appstore-api-mcp 1.2.0 → 1.4.0

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/) and the project uses
 [Semantic Versioning](https://semver.org/).
 
+## [1.4.0] - 2026-06-02
+
+### Added
+- **Provisioning & code signing:** `list_bundle_ids`, `register_bundle_id`,
+  `list_devices`, `register_device`, `list_certificates`, `create_certificate`,
+  `revoke_certificate`, `list_profiles`, `create_profile`, `download_profile`,
+  `delete_profile`.
+- **Game Center:** `list_game_center_leaderboards`, `list_game_center_achievements`.
+- **Automatic rate-limit handling** — the client backs off and retries on `429`/`503`
+  (honoring `Retry-After`, else exponential backoff), so large multi-app sweeps
+  don't fail. The latest `x-rate-limit` header is exposed on the client.
+
+## [1.3.0] - 2026-06-02
+
+### Added
+- Promoted popular App Store Connect capabilities from `raw_request` to dedicated tools:
+  - **Customer reviews:** `list_customer_reviews` (filter by rating/territory, shows reply status) + `reply_to_customer_review`.
+  - **TestFlight:** `list_builds`, `list_beta_groups`, `list_beta_testers`, `add_beta_tester`.
+  - **Catalog/pricing/availability:** `list_in_app_purchases`, `get_app_price_schedule`, `list_available_territories`, `get_age_rating`.
+- All read tools validated end-to-end against a live account (reviews, builds, groups, testers, IAPs, 175 territories, age rating).
+
 ## [1.2.0] - 2026-06-02
 
 ### Added

package/README.md

@@ -50,6 +50,7 @@ whatever AI agent you already use.
 - [Getting your API key](#getting-your-api-key) → full guide in [docs/SETUP.md](docs/SETUP.md)
 - [Configuration](#configuration)
 - [Tools](#tools) → full reference in [docs/TOOLS.md](docs/TOOLS.md)
+- [What you can ask](#what-you-can-ask)
 - [Analytics & reports setup](docs/ANALYTICS.md) — roles, Vendor Number, examples
 - [Common workflows](#common-workflows)
 - [Security](#security) → details in [docs/SECURITY.md](docs/SECURITY.md)
@@ -246,13 +247,49 @@ Full parameter reference: **[docs/TOOLS.md](docs/TOOLS.md)**.
 | 🚀 `audit_apps` | **Fleet health check** — scan all (or selected) apps for missing subtitle/keywords/description, under-used keyword field, single-locale listings, missing screenshots, and more. Read-only. |
 | 📊 `get_sales_report` / `get_subscription_report` / `get_finance_report` | Units/downloads, proceeds, **subscriptions & retention**, earnings by region (parsed rows). Needs a Vendor Number + a key with Admin/Finance/Sales role. |
 | 📈 `request_analytics_report` → `list_analytics_reports` → `list_analytics_report_instances` → `get_analytics_report_data` | The async Analytics Reports API — downloads, sessions, active devices, App Store engagement. |
-| `raw_request` | Any method/path against the API — previews, pricing, TestFlight, IAP, reviews, … |
+| ⭐ `list_customer_reviews` / `reply_to_customer_review` | Read reviews (filter by rating/territory, shows if you've replied) and post public replies. |
+| ✈️ `list_builds` / `list_beta_groups` / `list_beta_testers` / `add_beta_tester` | TestFlight — builds, beta groups, testers, and inviting testers. |
+| 🛒 `list_in_app_purchases` / `get_app_price_schedule` / `list_available_territories` / `get_age_rating` | Catalog, pricing, territory availability, and age-rating. |
+| 🔏 `list_bundle_ids` / `register_bundle_id` / `list_devices` / `register_device` / `list_certificates` / `create_certificate` / `revoke_certificate` / `list_profiles` / `create_profile` / `download_profile` / `delete_profile` | **Provisioning & code signing** — bundle IDs, devices, certificates, and provisioning profiles. |
+| 🎮 `list_game_center_leaderboards` / `list_game_center_achievements` | Game Center leaderboards & achievements. |
+| `raw_request` | Any method/path against the API — app previews, matchmaking, Xcode Cloud, anything not above. |
+
+> ⚙️ **Rate-limit aware:** the client automatically backs off and retries on
+> App Store Connect's `429` (hourly quota), so large sweeps (e.g. auditing 60+
+> apps) don't fall over.
 
 > 🛡️ **Dry-run:** the `update_*` tools accept `dryRun: true` — they return a field-by-field
 > diff (old → new) with length/limit checks and **write nothing**. Drop the flag to apply.
 
