Heimdall — App Store Connect MCP

Manage your entire App Store Connect account from your AI client: apps and metadata, versions and phased releases, TestFlight, subscriptions and in-app purchases, pricing, reviews, Game Center, Xcode Cloud, provisioning, webhooks, and sales and finance reports.

Heimdall is an MCP server for the App Store Connect API and the App Store Server API (StoreKit 2), with every tool generated from Apple's own OpenAPI specification. That makes its coverage complete by construction — 982 operations across 17 domains — and it is what sets Heimdall apart: where other servers wrap a hand-picked slice of the API, Heimdall gives you all of it, and lets you add or drop tools whenever you like.

Named after the watchman who sees across every realm and guards the gateway. The npm package (@erayendes/asc-mcp) and the command (asc-mcp) keep their names; Heimdall is the project.

Why it's different

Most App Store Connect MCP servers wrap a hand-picked subset of endpoints. That works until you need the one endpoint nobody wrapped. Heimdall takes the opposite approach:

• Complete: Generated from Apple's OpenAPI spec v4.4.1 — all 966 paths, 982 operations. Not a curated subset.

• Currenr: npm run spec:update && npm run generate picks up Apple's changes as a reviewable diff.

• Scoped: 11 purpose-built profiles plus a --domains flag. Load only what a project needs, so large tool sets don't overwhelm your client.

• StoreKit 2: Includes the App Store Server API (customer transactions, entitlements, refunds) — rare among ASC MCP servers

• Safe: --read-only mode, destructive-action annotations, host-pinned requests, no telemetry.

• Self-describing: Ask the server what it can do — asc__discover_domains and asc__search_tools answer, and point you to a tool even when it isn't loaded.

• Client-agnostic: Standard MCP over stdio — works with Claude Code, Claude Desktop, Codex, Antigravity, Cursor and any other MCP client.

• Private by default: On macOS the .p8 key lives in the Keychain, never in plain-text config.

Profiles

• app-info: Names, bundle IDs, availability, encryption declarations

• distribution: App Store versions, review submissions, phased releases, uploaded builds

• user-management: TestFlight beta distribution, team members, sandbox test accounts

• monetization: Subscriptions, in-app purchases, offers, pricing, StoreKit 2 transactions

• marketing: Screenshots, previews, custom product pages, in-app events, customer reviews

• analytics: Sales and finance reports, analytics requests, performance metrics

• game-center: Achievements, leaderboards, matchmaking, challenges

• xcode-cloud: Workflows, build runs, artifacts, source control

• provisioning: Bundle IDs, certificates, devices, provisioning profiles

• background-assets: Asset packs downloaded outside the app binary

• webhooks: Webhooks pushing App Store Connect events to your endpoint

Loading the right tools

The full 982-operation surface would cost well over 100k tokens of tool definitions — more than most context windows can spare. So a profile loads only its own area, and the combined server loads a default working set for everyday release work. The 123 deprecated operations stay out unless you pass --include-deprecated.