M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
COMPARE UP TO 4 SERVERS

Compare MCP servers

Compare scores, permissions, risks, and fit in one decision-focused table.

DimensionHeimdall MCP ServerOne tool standing watch over your entire App Store Connect accountGitHub MCP ServerGitHub's official MCP server for managing repos, issues, PRs, and workflows via natural language
FMRS61 / 100 · C76 / 100 · B
Reliability8 / 2013 / 20
Security and permissions14 / 2014 / 20
Maintenance12 / 2018 / 20
Documentation14 / 2017 / 20
Setup experience13 / 2014 / 20
Best for
  • iOS/macOS developers and release teams needing every App Store Connect endpoint
  • Anyone working with subscriptions, IAP, StoreKit 2 transactions and refunds
  • Users who want confirm-before-write safety and local key custody
  • Teams using multiple MCP clients (Claude, Codex, Cursor) wanting one-step registration
  • Teams that want an AI assistant to directly operate on GitHub repos and collaboration workflows
  • Users already in the GitHub Copilot ecosystem who want a zero-deployment remote option
Not for
  • Users who won't install Node locally or prefer remote HTTP servers
  • Those expecting the server itself to generate marketing/reply text (your own model writes it)
  • Anyone seeking a Fastlane replacement for scripted CI pipelines (it's positioned as the interactive complement)
  • Users looking for an official Apple tool — this project is unaffiliated with Apple
  • Scenarios where you don't want the assistant to have write access to repos (enable only read-only toolsets)
  • Environments with strict network isolation for private repos that can't reach the official remote endpoint
Required permissions
  • Reads App Store Connect API credentials (Key ID, Issuer ID, .p8 private key)
  • Accesses the Apple App Store Connect and App Store Server APIs
  • StoreKit 2 transaction tools need the app's Bundle ID
  • Optional write access: writes confirm by default; ASC_CONFIRM_WRITES=0 disables confirmation and --read-only removes mutating tools entirely
  • A personal access token (PAT) or OAuth App token; effective scope depends on the token's own permissions
  • Enabling toolsets like actions/issues/pull_requests grants write access — request tokens on a least-privilege basis
Risks and side effects
  • A leaked .p8 key grants signing power over your App Store account at whatever role was granted; use Keychain storage, not plain-text config
  • Write-capable tools can change prices, submit for review or delete resources; a misread instruction could still execute after confirmation
  • 2.x is a breaking release; 1.x profile names in configs may have changed
  • The full tool surface exceeds 100k tokens of definitions if profiles aren't narrowed
  • No telemetry and local-only operation means you track version updates yourself
  • Write toolsets (creating/merging PRs, triggering workflows) can cause accidental changes if the token is overscoped — try a read-only toolset first
  • In hosted mode, credentials travel via the Authorization header — make sure the client-to-api.githubcopilot.com connection is trusted
Supported clientsClaude Desktop, Claude, Codex, Cursor, Windsurf, VS Code, AntigravityClaude Desktop, Claude Code, VS Code, Cursor, Windsurf, JetBrains IDEs, Zed, Amp
Tools115