@orellbuehler/testflight-mcp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Orell Bühler
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,202 @@
+# testflight-mcp
+
+[![npm](https://img.shields.io/npm/v/@orellbuehler/testflight-mcp.svg)](https://www.npmjs.com/package/@orellbuehler/testflight-mcp)
+[![CI](https://github.com/OrellBuehler/testflight-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/OrellBuehler/testflight-mcp/actions/workflows/ci.yml)
+[![node](https://img.shields.io/node/v/@orellbuehler/testflight-mcp.svg)](https://nodejs.org)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
+
+MCP server for **TestFlight** and **App Store Connect** that exposes the
+[App Store Connect API](https://developer.apple.com/documentation/appstoreconnectapi) as tools for AI
+agents.
+
+Its focus is **TestFlight beta feedback retrieval** — pulling the screenshot feedback (with the
+tester's comment), crash feedback and crash logs your testers submit — plus the surrounding context
+an agent needs to make sense of it: apps, builds, beta testers/groups, analytics & sales reports,
+provisioning, and App Store metadata. It talks **only to the official, documented API** using a
+standard App Store Connect API key (ES256 JWT), and is **read-only**.
+
+> It deliberately does **not** scrape App Store Connect with your Apple ID / password (no headless
+> browser, no internal `iris` API) and does **not** send email to testers. Some third-party
+> TestFlight servers do; this one stays on the supported API.
+
+## Install
+
+The package is published as
+[`@orellbuehler/testflight-mcp`](https://www.npmjs.com/package/@orellbuehler/testflight-mcp) and runs
+directly with `npx` — no clone or build needed:
+
+```bash
+claude mcp add testflight \
+  --env ASC_KEY_ID=ABCD123456 \
+  --env ASC_ISSUER_ID=12a3b456-7890-1234-5678-9abcdef01234 \
+  --env ASC_PRIVATE_KEY_PATH=/path/to/AuthKey_ABCD123456.p8 \
+  -- npx -y @orellbuehler/testflight-mcp
+```
+
+For any other MCP client, run the package directly — `npx -y @orellbuehler/testflight-mcp` with the
+env vars below set. Requires Node.js 20+.
+
+## Getting an API key
+
+The server authenticates with an **App Store Connect API key** (a `.p8` file plus a key ID and issuer
+ID), the same credentials `fastlane`/`altool` use:
+
+1. In [App Store Connect](https://appstoreconnect.apple.com), go to **Users and Access →
+   Integrations → App Store Connect API** (Team Keys).
+2. **Generate** a key. A role of **App Manager** (or **Admin**) covers TestFlight feedback; **Finance**
+   is additionally required for sales/finance reports.
+3. Download the `AuthKey_XXXXXXXXXX.p8` (you can only download it once — keep it safe), and note the
+   **Key ID** and the team **Issuer ID** shown above the keys table.
+
+Provide the key either as a file path (`ASC_PRIVATE_KEY_PATH`) or inline (`ASC_PRIVATE_KEY`, newlines
+may be escaped as `\n`). The key is read locally and used only to sign short-lived request tokens.
+
+## Configuration
+
+| Variable               | Required | Description                                                                           |
+| ---------------------- | -------- | ------------------------------------------------------------------------------------- |
+| `ASC_KEY_ID`           | yes      | App Store Connect API **Key ID**.                                                     |
+| `ASC_ISSUER_ID`        | yes      | App Store Connect API **Issuer ID** (per team).                                       |
+| `ASC_PRIVATE_KEY_PATH` | yes\*    | Path to the downloaded `.p8` private key file.                                        |
+| `ASC_PRIVATE_KEY`      | yes\*    | The `.p8` contents inline (alternative to the path; `\n` escapes are unescaped).      |
+| `ASC_VENDOR_NUMBER`    | no       | Vendor number; required only for `download_sales_report` / `download_finance_report`. |
+
+\* Provide **either** `ASC_PRIVATE_KEY_PATH` **or** `ASC_PRIVATE_KEY`.
+
+## Usage with Claude Code
+
+Add the server to `~/.claude/settings.json` (or a project `.mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "testflight": {
+      "command": "npx",
+      "args": ["-y", "@orellbuehler/testflight-mcp"],
+      "env": {
+        "ASC_KEY_ID": "ABCD123456",
+        "ASC_ISSUER_ID": "12a3b456-7890-1234-5678-9abcdef01234",
+        "ASC_PRIVATE_KEY_PATH": "/path/to/AuthKey_ABCD123456.p8"
+      }
+    }
+  }
+}
+```
+
+If you built from source instead, use `"command": "node"` with
+`"args": ["/path/to/testflight-mcp/dist/index.js"]`. Restart Claude Code and verify with
+`claude mcp list` (should show `testflight ✓ connected`) or `/mcp` inside a session.
+
+## Tools
+
+Start from `list_apps` to get an `app_id`, then drill into feedback. All tools are read-only.
+
+**TestFlight feedback**
+
+| Tool                       | Description                                                                                                                           |
+| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `list_screenshot_feedback` | Screenshot feedback for an app: tester comment, screenshot URLs, device/OS, tester, build. Filter by build/platform/device/OS/tester. |
+| `list_crash_feedback`      | Crash feedback for an app: comment, device/OS, tester, build, crash-log reference.                                                    |
+| `get_screenshot_feedback`  | One screenshot submission; optionally returns the first screenshot inline as an image.                                                |
+| `get_crash_feedback`       | One crash submission with full metadata and crash-log reference.                                                                      |
