M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
H

Heimdall MCP Server

Community
One tool standing watch over your entire App Store Connect account
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #108 of 438
Stars
★ 53 Popular
Transport
stdio (local process)
Runtime
Node.js >=20.19
Credentials
API key / credential required
License
MIT
Last commit
Tools
1
61FMRS · C

Heimdall generates all 875 tools from Apple's official OpenAPI spec, a coverage level rare among App Store Connect MCP servers, and uniquely adds StoreKit 2 support. Its profile system keeps token costs manageable, and confirm-before-write plus local Keychain key storage reflect a security-first design. Limitations: local stdio only, requires Node, and 2.x introduced breaking profile changes. Best for developers seriously managing App Store releases; not for those wanting an official or remotely hosted solution.

Strongest · Documentation 14/20 Weakest · Reliability 8/20

Reliability
8/20
Security and permissions
14/20
Maintenance
12/20
Documentation
14/20
Setup experience
13/20
Why each score
Reliability 8/20
The manifest and README contradict each other on total tool count: the object description says '875 tools', server.json's own description says '890 tools in 13 profiles, narrow to 27', and the README feature table says 'monetization:subscription-pricing is 24 tools instead of 204' — three different sets of numbers for what should be the same generated surface, suggesting the tool manifest and docs have drifted out of sync. No CI workflow or test files are included in the provided material to verify the MCP init/tool-list handshake or the behavior of the 875+ generated tools, so per the static calibration rule reliability is capped at 12; the actual score is further reduced for the unresolved numeric contradictions and total absence of verifiable execution evidence.
Security and permissions 14/20
The README states that write operations require confirmation by default (must explicitly set ASC_CONFIRM_WRITES=0 to disable), offers a --read-only mode, marks destructive actions, pins requests to a host, claims no telemetry, and stores the private key in the macOS Keychain rather than a plaintext config, with the private-key env var explicitly flagged isSecret — this reflects a reasonable least-privilege, secure-by-default design, and no real secrets/tokens appear in any example, so no red line is triggered. However, all of this is self-reported in the README/manifest with no source code or the actual SECURITY.md content provided to verify that the confirmation logic, host-pinning, or Keychain handling are genuinely implemented, so full marks are not warranted.
Maintenance 12/20
The project uses the MIT license, is at version 2.3.0, and the README references CHANGELOG.md, GOVERNANCE.md, CONTRIBUTING.md and SECURITY.md, and documents how the 2.0.0 breaking change was communicated — indicating some versioning discipline. The repo is not archived and has 0 open issues. But there are signs of a single maintainer (a personal donation link), no actual commit history, release cadence, or issue-response evidence is provided, and no CI/automation material is shown; star count is explicitly excluded from scoring. This nets out to moderate maintenance activity with limited supporting evidence.
Documentation 14/20
The documentation set is fairly extensive: a bilingual (English/Turkish) README linking to GUIDE, SECURITY, SUPPORT, CHANGELOG, CONTRIBUTING, CODE_OF_CONDUCT, GOVERNANCE and AGENTS docs, covering install, auth, configuration examples, safety modes, and multi-client registration. However there are clear internal inconsistencies (875 vs 890 total tools; 27/207 vs 24/204 sub-profile narrowing examples) that undercut confidence in the documentation's accuracy, and the content of the linked detailed docs itself is not provided for verification.
Setup experience 13/20
The manifest is well-structured: npm package, stdio transport, an optional positional profile argument, and explicit environment variables with required/secret flags. The README gives a single `npx -y @erayendes/asc-mcp setup` command and describes it registering profiles across multiple clients, which reads as a low-step, clear installation path in principle. But with no executable evidence (no CI, no recorded install test) to confirm the setup wizard's real-world behavior, setup is capped at 15 per the static calibration rule, and the score is further tempered by the lack of any verifiable execution record.

Static review · not runListed 2026-09-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account data

Best for

  • iOS/macOS developers and release teams needing every App Store Connect endpoint
  • Anyone working with subscriptions, IAP, StoreKit 2 transactions and refunds
  • Users who want confirm-before-write safety and local key custody
  • Teams using multiple MCP clients (Claude, Codex, Cursor) wanting one-step registration

Not for

  • Users who won't install Node locally or prefer remote HTTP servers
  • Those expecting the server itself to generate marketing/reply text (your own model writes it)
  • Anyone seeking a Fastlane replacement for scripted CI pipelines (it's positioned as the interactive complement)
  • Users looking for an official Apple tool — this project is unaffiliated with Apple

Required permissions

  • Reads App Store Connect API credentials (Key ID, Issuer ID, .p8 private key)
  • Accesses the Apple App Store Connect and App Store Server APIs
  • StoreKit 2 transaction tools need the app's Bundle ID
  • Optional write access: writes confirm by default; ASC_CONFIRM_WRITES=0 disables confirmation and --read-only removes mutating tools entirely

