continuation URLs.

Full changelog

[3.5.0] - 2026-07-20

Changed

  • Review-attachment reads now request a stable Apple 4.4.1 projection that includes file metadata, delivery state, and review-detail relationship linkage without returning upload operations.
  • review_attachments_get and review_attachments_list now return appStoreReviewDetailId; collection results also return Apple's paging total when available.
  • review_attachments_list now publishes a bounded 1...200 limit contract and requires non-default limits to be repeated with next_url so continuation requests preserve their original page size and projection.

Fixed

  • Reject review-attachment continuation URLs that change the parent review detail, fixed sparse-field projection, or effective page limit before making a network request.
  • Use the same safe sparse-field projection while reconciling a committed upload, avoiding unnecessary presigned upload-operation data during delivery checks.
  • Describe upload input as a generic attachment file instead of incorrectly limiting it to images.

Compatibility

  • No public MCP tool or input was added, removed, or renamed; existing review-attachment calls remain valid.
  • Clients continuing a list started with a non-default limit must pass that same limit together with Apple's returned next_url.
  • The strict contract pin records 2,154 optional Apple inputs: 724 bound, 6 internally controlled, 1,012 intentionally omitted, and 412 still queued for domain review.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track zelentsov-dev/asc-mcp

Get notified when new releases ship.

Sign up free

About zelentsov-dev/asc-mcp

App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.

All releases →

Related context

Earlier breaking changes

  • v3.1.0 `app_versions_set_review_details.attachment_file_id` replaced by separate `review_attachments_upload` call.
  • v3.1.0 Moved app-level TestFlight contact and policy metadata from `builds_set_beta_localization` to corresponding `beta_app_*_localization` tools.
  • v3.1.0 `builds_update_beta_detail` no longer accepts read-only fields `internal_build_state` or `external_build_state`.
  • v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.

Beta — feedback welcome: [email protected]