+| `get_crash_log`            | Download the crash log text for a crash submission.                                                                                   |
+
+**Apps & builds**
+
+| Tool                    | Description                                                                |
+| ----------------------- | -------------------------------------------------------------------------- |
+| `list_apps`             | Apps in the account (id, name, bundleId, sku). Filter by bundle ID.        |
+| `get_app`               | One app by ID.                                                             |
+| `list_builds`           | TestFlight builds for an app (version, processing state, expiry).          |
+| `get_build`             | One build with its pre-release version.                                    |
+| `list_customer_reviews` | Public App Store reviews for a released app (distinct from beta feedback). |
+
+**Beta testers & groups**
+
+| Tool                 | Description                                                                |
+| -------------------- | -------------------------------------------------------------------------- |
+| `list_beta_groups`   | Beta groups for an app (internal/external, public link, feedback enabled). |
+| `list_beta_testers`  | Beta testers (name, email, invite type, state). Filter by app/group/email. |
+| `list_group_testers` | Testers in a specific beta group.                                          |
+
+**Analytics & reports**
+
+| Tool                                | Description                                                                  |
+| ----------------------------------- | ---------------------------------------------------------------------------- |
+| `create_analytics_report_request`   | Request an analytics report (the required first step). Returns a request ID. |
+| `list_analytics_reports`            | Reports available for a request, optionally filtered by category.            |
+| `list_analytics_report_segments`    | Downloadable segments of a report (presigned URLs).                          |
+| `download_analytics_report_segment` | Download + decompress a segment to CSV/TSV text.                             |
+| `download_sales_report`             | Sales & Trends report as CSV (needs `ASC_VENDOR_NUMBER`).                    |
+| `download_finance_report`           | Financial report as CSV (needs `ASC_VENDOR_NUMBER` and a region code).       |
+
+**Provisioning & devices**
+
+| Tool                | Description                                         |
+| ------------------- | --------------------------------------------------- |
+| `list_devices`      | Registered devices (name, platform, UDID, status).  |
+| `list_certificates` | Signing certificates (type, name, serial, expiry).  |
+| `list_profiles`     | Provisioning profiles with their bundle ID.         |
+| `list_bundle_ids`   | Registered bundle IDs (identifier, name, platform). |
+
+**App metadata & localizations**
+
+| Tool                                   | Description                                                    |
+| -------------------------------------- | -------------------------------------------------------------- |
+| `list_app_store_versions`              | App Store versions for an app (version, platform, state).      |
+| `list_app_store_version_localizations` | Per-locale metadata (description, keywords, what's new, URLs). |
+| `get_app_store_version_localization`   | One localization by ID.                                        |
+
+## Notes & caveats
+
+- **Read-only.** The server cannot add/remove testers, edit metadata, or submit apps. The only `POST`
+  is `create_analytics_report_request`, which requests an analytics snapshot so the data can be read;
+  it does not change your app.
+- **TestFlight feedback** requires builds uploaded with feedback enabled and is retained by Apple for
+  a limited window (~90 days). The tester's typed comment is the `comment` field on a screenshot
+  submission.
+- **Crash logs** are resolved from the submission's crash-log URL and downloaded as text. If Apple
+  exposes no download URL for a given submission, `get_crash_log` returns the raw attributes so you
+  can see what's available.
+- **Reports** (`download_sales_report` / `download_finance_report`) are gzipped CSV decompressed for
+  you, and need the **Finance** role on the API key plus `ASC_VENDOR_NUMBER`.
+- **Your data goes to the agent/LLM.** Feedback includes tester names, emails and device details. Use
+  an API key scoped to the access you actually want.
+
+## Development
+
+```bash
+npm install
+npm run build         # tsc -> dist/
+npm test              # vitest run
+npm run typecheck     # tsc --noEmit
+npm run lint          # eslint src
+npm run format:check  # prettier --check .
+```
+
+Run a single test file:
+
+```bash
+npx vitest run src/__tests__/feedback.test.ts
+```
+
+## CI / Releasing
+
+- **CI** (`.github/workflows/ci.yml`) runs on every push to `main` and on pull requests:
+  `format:check`, `lint`, `typecheck` (once) and `test` + `build` on Node 20 and 22.
+- **Publish** (`.github/workflows/publish.yml`) runs when a GitHub Release is published. It builds,
+  tests, and publishes to npm using [trusted publishing](https://docs.npmjs.com/trusted-publishers)
+  (OIDC) — **no `NPM_TOKEN` secret required**, with provenance generated automatically. It skips
+  publishing if that version is already on npm.
+
+Cut a release:
+
+```bash
+npm version patch          # bumps package.json + creates a vX.Y.Z tag (use minor/major as needed)
+git push --follow-tags
+gh release create "v$(node -p "require('./package.json').version")" --generate-notes
+```
+
+## License
+
+[MIT](./LICENSE) © Orell Bühler