 ---
 
+## What you can ask
+
+Once it's connected, just talk to your agent in plain language. A few things to try:
+
+**Listings & ASO**
+- *"Which of my apps are missing a subtitle or screenshots?"* (fleet audit)
+- *"Tighten the keywords for <app> — dry-run it first so I can confirm."*
+- *"Show me <app>'s current screenshots and flag any that look outdated."*
+- *"Translate <app>'s description and keywords into German and French."*
+
+**Performance**
+- *"How many downloads did all my apps get last week?"*
+- *"Pull last month's proceeds broken down by country."*
+- *"How many active subscribers do I have, and what's the recent churn?"*
+
+**Releases & the rest of the API** (via `raw_request`)
+- *"Create a new App Store version (1.4.0) for <app>."*
+- *"Summarize this week's 1-star reviews and draft polite replies."*
+- *"List my latest TestFlight builds and which beta groups can see them."*
+- *"What's <app>'s price and which territories is it available in?"*
+
+> **Dedicated tools cover it all:** app management, localization, screenshots
+> (incl. *seeing* them), sales/subscriptions/analytics, ASO audit, dry-run,
+> **customer reviews, TestFlight, in-app purchases, pricing, availability, and
+> age-rating**. Anything else in the App Store Connect API is still reachable
+> through the **`raw_request`** escape hatch — just ask.
+
 ## Common workflows
 
 ### Update keywords or description

package/docs/TOOLS.md

@@ -266,6 +266,86 @@ Download + decompress + parse an instance's segments into rows.
 
 ---
 
+## Customer reviews
+
+### list_customer_reviews
+- `appId` **(required)**
+- `rating` — filter to a star rating 1–5
+- `territory` — 3-letter code, e.g. `USA`, `GBR`
+- `sort` — `-createdDate` (default), `createdDate`, `rating`, `-rating`
+- `limit` — max reviews (default 50)
+- **Returns:** reviews with `rating`, `title`, `body`, `reviewerNickname`, `createdDate`, `territory`, and `hasResponse`.
+
+### reply_to_customer_review
+Posts a **public** reply (confirm the text with the user first).
+- `reviewId` **(required)**
+- `responseBody` **(required)** — max ~5970 chars
+
+## TestFlight
+
+### list_builds
+- `appId` **(required)**, `limit` (default 25) — newest first: `version`, `processingState`, upload/expiration dates, min OS.
+
+### list_beta_groups
+- `appId` **(required)** — group `name`, internal/external, public-link status.
+
+### list_beta_testers
+- `appId` **or** `betaGroupId` **(one required)**, `limit` (default 100).
+
+### add_beta_tester
+Invites a tester by email (emails a real person — confirm first).
+- `betaGroupId` **(required)**, `email` **(required)**, `firstName`, `lastName`
+
+## Catalog, pricing & availability
+
+### list_in_app_purchases
+- `appId` **(required)** — `name`, `productId`, type, `state`.
+
+### get_app_price_schedule
+- `appId` **(required)** — base territory + manual price points (raw schedule for inspection).
+
+### list_available_territories
+- `appId` **(required)**, `limit` (default 200) — `{ count, territories: [{ territory, available, releaseDate }] }`.
+
+### get_age_rating
+- `appId` **(required)** — the app's age-rating declaration (content descriptors).
+
+## Provisioning & code signing
+
+### list_bundle_ids
+- `filterIdentifier`, `limit` (default 200)
+
+### register_bundle_id
+- `identifier` **(required)**, `name` **(required)**, `platform` (IOS/MAC_OS/UNIVERSAL)
+
+### list_devices / register_device
+- register: `name` **(required)**, `udid` **(required)**, `platform` (IOS/MAC_OS)
+
+### list_certificates / create_certificate / revoke_certificate
+- `create_certificate` needs a CSR you generate yourself (`csrContent` PEM) + `certificateType` (e.g. IOS_DISTRIBUTION).
+- `revoke_certificate` — `certificateId`.
+
+### list_profiles / create_profile / download_profile / delete_profile
+- `create_profile` — `name`, `profileType` (IOS_APP_DEVELOPMENT/IOS_APP_STORE/IOS_APP_ADHOC), `bundleId` (resource id), `certificateIds[]`, `deviceIds[]` (dev/ad-hoc).
+- `download_profile` — returns base64 `.mobileprovision` in `profileContent`.
+
+## Game Center
+
+### list_game_center_leaderboards / list_game_center_achievements
+- `appId` **(required)** — requires Game Center enabled on the app.
+
+---
+
+## Rate limits
+
+App Store Connect allows ~3,500 requests/hour and returns `429` when exceeded.
+The client handles this automatically: on `429`/`503` it waits (honoring
+`Retry-After` when present, else exponential backoff up to ~16 s) and retries up
+to 4 times. The latest `x-rate-limit` header is kept on the client for visibility.
+See <https://developer.apple.com/documentation/appstoreconnectapi/identifying-rate-limits>.
+
+---
+
 ## Raw API access
 