Risks and side effects

  • A leaked .p8 key grants signing power over your App Store account at whatever role was granted; use Keychain storage, not plain-text config
  • Write-capable tools can change prices, submit for review or delete resources; a misread instruction could still execute after confirmation
  • 2.x is a breaking release; 1.x profile names in configs may have changed
  • The full tool surface exceeds 100k tokens of definitions if profiles aren't narrowed
  • No telemetry and local-only operation means you track version updates yourself

Setup

Before you start

Runtime：Node.js >=20.19

ASC_PRIVATE_KEY optionalsecret The .p8 private key as PEM text; prefer setup (macOS Keychain), set only where no Keychain exists, e.g. CI.
Other optional settings (4)
ASC_KEY_ID optional App Store Connect API Key ID; normally written for you by the setup wizard.
ASC_ISSUER_ID optional App Store Connect Issuer ID (a UUID); normally written by setup.
ASC_PRIVATE_KEY_PATH optional Path to the .p8 file as an alternative to pasting contents; what setup records off macOS.
ASC_BUNDLE_ID optional Bundle ID of one app, only needed by the StoreKit 2 transaction tools on the monetization profile.

Run npx -y @erayendes/asc-mcp setup. The wizard asks for your API key once, stores it securely (in the macOS Keychain), and registers your chosen profiles with every MCP client on your machine — Claude, Codex, Cursor, Windsurf, VS Code. If an AI agent installs it, the agent adds profiles via register while you run setup yourself for the key. Optional environment variables: ASC_KEY_ID, ASC_ISSUER_ID, ASC_PRIVATE_KEY (secret), ASC_PRIVATE_KEY_PATH, ASC_BUNDLE_ID. Requires Node >= 20.19. Pass a profile as a positional argument (e.g. monetization or monetization:subscription-pricing) to narrow the tool surface.

claude_desktop_config.json 
{"mcpServers":{"heimdall":{"command":"npx","args":["-y","@erayendes/asc-mcp","setup"]}}}

Shown for Claude Desktop. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "heimdall": {
      "command": "npx",
      "args": [
        "-y",
        "@erayendes/asc-mcp",
        "setup"
      ]
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add heimdall -- npx -y @erayendes/asc-mcp setup

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

Run npx -y @erayendes/asc-mcp setup to register profiles, then check the client's tool list for asc__search_tools; asking "is there a tool for TestFlight builds?" and getting an answer proves the connection.

Troubleshooting

  1. Confirm setup ran and ASC_KEY_ID / ASC_ISSUER_ID / .p8 credentials are valid
  2. On macOS, check the key is in the Keychain; on CI or non-macOS use ASC_PRIVATE_KEY or ASC_PRIVATE_KEY_PATH
  3. If a tool is missing, use asc__search_tools to find its profile and register it
  4. After upgrading from 1.x with missing tools, check profile names against the changelog
  5. If writes are blocked or unconfirmed, check ASC_CONFIRM_WRITES and --read-only settings
  6. Verify Node version >= 20.19

Things to try

Once connected, you can ask your AI assistant things like:

  • Search for a tool to manage in-app events and tell me which profile it lives in.
  • Summarise this week's 1-star reviews and draft replies.
  • Which builds are stuck in review?
  • Raise this subscription's price in every territory.

Tools 1

asc__search_tools read-only
Search all tools, including ones not currently loaded, and report which profile a tool lives in

Use cases

Summarise this week's 1-star reviews and draft replies
Find which builds are stuck in review
Raise a subscription's price in every territory
Manage TestFlight builds, versions and phased releases
Inspect subscriptions, in-app purchases, transactions, refunds and finance reports

Supported clients

Claude Desktop
Claude
Codex
Cursor
Windsurf
VS Code
Antigravity

Listed from the project's documentation, not tested by this site.

Overview

Heimdall is a locally-run (stdio) MCP server for the Apple App Store Connect API and the App Store Server API (StoreKit 2). Every tool is generated from Apple's official OpenAPI specification (v4.4.1, 966 paths, 982 operations), giving 875 tools across 13 profiles and 32 sub-profiles, narrowable further (e.g. monetization:subscription-pricing is 24-27 tools instead of ~200) to save context tokens. It also offers review triage and reply drafting where your own model writes the text — no second API key required. Writes confirm before executing; --read-only, destructive-action annotations and no telemetry are supported; the .p8 key lives in the macOS Keychain, never in plain-text config. Not affiliated with Apple; MIT licensed.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 63.3k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision fd43553135dc Data synced 2026-10-19 Read the FMRS scoring method