package/dist/asc/client.js

@@ -0,0 +1,126 @@
+import { gunzipSync } from "node:zlib";
+export const BASE_URL = "https://api.appstoreconnect.apple.com/v1";
+export class AppStoreConnectClient {
+    tokenProvider;
+    timeoutMs;
+    constructor(tokenProvider, timeoutMs = 30000) {
+        this.tokenProvider = tokenProvider;
+        this.timeoutMs = timeoutMs;
+    }
+    buildUrl(path, params) {
+        const url = new URL(path.startsWith("http") ? path : `${BASE_URL}${path}`);
+        if (params) {
+            for (const [k, v] of Object.entries(params)) {
+                if (v === undefined || v === null)
+                    continue;
+                if (Array.isArray(v)) {
+                    if (v.length === 0)
+                        continue;
+                    url.searchParams.set(k, v.join(","));
+                }
+                else {
+                    url.searchParams.set(k, String(v));
+                }
+            }
+        }
+        return url.toString();
+    }
+    async request(url, options = {}) {
+        const token = await this.tokenProvider();
+        let res;
+        try {
+            res = await fetch(url, {
+                ...options,
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    Accept: "application/json",
+                    ...(typeof options.body === "string" ? { "Content-Type": "application/json" } : {}),
+                    ...(options.headers ?? {}),
+                },
+                signal: options.signal ?? AbortSignal.timeout(this.timeoutMs),
+            });
+        }
+        catch (e) {
+            if (e instanceof DOMException && e.name === "TimeoutError") {
+                throw new Error(`App Store Connect request timed out after ${this.timeoutMs}ms`, {
+                    cause: e,
+                });
+            }
+            throw e;
+        }
+        if (!res.ok) {
+            const body = await res.text();
+            throw new Error(`${res.status} ${res.statusText}: ${body}`);
+        }
+        return res;
+    }
+    async get(path, params) {
+        const res = await this.request(this.buildUrl(path, params));
+        return res.json();
+    }
+    async getAll(path, params, maxPages = 5) {
+        const data = [];
+        const included = [];
+        let next;
+        let page = 0;
+        do {
+            const res = next ? await this.get(next) : await this.get(path, params);
+            if (Array.isArray(res.data))
+                data.push(...res.data);
+            else if (res.data)
+                data.push(res.data);
+            if (res.included)
+                included.push(...res.included);
+            next = res.links?.next;
+            page++;
+        } while (next && page < maxPages);
+        return { data, included };
+    }
+    async post(path, body) {
+        const res = await this.request(this.buildUrl(path), {
+            method: "POST",
+            body: JSON.stringify(body),
+        });
+        return res.json();
+    }
+    async downloadText(url) {
+        const res = await fetch(url, { signal: AbortSignal.timeout(this.timeoutMs) });
+        if (!res.ok)
+            throw new Error(`${res.status} ${res.statusText}: failed to download ${url}`);
+        return res.text();
+    }
+    async downloadBinary(url) {
+        const res = await fetch(url, { signal: AbortSignal.timeout(this.timeoutMs) });
+        if (!res.ok)
+            throw new Error(`${res.status} ${res.statusText}: failed to download ${url}`);
+        const buf = Buffer.from(await res.arrayBuffer());
+        return {
+            base64: buf.toString("base64"),
+            mimeType: res.headers.get("content-type") ?? "image/png",
+        };
+    }
+    async downloadGzipText(url) {
+        const res = await fetch(url, { signal: AbortSignal.timeout(this.timeoutMs) });
+        if (!res.ok)
+            throw new Error(`${res.status} ${res.statusText}: failed to download ${url}`);
+        const buf = Buffer.from(await res.arrayBuffer());
+        try {
+            return gunzipSync(buf).toString("utf-8");
+        }
+        catch {
+            return buf.toString("utf-8");
+        }
+    }
+    async getGzippedReport(path, params) {
+        const res = await this.request(this.buildUrl(path, params), {
+            headers: { Accept: "application/a-gzip, application/json" },
+        });
+        const buf = Buffer.from(await res.arrayBuffer());
+        try {
+            return gunzipSync(buf).toString("utf-8");
+        }
+        catch {
+            return buf.toString("utf-8");
+        }
+    }
+}

package/dist/asc/format.js

@@ -0,0 +1,41 @@
+export function ok(data) {
+    const text = typeof data === "string" ? data : JSON.stringify(data);
+    return { content: [{ type: "text", text }] };
+}
+export function err(e) {
+    return { content: [{ type: "text", text: String(e) }], isError: true };
+}
+export function imageResult(base64, mimeType, caption) {
+    const content = [];
+    if (caption)
+        content.push({ type: "text", text: caption });
+    content.push({ type: "image", data: base64, mimeType });
+    return { content };
+}
+export function singleRef(rel) {
+    const data = rel?.data;
+    if (!data || Array.isArray(data))
+        return null;
+    return data;
+}
+export function findIncluded(included, ref) {
+    if (!ref)
+        return null;
+    return included.find((r) => r.type === ref.type && r.id === ref.id) ?? null;
+}
+export function flattenResource(resource) {
+    if (!resource)
+        return null;
+    return { id: resource.id, type: resource.type, ...resource.attributes };
+}
+export function shapeResource(resource, included = [], options = {}) {
+    const out = {
+        id: resource.id,
+        type: resource.type,
+        ...resource.attributes,
+    };
+    for (const name of options.relationships ?? []) {
+        out[name] = flattenResource(findIncluded(included, singleRef(resource.relationships?.[name])));
+    }
+    return out;
+}

package/dist/asc/jwt.js

@@ -0,0 +1,33 @@
+import { SignJWT, importPKCS8 } from "jose";
+import { readFile } from "node:fs/promises";
+async function loadKey(auth) {
+    if (auth.privateKey && auth.privateKey.trim()) {
+        return auth.privateKey.replace(/\\n/g, "\n");
+    }
+    if (auth.privateKeyPath) {
+        return readFile(auth.privateKeyPath, "utf-8");
+    }
+    throw new Error("No App Store Connect private key configured");
+}
+export function createTokenProvider(auth, nowMs = Date.now) {
+    let cached = null;
+    let pem = null;
+    return async () => {
+        const now = Math.floor(nowMs() / 1000);
+        if (cached && cached.expiresAt > now + 60)
+            return cached.token;
+        if (pem === null)
+            pem = await loadKey(auth);
+        const key = await importPKCS8(pem, "ES256");
+        const expiresAt = now + 20 * 60;
+        const token = await new SignJWT({})
+            .setProtectedHeader({ alg: "ES256", kid: auth.keyId, typ: "JWT" })
+            .setIssuer(auth.issuerId)
+            .setIssuedAt(now)
+            .setExpirationTime(expiresAt)
+            .setAudience("appstoreconnect-v1")
+            .sign(key);
+        cached = { token, expiresAt };
+        return token;
+    };
+}

package/dist/config.js

@@ -0,0 +1,20 @@
+import { AppStoreConnectClient } from "./asc/client.js";
+import { createTokenProvider } from "./asc/jwt.js";
+const keyId = (process.env.ASC_KEY_ID || "").trim();
+const issuerId = (process.env.ASC_ISSUER_ID || "").trim();
+const privateKey = process.env.ASC_PRIVATE_KEY;
+const privateKeyPath = (process.env.ASC_PRIVATE_KEY_PATH || "").trim() || undefined;
+const vendorNumber = (process.env.ASC_VENDOR_NUMBER || "").trim() || undefined;
+if (!keyId || !issuerId || (!privateKey && !privateKeyPath)) {
+    console.error("ASC_KEY_ID, ASC_ISSUER_ID and one of ASC_PRIVATE_KEY / ASC_PRIVATE_KEY_PATH are required. " +
+        "Create an App Store Connect API key under Users and Access > Integrations > App Store Connect API.");
+    process.exit(1);
+}
+export const config = {
+    keyId,
+    issuerId,
+    vendorNumber,
+    transport: "stdio",
+};
+const tokenProvider = createTokenProvider({ keyId, issuerId, privateKey, privateKeyPath });
+export const client = new AppStoreConnectClient(tokenProvider);