 ### `raw_request`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appstore-api-mcp",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "MCP server for Apple App Store Connect — edit listings (keywords, descriptions, titles, screenshots), track analytics (downloads, proceeds, subscriptions, retention), run a fleet-wide ASO audit, preview changes with dry-run, and reach the full API. Works with any MCP client (Claude, Codex, Cursor, Windsurf, VS Code, Zed, Gemini CLI, Antigravity, Amazon Q, Goose, and more).",
   "type": "module",
   "bin": {

package/src/client.js

@@ -75,7 +75,7 @@ export class AppStoreConnectClient {
     return url;
   }
 
-  async request(method, path, { query, body } = {}) {
+  async request(method, path, { query, body, _attempt = 0 } = {}) {
     const token = await this._getToken();
     const url = this._buildUrl(path, query);
     const headers = { Authorization: `Bearer ${token}` };
@@ -85,6 +85,21 @@ export class AppStoreConnectClient {
       payload = JSON.stringify(body);
     }
     const res = await fetch(url, { method, headers, body: payload });
+
+    // Rate limiting: App Store Connect returns 429 when the hourly quota is hit.
+    // Respect Retry-After if present, else exponential backoff; retry a few times.
+    if ((res.status === 429 || res.status === 503) && _attempt < 4) {
+      const retryAfter = Number(res.headers.get("retry-after"));
+      const waitMs =
+        retryAfter > 0
+          ? retryAfter * 1000
+          : Math.min(1000 * 2 ** _attempt, 16000);
+      await new Promise((r) => setTimeout(r, waitMs));
+      return this.request(method, path, { query, body, _attempt: _attempt + 1 });
+    }
+    // Expose remaining quota for visibility (parsed from x-rate-limit header).
+    this.rateLimit = res.headers.get("x-rate-limit") || this.rateLimit;
+
     const text = await res.text();
     let data = null;
     if (text) {

