zelentsov-dev/asc-mcp

v4.0.0 Breaking

This release includes 3 breaking changes for platform teams planning a safe upgrade.

Published 6d MCP SaaS Integrations

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-tools app-store-connect claude in-app-purchase ios macos

+6 more

mcp model-context-protocol subscriptions swift testflight xcode-cloud

Affected surfaces

breaking_upgrade

Summary

AI summary

Updates Highlights, Contract coverage, and Verification across a mixed release.

Full changelog

Highlights

Adds 18 App Store Connect tools across app search keywords, Custom Product Pages, Product Page Optimization, promoted purchases, screenshots, and app previews. The public catalog now contains 490 tools without removing or renaming an existing tool or worker filter.
Hardens Marketing and review-attachment pagination, parent lineage, response identity, mutation status, upload snapshot, checksum, and recovery validation against App Store Connect API 4.4.1.
Keeps ambiguous non-idempotent writes unsafe to retry until the exact resource is inspected, and redacts credential-bearing upload URLs while preserving safe recovery identifiers.

Breaking changes

This major release adds exact confirmation parameters to destructive Marketing and review-attachment operations. Existing callers must provide the matching documented confirm parameter, including confirm_page_id, confirm_experiment_id, confirm_promoted_purchase_id, confirm_attachment_id, confirm_set_id, confirm_screenshot_id, or confirm_preview_id as applicable.

PPO experiment state changes also require confirm_experiment_id. Unknown top-level arguments in the affected Marketing and review-attachment tools are now rejected locally instead of being ignored.

Contract coverage

464 Apple operations mapped, 436 explicitly deferred, and 363 scoped out: all 1,263 pinned Apple 4.4.1 operations are accounted for without overlap.
2,756 optional inputs classified: 1,041 public, 40 internal, 1,675 intentionally omitted, and 0 unclassified.
Optional-input identity SHA-256: d23f48816b9bc0b19933ae9f65cf4d737918730b1247f8949a802007055bd4a2.

Verification

Debug and release builds passed with the release-warning gate enabled.
Strict OpenAPI coverage, generated coverage, operation-manifest, annotated-tag, and release-contract gates passed.
1,651 tests in 130 suites passed on develop, main, and the v4.0.0 tag.

See CHANGELOG.md for the complete tool-by-tool migration guidance.

Breaking Changes

Destructive Marketing and review‑attachment operations now require exact confirmation parameters (e.g., confirm_page_id, confirm_experiment_id, confirm_promoted_purchase_id, confirm_attachment_id, confirm_set_id, confirm_screenshot_id, confirm_preview_id).
Unknown top‑level arguments in affected Marketing and review‑attachment tools are rejected locally instead of being ignored.
PPO experiment state changes require confirm_experiment_id.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track zelentsov-dev/asc-mcp

Get notified when new releases ship.

About zelentsov-dev/asc-mcp

App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.

All releases →

Related context

Related tools

Earlier breaking changes

v3.1.0 `app_versions_set_review_details.attachment_file_id` replaced by separate `review_attachments_upload` call.
v3.1.0 Moved app-level TestFlight contact and policy metadata from `builds_set_beta_localization` to corresponding `beta_app_*_localization` tools.
v3.1.0 `builds_update_beta_detail` no longer accepts read-only fields `internal_build_state` or `external_build_state`.
v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.