package/dist/index.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { client, config } from "./config.js";
+import { createServer } from "./server.js";
+const server = createServer(client, config.vendorNumber);
+const transport = new StdioServerTransport();
+try {
+    await server.connect(transport);
+}
+catch (e) {
+    console.error(`Failed to start testflight-mcp: ${String(e)}`);
+    process.exit(1);
+}

package/dist/server.js

@@ -0,0 +1,17 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { registerFeedbackTools } from "./tools/feedback.js";
+import { registerAppTools } from "./tools/apps.js";
+import { registerTesterTools } from "./tools/testers.js";
+import { registerAnalyticsTools } from "./tools/analytics.js";
+import { registerProvisioningTools } from "./tools/provisioning.js";
+import { registerMetadataTools } from "./tools/metadata.js";
+export function createServer(client, vendorNumber) {
+    const server = new McpServer({ name: "testflight-mcp", version: "0.1.0" });
+    registerFeedbackTools(server, client);
+    registerAppTools(server, client);
+    registerTesterTools(server, client);
+    registerAnalyticsTools(server, client, vendorNumber);
+    registerProvisioningTools(server, client);
+    registerMetadataTools(server, client);
+    return server;
+}

package/dist/tools/analytics.js

@@ -0,0 +1,147 @@
+import { z } from "zod";
+import { ok, err, flattenResource } from "../asc/format.js";
+export function registerAnalyticsTools(server, client, defaultVendorNumber) {
+    server.tool("create_analytics_report_request", "Create an analytics report request for an app — the required first step to read App Store analytics. Returns a reportRequestId to pass to list_analytics_reports. ONE_TIME_SNAPSHOT requests the latest data once; ONGOING accrues daily data. This creates a request resource but does not modify the app.", {
+        app_id: z.string().describe("App Store Connect app ID"),
+        access_type: z
+            .enum(["ONE_TIME_SNAPSHOT", "ONGOING"])
+            .optional()
+            .describe("Report access type (default: ONE_TIME_SNAPSHOT)"),
+    }, async ({ app_id, access_type }) => {
+        try {
+            const res = await client.post("/analyticsReportRequests", {
+                data: {
+                    type: "analyticsReportRequests",
+                    attributes: { accessType: access_type ?? "ONE_TIME_SNAPSHOT" },
+                    relationships: { app: { data: { type: "apps", id: app_id } } },
+                },
+            });
+            return ok(flattenResource(res.data));
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_analytics_reports", "List the analytics reports available for a report request (name, category, instances). Optionally filter by category.", {
+        report_request_id: z
+            .string()
+            .describe("reportRequestId from create_analytics_report_request"),
+        category: z
+            .enum([
+            "APP_STORE_ENGAGEMENT",
+            "APP_STORE_COMMERCE",
+            "APP_USAGE",
+            "FRAMEWORKS_USAGE",
+            "PERFORMANCE",
+        ])
+            .optional()
+            .describe("Filter reports by category"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max reports (default: 100)"),
+    }, async ({ report_request_id, category, limit }) => {
+        try {
+            const params = { limit: limit ?? 100 };
+            if (category)
+                params["filter[category]"] = category;
+            const { data } = await client.getAll(`/analyticsReportRequests/${encodeURIComponent(report_request_id)}/reports`, params);
+            return ok({ count: data.length, reports: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_analytics_report_segments", "List the downloadable segments of an analytics report (each has a presigned url, size and checksum). Pass a segment url to download_analytics_report_segment.", {
+        report_id: z.string().describe("Analytics report ID from list_analytics_reports"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max segments (default: 100)"),
+    }, async ({ report_id, limit }) => {
+        try {
+            const { data } = await client.getAll(`/analyticsReports/${encodeURIComponent(report_id)}/segments`, { limit: limit ?? 100 });
+            return ok({ count: data.length, segments: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("download_analytics_report_segment", "Download and decompress an analytics report segment from its presigned url. Returns the report data as CSV/TSV text.", { segment_url: z.string().describe("The 'url' field of an analytics report segment") }, async ({ segment_url }) => {
+        try {
+            return ok(await client.downloadGzipText(segment_url));
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("download_sales_report", "Download a Sales and Trends report as CSV text (decompressed from gzip). Requires a vendor number (from ASC_VENDOR_NUMBER or passed explicitly).", {
+        report_date: z
+            .string()
+            .describe("Report date: 'YYYY-MM-DD' (DAILY), 'YYYY-MM-DD' week end (WEEKLY), 'YYYY-MM' (MONTHLY), 'YYYY' (YEARLY)"),
+        frequency: z
+            .enum(["DAILY", "WEEKLY", "MONTHLY", "YEARLY"])
+            .optional()
+            .describe("Report frequency (default: DAILY)"),
+        report_type: z
+            .enum([
+            "SALES",
+            "SUBSCRIPTION",
+            "SUBSCRIPTION_EVENT",
+            "SUBSCRIBER",
+            "NEWSSTAND",
+            "PRE_ORDER",
+        ])
+            .optional()
+            .describe("Report type (default: SALES)"),
+        report_sub_type: z
+            .enum(["SUMMARY", "DETAILED", "OPT_IN"])
+            .optional()
+            .describe("Report sub type (default: SUMMARY)"),
+        vendor_number: z.string().optional().describe("Overrides ASC_VENDOR_NUMBER"),
+        version: z
+            .string()
+            .optional()
+            .describe("Report version, e.g. '1_0' or '1_1' (some report types require it)"),
+    }, async ({ report_date, frequency, report_type, report_sub_type, vendor_number, version }) => {
+        try {
+            const vendor = vendor_number ?? defaultVendorNumber;
+            if (!vendor) {
+                return err("No vendor number. Set ASC_VENDOR_NUMBER or pass vendor_number (App Store Connect > Payments and Financial Reports).");
+            }
+            const params = {
+                "filter[frequency]": frequency ?? "DAILY",
+                "filter[reportType]": report_type ?? "SALES",
+                "filter[reportSubType]": report_sub_type ?? "SUMMARY",
+                "filter[vendorNumber]": vendor,
+                "filter[reportDate]": report_date,
+            };
+            if (version)
+                params["filter[version]"] = version;
+            return ok(await client.getGzippedReport("/salesReports", params));
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("download_finance_report", "Download a Financial report as CSV text (decompressed from gzip). Requires a vendor number and a region code.", {
+        report_date: z.string().describe("Fiscal report date in 'YYYY-MM' format"),
+        region_code: z.string().describe("Region code, e.g. 'ZZ' for all regions, 'US', 'EU'"),
+        report_type: z
+            .enum(["FINANCIAL", "FINANCE_DETAIL"])
+            .optional()
+            .describe("Report type (default: FINANCIAL)"),
+        vendor_number: z.string().optional().describe("Overrides ASC_VENDOR_NUMBER"),
+    }, async ({ report_date, region_code, report_type, vendor_number }) => {
+        try {
+            const vendor = vendor_number ?? defaultVendorNumber;
+            if (!vendor) {
+                return err("No vendor number. Set ASC_VENDOR_NUMBER or pass vendor_number.");
+            }
+            const params = {
+                "filter[regionCode]": region_code,
+                "filter[reportDate]": report_date,
+                "filter[reportType]": report_type ?? "FINANCIAL",
+                "filter[vendorNumber]": vendor,
+            };
+            return ok(await client.getGzippedReport("/financeReports", params));
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+}

