Skip to content

zelentsov-dev/asc-mcp

v4.1.2 Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-tools app-store-connect claude in-app-purchase ios macos
+6 more
mcp model-context-protocol subscriptions swift testflight xcode-cloud

Affected surfaces

auth rbac

Summary

AI summary

POST/ PATCH calls now require exact Apple operation status, exposing unknown or committed_unverified recovery state.

Full changelog

Changed

  • Tightened public input contracts across App Store metadata, TestFlight, commerce, provisioning, users, webhooks, analytics, metrics, and Xcode Cloud so documented enums, nullable values, canonical identifiers, list bounds, and relationship linkages are validated before network access.
  • App, review, accessibility, pricing, provisioning, export-compliance, TestFlight, and commerce projections now preserve sparse Apple responses, honest paging totals, current App Store Connect 4.4.1 fields, and validated resource lineage without inventing missing values.
  • POST and PATCH calls now require each Apple operation's exact success status, never replay after an ambiguous outcome, and expose machine-readable unknown or committed_unverified recovery state when completion cannot be proved.

Fixed

  • Preserve explicit JSON null separately from omission for supported Apple PATCH and create attributes, including webhook, user, provisioning, TestFlight, subscription, in-app purchase, and App Store version fields.
  • Reject mixed-type relationship ID arrays, invalid email and resource identifiers, out-of-range list controls, duplicate linkages, malformed pagination, and response identity mismatches instead of silently dropping, clamping, or accepting them.
  • Keep export-compliance build attachment on Apple's supported PATCH /v1/builds/{id} HTTP 200 contract, and retain inspection guidance for every ambiguous or unverifiable mutation.
  • Expose Xcode metrics goal keys, current App attributes, complete metadata localizations, and paging-aware review, app, provisioning, and availability totals.
  • Release automation now carries exact release IDs through draft creation, normalization, and publication, and paginates existing-release lookup to keep reruns reliable as release history grows.

Compatibility

  • The public catalog remains at 502 tools and no worker filter key, tool name, or successful response key is removed.
  • Previously accepted malformed or out-of-range inputs now fail locally; explicit null clears only attributes Apple marks nullable, while omission continues to leave update fields unchanged.
  • Clients should inspect operationCommitState, outcomeUnknown, operationCommitted, retrySafe, and inspectionRequired before retrying a failed mutation.

Breaking Changes

  • POST and PATCH calls now require each Apple operation's exact success status, never replay after an ambiguous outcome, and expose machine-readable `unknown` or `committed_unverified` recovery state when completion cannot be proved.
  • Public input contracts across multiple domains (App Store metadata, TestFlight, commerce, provisioning, users, webhooks, analytics, metrics, Xcode Cloud) are now tightly validated for enums, nullable values, identifiers, list bounds, and relationship linkages before network access.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track zelentsov-dev/asc-mcp

Get notified when new releases ship.

Sign up free

About zelentsov-dev/asc-mcp

App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.

All releases →

Related context

Earlier breaking changes

  • v3.1.0 `app_versions_set_review_details.attachment_file_id` replaced by separate `review_attachments_upload` call.
  • v3.1.0 Moved app-level TestFlight contact and policy metadata from `builds_set_beta_localization` to corresponding `beta_app_*_localization` tools.
  • v3.1.0 `builds_update_beta_detail` no longer accepts read-only fields `internal_build_state` or `external_build_state`.
  • v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.

Beta — feedback welcome: [email protected]