package/dist/tools/apps.js

@@ -0,0 +1,106 @@
+import { z } from "zod";
+import { ok, err, shapeResource, flattenResource } from "../asc/format.js";
+const APP_FIELDS = "name,bundleId,sku,primaryLocale";
+const BUILD_FIELDS = "version,uploadedDate,expirationDate,expired,minOsVersion,processingState";
+export function registerAppTools(server, client) {
+    server.tool("list_apps", "List the apps in your App Store Connect account (id, name, bundleId, sku, primaryLocale). Use the returned id as app_id for the other tools.", {
+        bundle_id: z.string().optional().describe("Filter by exact bundle ID, e.g. 'com.acme.app'"),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(200)
+            .optional()
+            .describe("Max apps to return (default: 100)"),
+    }, async ({ bundle_id, limit }) => {
+        try {
+            const params = { "fields[apps]": APP_FIELDS, limit: limit ?? 100 };
+            if (bundle_id)
+                params["filter[bundleId]"] = bundle_id;
+            const { data } = await client.getAll("/apps", params);
+            return ok({ count: data.length, apps: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("get_app", "Get a single app by ID (name, bundleId, sku, primaryLocale).", { app_id: z.string().describe("App Store Connect app ID") }, async ({ app_id }) => {
+        try {
+            const res = await client.get(`/apps/${encodeURIComponent(app_id)}`, {
+                "fields[apps]": APP_FIELDS,
+            });
+            return ok(flattenResource(res.data));
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_builds", "List TestFlight builds for an app (build/upload number, app version, platform, processing state, expiry). Filter by pre-release version or processing state.", {
+        app_id: z.string().describe("App Store Connect app ID"),
+        version: z.string().optional().describe("Filter by pre-release version, e.g. '1.2.0'"),
+        processing_state: z
+            .enum(["PROCESSING", "FAILED", "INVALID", "VALID"])
+            .optional()
+            .describe("Filter by processing state"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max builds (default: 25)"),
+    }, async ({ app_id, version, processing_state, limit }) => {
+        try {
+            const params = {
+                "filter[app]": app_id,
+                include: "preReleaseVersion",
+                "fields[builds]": BUILD_FIELDS,
+                "fields[preReleaseVersions]": "version,platform",
+                sort: "-uploadedDate",
+                limit: limit ?? 25,
+            };
+            if (version)
+                params["filter[preReleaseVersion.version]"] = version;
+            if (processing_state)
+                params["filter[processingState]"] = processing_state;
+            const { data, included } = await client.getAll("/builds", params);
+            const builds = data.map((d) => shapeResource(d, included, { relationships: ["preReleaseVersion"] }));
+            return ok({ count: builds.length, builds });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("get_build", "Get a single TestFlight build by ID, including its pre-release version.", { build_id: z.string().describe("Build ID") }, async ({ build_id }) => {
+        try {
+            const res = await client.get(`/builds/${encodeURIComponent(build_id)}`, {
+                include: "preReleaseVersion",
+                "fields[builds]": BUILD_FIELDS,
+                "fields[preReleaseVersions]": "version,platform",
+            });
+            return ok(shapeResource(res.data, res.included ?? [], {
+                relationships: ["preReleaseVersion"],
+            }));
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_customer_reviews", "List public App Store customer reviews for a released app (rating, title, body, reviewer, territory). Distinct from TestFlight beta feedback. Filter by rating or territory.", {
+        app_id: z.string().describe("App Store Connect app ID"),
+        rating: z.number().int().min(1).max(5).optional().describe("Filter by star rating (1-5)"),
+        territory: z.string().optional().describe("Filter by territory code, e.g. 'USA'"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max reviews (default: 50)"),
+    }, async ({ app_id, rating, territory, limit }) => {
+        try {
+            const params = {
+                "fields[customerReviews]": "rating,title,body,reviewerNickname,createdDate,territory",
+                sort: "-createdDate",
+                limit: limit ?? 50,
+            };
+            if (rating !== undefined)
+                params["filter[rating]"] = rating;
+            if (territory)
+                params["filter[territory]"] = territory;
+            const { data } = await client.getAll(`/apps/${encodeURIComponent(app_id)}/customerReviews`, params);
+            return ok({ count: data.length, reviews: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+}

package/dist/tools/feedback.js

@@ -0,0 +1,143 @@
+import { z } from "zod";
+import { ok, err, imageResult, shapeResource } from "../asc/format.js";
+const PLATFORM = z.enum(["IOS", "MAC_OS", "TV_OS", "VISION_OS"]);
+const TESTER_FIELDS = "firstName,lastName,email";
+const BUILD_FIELDS = "version,uploadedDate";
+const listShape = {
+    app_id: z.string().describe("App Store Connect app ID (from list_apps)"),
+    build_id: z.string().optional().describe("Filter to a single build ID"),
+    device_platform: PLATFORM.optional().describe("Filter by device platform"),
+    app_platform: PLATFORM.optional().describe("Filter by app platform"),
+    device_model: z.string().optional().describe("Filter by device model, e.g. 'iPhone15,2'"),
+    os_version: z.string().optional().describe("Filter by OS version string"),
+    tester_id: z.string().optional().describe("Filter by beta tester ID"),
+    sort: z
+        .enum(["createdDate", "-createdDate"])
+        .optional()
+        .describe("Sort order (default: -createdDate, newest first)"),
+    limit: z.number().int().min(1).max(200).optional().describe("Max items to return (default: 50)"),
+};
+function buildListParams(args, fieldsKey, fields) {
+    const params = {
+        include: "build,tester",
+        "fields[builds]": BUILD_FIELDS,
+        "fields[betaTesters]": TESTER_FIELDS,
+        [fieldsKey]: fields,
+        sort: args.sort ?? "-createdDate",
+        limit: args.limit ?? 50,
+    };
+    if (args.build_id)
+        params["filter[build]"] = args.build_id;
+    if (args.device_platform)
+        params["filter[devicePlatform]"] = args.device_platform;
+    if (args.app_platform)
+        params["filter[appPlatform]"] = args.app_platform;
+    if (args.device_model)
+        params["filter[deviceModel]"] = args.device_model;
+    if (args.os_version)
+        params["filter[osVersion]"] = args.os_version;
+    if (args.tester_id)
+        params["filter[tester]"] = args.tester_id;
+    return params;
+}
+const SCREENSHOT_FIELDS = "createdDate,comment,email,deviceModel,osVersion,locale,timeZone,architecture,connectionType,pairedAppleWatch,appUptimeInMilliseconds,diskBytesAvailable,diskBytesTotal,batteryPercentage,screenWidthInPoints,screenHeightInPoints,appPlatform,devicePlatform,deviceFamily,buildBundleId,screenshots";
+const CRASH_FIELDS = "createdDate,comment,email,deviceModel,osVersion,locale,timeZone,architecture,connectionType,pairedAppleWatch,appUptimeInMilliseconds,diskBytesAvailable,diskBytesTotal,batteryPercentage,screenWidthInPoints,screenHeightInPoints,appPlatform,devicePlatform,deviceFamily,buildBundleId,crashLog";
+function findCrashLogUrl(attrs) {
+    const cl = attrs?.crashLog;
+    if (typeof cl === "string")
+        return cl;
+    if (cl && typeof cl === "object" && typeof cl.url === "string") {
+        return cl.url;
+    }
+    return null;
+}
+export function registerFeedbackTools(server, client) {
+    server.tool("list_screenshot_feedback", "List TestFlight screenshot feedback submissions for an app. Each submission includes the tester's comment (the actual feedback text), the screenshot asset URL(s), device/OS details, and the resolved tester and build. Filter by build, platform, device, OS or tester.", listShape, async (args) => {
+        try {
+            const params = buildListParams(args, "fields[betaFeedbackScreenshotSubmissions]", SCREENSHOT_FIELDS);
+            const { data, included } = await client.getAll(`/apps/${encodeURIComponent(args.app_id)}/betaFeedbackScreenshotSubmissions`, params);
+            const items = data.map((d) => shapeResource(d, included, { relationships: ["build", "tester"] }));
+            return ok({ count: items.length, feedback: items });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_crash_feedback", "List TestFlight crash feedback submissions for an app. Each submission includes any tester comment, device/OS details, the resolved tester and build, and a reference to the downloadable crash log (use get_crash_log). Filter by build, platform, device, OS or tester.", listShape, async (args) => {
+        try {
+            const params = buildListParams(args, "fields[betaFeedbackCrashSubmissions]", CRASH_FIELDS);
+            const { data, included } = await client.getAll(`/apps/${encodeURIComponent(args.app_id)}/betaFeedbackCrashSubmissions`, params);
+            const items = data.map((d) => shapeResource(d, included, { relationships: ["build", "tester"] }));
+            return ok({ count: items.length, feedback: items });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("get_screenshot_feedback", "Get a single screenshot feedback submission by ID, including the tester comment, full device metadata, resolved tester and build, and screenshot asset URLs. Set download_screenshot to also return the first screenshot inline as an image.", {
+        feedback_id: z.string().describe("Screenshot feedback submission ID"),
+        download_screenshot: z
+            .boolean()
+            .optional()
+            .describe("Download and return the first screenshot inline as an image (default: false)"),
+    }, async ({ feedback_id, download_screenshot }) => {
+        try {
+            const res = await client.get(`/betaFeedbackScreenshotSubmissions/${encodeURIComponent(feedback_id)}`, {
+                include: "build,tester",
+                "fields[builds]": BUILD_FIELDS,
+                "fields[betaTesters]": TESTER_FIELDS,
+                "fields[betaFeedbackScreenshotSubmissions]": SCREENSHOT_FIELDS,
+            });
+            const resource = res.data;
+            const shaped = shapeResource(resource, res.included ?? [], {
+                relationships: ["build", "tester"],
+            });
+            if (download_screenshot) {
+                const shots = resource.attributes?.screenshots;
+                const url = shots?.[0]?.url;
+                if (url) {
+                    const { base64, mimeType } = await client.downloadBinary(url);
+                    const comment = resource.attributes?.comment || "(no comment)";
+                    return imageResult(base64, mimeType, `Screenshot feedback ${feedback_id}: ${comment}`);
+                }
+            }
+            return ok(shaped);
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("get_crash_feedback", "Get a single crash feedback submission by ID, including any tester comment, full device metadata, resolved tester and build, and the crash log reference. Use get_crash_log to download the crash log text.", { feedback_id: z.string().describe("Crash feedback submission ID") }, async ({ feedback_id }) => {
+        try {
+            const res = await client.get(`/betaFeedbackCrashSubmissions/${encodeURIComponent(feedback_id)}`, {
+                include: "build,tester",
+                "fields[builds]": BUILD_FIELDS,
+                "fields[betaTesters]": TESTER_FIELDS,
+                "fields[betaFeedbackCrashSubmissions]": CRASH_FIELDS,
+            });
+            return ok(shapeResource(res.data, res.included ?? [], {
+                relationships: ["build", "tester"],
+            }));
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("get_crash_log", "Download the crash log text for a crash feedback submission. Resolves the temporary crash-log URL from the submission and fetches its contents.", { feedback_id: z.string().describe("Crash feedback submission ID") }, async ({ feedback_id }) => {
+        try {
+            const res = await client.get(`/betaFeedbackCrashSubmissions/${encodeURIComponent(feedback_id)}`, { "fields[betaFeedbackCrashSubmissions]": "crashLog" });
+            const attrs = res.data.attributes;
+            const url = findCrashLogUrl(attrs);
+            if (!url) {
+                return ok({
+                    message: "No downloadable crash log URL is present on this submission.",
+                    attributes: attrs ?? {},
+                });
+            }
+            return ok(await client.downloadText(url));
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+}

package/dist/tools/metadata.js

@@ -0,0 +1,70 @@
+import { z } from "zod";
+import { ok, err, flattenResource } from "../asc/format.js";
+const VERSION_FIELDS = "versionString,platform,appStoreState,releaseType,copyright,earliestReleaseDate,createdDate";
+const LOCALIZATION_FIELDS = "locale,description,keywords,whatsNew,promotionalText,marketingUrl,supportUrl";
+export function registerMetadataTools(server, client) {
+    server.tool("list_app_store_versions", "List App Store versions for an app (version string, platform, App Store state, release type). Filter by platform, version string or App Store state.", {
+        app_id: z.string().describe("App Store Connect app ID"),
+        platform: z
+            .enum(["IOS", "MAC_OS", "TV_OS", "VISION_OS"])
+            .optional()
+            .describe("Filter by platform"),
+        version: z.string().optional().describe("Filter by version string, e.g. '1.2.0'"),
+        app_store_state: z
+            .string()
+            .optional()
+            .describe("Filter by App Store state, e.g. 'READY_FOR_SALE'"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max versions (default: 100)"),
+    }, async ({ app_id, platform, version, app_store_state, limit }) => {
+        try {
+            const params = {
+                "filter[app]": app_id,
+                "fields[appStoreVersions]": VERSION_FIELDS,
+                limit: limit ?? 100,
+            };
+            if (platform)
+                params["filter[platform]"] = platform;
+            if (version)
+                params["filter[versionString]"] = version;
+            if (app_store_state)
+                params["filter[appStoreState]"] = app_store_state;
+            const { data } = await client.getAll("/appStoreVersions", params);
+            return ok({ count: data.length, versions: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_app_store_version_localizations", "List the per-locale localizations for an App Store version (description, keywords, what's new, promotional text, URLs).", {
+        version_id: z.string().describe("App Store version ID (from list_app_store_versions)"),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(200)
+            .optional()
+            .describe("Max localizations (default: 100)"),
+    }, async ({ version_id, limit }) => {
+        try {
+            const params = {
+                "filter[appStoreVersion]": version_id,
+                "fields[appStoreVersionLocalizations]": LOCALIZATION_FIELDS,
+                limit: limit ?? 100,
+            };
+            const { data } = await client.getAll("/appStoreVersionLocalizations", params);
+            return ok({ count: data.length, localizations: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("get_app_store_version_localization", "Get a single App Store version localization by ID (description, keywords, what's new, promotional text, URLs).", { localization_id: z.string().describe("App Store version localization ID") }, async ({ localization_id }) => {
+        try {
+            const res = await client.get(`/appStoreVersionLocalizations/${encodeURIComponent(localization_id)}`, { "fields[appStoreVersionLocalizations]": LOCALIZATION_FIELDS });
+            return ok(flattenResource(res.data));
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+}

package/dist/tools/provisioning.js

@@ -0,0 +1,100 @@
+import { z } from "zod";
+import { ok, err, flattenResource, shapeResource } from "../asc/format.js";
+export function registerProvisioningTools(server, client) {
+    server.tool("list_devices", "List registered devices (name, platform, UDID, class, model, status). Filter by platform or status.", {
+        platform: z.enum(["IOS", "MAC_OS"]).optional().describe("Filter by device platform"),
+        status: z.enum(["ENABLED", "DISABLED"]).optional().describe("Filter by device status"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max devices (default: 100)"),
+    }, async ({ platform, status, limit }) => {
+        try {
+            const params = {
+                "fields[devices]": "name,platform,udid,deviceClass,status,model,addedDate",
+                limit: limit ?? 100,
+            };
+            if (platform)
+                params["filter[platform]"] = platform;
+            if (status)
+                params["filter[status]"] = status;
+            const { data } = await client.getAll("/devices", params);
+            return ok({ count: data.length, devices: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_certificates", "List signing certificates (type, name, platform, serial number, expiry). Filter by certificate type.", {
+        certificate_type: z
+            .string()
+            .optional()
+            .describe("Filter by type, e.g. 'IOS_DISTRIBUTION', 'IOS_DEVELOPMENT', 'DISTRIBUTION'"),
+        limit: z
+            .number()
+            .int()
+            .min(1)
+            .max(200)
+            .optional()
+            .describe("Max certificates (default: 100)"),
+    }, async ({ certificate_type, limit }) => {
+        try {
+            const params = {
+                "fields[certificates]": "certificateType,displayName,name,platform,serialNumber,expirationDate",
+                limit: limit ?? 100,
+            };
+            if (certificate_type)
+                params["filter[certificateType]"] = certificate_type;
+            const { data } = await client.getAll("/certificates", params);
+            return ok({ count: data.length, certificates: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_profiles", "List provisioning profiles (name, platform, type, state, UUID, expiry) with their bundle ID. Filter by profile state.", {
+        profile_state: z.enum(["ACTIVE", "INVALID"]).optional().describe("Filter by profile state"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max profiles (default: 100)"),
+    }, async ({ profile_state, limit }) => {
+        try {
+            const params = {
+                "fields[profiles]": "name,platform,profileType,profileState,uuid,createdDate,expirationDate",
+                "fields[bundleIds]": "identifier,name,platform",
+                include: "bundleId",
+                limit: limit ?? 100,
+            };
+            if (profile_state)
+                params["filter[profileState]"] = profile_state;
+            const { data, included } = await client.getAll("/profiles", params);
+            const profiles = data.map((d) => shapeResource(d, included, { relationships: ["bundleId"] }));
+            return ok({ count: profiles.length, profiles });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_bundle_ids", "List registered bundle IDs (identifier, name, platform, seed ID). Filter by identifier or platform.", {
+        identifier: z
+            .string()
+            .optional()
+            .describe("Filter by bundle identifier, e.g. 'com.acme.app'"),
+        platform: z
+            .enum(["IOS", "MAC_OS", "UNIVERSAL"])
+            .optional()
+            .describe("Filter by bundle platform"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max bundle IDs (default: 100)"),
+    }, async ({ identifier, platform, limit }) => {
+        try {
+            const params = {
+                "fields[bundleIds]": "identifier,name,platform,seedId",
+                limit: limit ?? 100,
+            };
+            if (identifier)
+                params["filter[identifier]"] = identifier;
+            if (platform)
+                params["filter[platform]"] = platform;
+            const { data } = await client.getAll("/bundleIds", params);
+            return ok({ count: data.length, bundleIds: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+}

package/dist/tools/testers.js

@@ -0,0 +1,64 @@
+import { z } from "zod";
+import { ok, err, flattenResource } from "../asc/format.js";
+const GROUP_FIELDS = "name,isInternalGroup,publicLinkEnabled,publicLinkLimit,publicLink,feedbackEnabled,createdDate";
+const TESTER_FIELDS = "firstName,lastName,email,inviteType,state";
+export function registerTesterTools(server, client) {
+    server.tool("list_beta_groups", "List the TestFlight beta groups for an app (name, internal/external, public link, whether feedback is enabled).", {
+        app_id: z.string().describe("App Store Connect app ID"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max groups (default: 100)"),
+    }, async ({ app_id, limit }) => {
+        try {
+            const params = {
+                "filter[app]": app_id,
+                "fields[betaGroups]": GROUP_FIELDS,
+                limit: limit ?? 100,
+            };
+            const { data } = await client.getAll("/betaGroups", params);
+            return ok({ count: data.length, groups: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_beta_testers", "List TestFlight beta testers (name, email, invite type, state). Filter by app, beta group and/or email.", {
+        app_id: z.string().optional().describe("Filter testers by app ID"),
+        group_id: z.string().optional().describe("Filter testers by beta group ID"),
+        email: z.string().optional().describe("Filter by exact tester email"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max testers (default: 100)"),
+    }, async ({ app_id, group_id, email, limit }) => {
+        try {
+            const params = {
+                "fields[betaTesters]": TESTER_FIELDS,
+                sort: "lastName",
+                limit: limit ?? 100,
+            };
+            if (app_id)
+                params["filter[apps]"] = app_id;
+            if (group_id)
+                params["filter[betaGroups]"] = group_id;
+            if (email)
+                params["filter[email]"] = email;
+            const { data } = await client.getAll("/betaTesters", params);
+            return ok({ count: data.length, testers: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+    server.tool("list_group_testers", "List the beta testers that belong to a specific beta group.", {
+        group_id: z.string().describe("Beta group ID"),
+        limit: z.number().int().min(1).max(200).optional().describe("Max testers (default: 100)"),
+    }, async ({ group_id, limit }) => {
+        try {
+            const params = {
+                "fields[betaTesters]": TESTER_FIELDS,
+                limit: limit ?? 100,
+            };
+            const { data } = await client.getAll(`/betaGroups/${encodeURIComponent(group_id)}/betaTesters`, params);
+            return ok({ count: data.length, testers: data.map((d) => flattenResource(d)) });
+        }
+        catch (e) {
+            return err(e);
+        }
+    });
+}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@orellbuehler/testflight-mcp",
+  "version": "0.1.0",
+  "description": "Model Context Protocol server for TestFlight & App Store Connect: retrieve beta tester feedback (screenshots, crashes, crash logs), builds, testers, analytics and provisioning over the official App Store Connect API.",
+  "type": "module",
+  "bin": {
+    "testflight-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "!dist/__tests__"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "start": "node dist/index.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "prepare": "npm run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "testflight",
+    "app-store-connect",
+    "apple",
+    "beta-testing",
+    "feedback",
+    "llm",
+    "ai"
+  ],
+  "author": "Orell Bühler",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OrellBuehler/testflight-mcp.git"
+  },
+  "homepage": "https://github.com/OrellBuehler/testflight-mcp#readme",
+  "bugs": {
+    "url": "https://github.com/OrellBuehler/testflight-mcp/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "jose": "^6.0.11",
+    "zod": "^3.24.4"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.15.3",
+    "eslint": "^10.4.1",
+    "eslint-config-prettier": "^10.1.8",
+    "prettier": "^3.8.3",
+    "typescript": "^5.8.3",
+    "typescript-eslint": "^8.60.0",
+    "vitest": "^4.1.0"
+  }
+}