package/src/index.js

@@ -1081,6 +1081,513 @@ const tools = [
     },
   },
 
+  // ---- Customer reviews ----
+  {
+    name: "list_customer_reviews",
+    description:
+      "List customer reviews for an app. Filter by rating (1–5) and/or territory (3-letter code, e.g. USA, GBR). Sorted newest-first by default. Each review includes whether you've already responded.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        appId: { type: "string" },
+        rating: { type: "number", description: "Filter to a star rating 1–5" },
+        territory: { type: "string", description: "3-letter territory code, e.g. USA" },
+        sort: {
+          type: "string",
+          description: "'-createdDate' (default, newest first), 'createdDate', 'rating', '-rating'",
+        },
+        limit: { type: "number", description: "Max reviews (default 50)" },
+      },
+      required: ["appId"],
+    },
+    run: async (a) => {
+      const query = {
+        sort: a.sort || "-createdDate",
+        limit: a.limit ?? 50,
+        include: "response",
+      };
+      if (a.rating !== undefined) query["filter[rating]"] = a.rating;
+      if (a.territory) query["filter[territory]"] = a.territory;
+      const data = await client.getAll(
+        `/apps/${a.appId}/customerReviews`,
+        query,
+      );
+      return data.map((x) => ({
+        id: x.id,
+        ...x.attributes,
+        hasResponse: !!(x.relationships?.response?.data),
+      }));
+    },
+  },
+  {
+    name: "reply_to_customer_review",
+    description:
+      "Publicly reply to a customer review. NOTE: this publishes a response visible on the App Store — confirm the text with the user first. responseBody max ~5970 chars.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        reviewId: { type: "string" },
+        responseBody: { type: "string" },
+      },
+      required: ["reviewId", "responseBody"],
+    },
+    run: async (a) =>
+      client.post("/customerReviewResponses", {
+        data: {
+          type: "customerReviewResponses",
+          attributes: { responseBody: a.responseBody },
+          relationships: {
+            review: { data: { type: "customerReviews", id: a.reviewId } },
+          },
+        },
+      }),
+  },
+
+  // ---- TestFlight ----
+  {
+    name: "list_builds",
+    description:
+      "List TestFlight builds for an app (newest first): version, upload/expiration dates, processing state, min OS.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        appId: { type: "string" },
+        limit: { type: "number", description: "Max builds (default 25)" },
+      },
+      required: ["appId"],
+    },
+    run: async (a) => {
+      // The /builds collection supports sort; the app relationship does not.
+      const data = await client.getAll(`/builds`, {
+        "filter[app]": a.appId,
+        sort: "-version",
+        limit: a.limit ?? 25,
+      });
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+  {
+    name: "list_beta_groups",
+    description:
+      "List TestFlight beta groups for an app (internal/external, public-link status).",
+    inputSchema: {
+      type: "object",
+      properties: { appId: { type: "string" } },
+      required: ["appId"],
+    },
+    run: async (a) => {
+      const data = await client.getAll(`/apps/${a.appId}/betaGroups`);
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+  {
+    name: "list_beta_testers",
+    description:
+      "List TestFlight beta testers — either for a whole app (pass appId) or a specific group (pass betaGroupId).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        appId: { type: "string" },
+        betaGroupId: { type: "string" },
+        limit: { type: "number", description: "Max testers (default 100)" },
+      },
+    },
+    run: async (a) => {
+      let data;
+      if (a.betaGroupId)
+        data = await client.getAll(
+          `/betaGroups/${a.betaGroupId}/betaTesters`,
+          { limit: a.limit ?? 100 },
+        );
+      else if (a.appId)
+        data = await client.getAll(`/betaTesters`, {
+          "filter[apps]": a.appId,
+          limit: a.limit ?? 100,
+        });
+      else throw new Error("Provide appId or betaGroupId.");
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+  {
+    name: "add_beta_tester",
+    description:
+      "Add a beta tester to a TestFlight group by email (sends them an invite). NOTE: this emails a real person — confirm with the user first.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        betaGroupId: { type: "string" },
+        email: { type: "string" },
+        firstName: { type: "string" },
+        lastName: { type: "string" },
+      },
+      required: ["betaGroupId", "email"],
+    },
+    run: async (a) => {
+      const attributes = { email: a.email };
+      if (a.firstName) attributes.firstName = a.firstName;
+      if (a.lastName) attributes.lastName = a.lastName;
+      return client.post("/betaTesters", {
+        data: {
+          type: "betaTesters",
+          attributes,
+          relationships: {
+            betaGroups: { data: [{ type: "betaGroups", id: a.betaGroupId }] },
+          },
+        },
+      });
+    },
+  },
+
+  // ---- Catalog, pricing & availability ----
+  {
+    name: "list_in_app_purchases",
+    description:
+      "List the in-app purchase products for an app (name, product id, type, state).",
+    inputSchema: {
+      type: "object",
+      properties: { appId: { type: "string" } },
+      required: ["appId"],
+    },
+    run: async (a) => {
+      const data = await client.getAll(`/apps/${a.appId}/inAppPurchasesV2`);
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+  {
+    name: "list_available_territories",
+    description:
+      "List the territories (countries/regions) where an app is available. Returns territory codes and currencies.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        appId: { type: "string" },
+        limit: { type: "number", description: "Max territories (default 200)" },
+      },
+      required: ["appId"],
+    },
+    run: async (a) => {
+      // v2 availability model: app → appAvailabilityV2 → territoryAvailabilities.
+      // Follow the relationship's own related link (it points at the /v2 API).
+      const av = await client.get(`/apps/${a.appId}/appAvailabilityV2`);
+      const related =
+        av.data?.relationships?.territoryAvailabilities?.links?.related;
+      if (!related) return { note: "No availability record for this app." };
+      // Apple caps page size at 200; getAll paginates to cover the rest.
+      const data = await client.getAll(related, {
+        limit: Math.min(a.limit ?? 200, 200),
+      });
+      const territories = data
+        .map((x) => {
+          // The territory code is base64-encoded JSON in the item id: {"s":appId,"t":"USA"}.
+          let territory = null;
+          try {
+            territory = JSON.parse(
+              Buffer.from(x.id, "base64").toString("utf8"),
+            ).t;
+          } catch {
+            /* ignore */
+          }
+          return {
+            territory,
+            available: x.attributes?.available,
+            releaseDate: x.attributes?.releaseDate,
+          };
+        })
+        .filter((x) => x.territory);
+      return {
+        availableInNewTerritories: av.data?.attributes?.availableInNewTerritories,
+        count: territories.length,
+        territories,
+      };
+    },
+  },
+  {
+    name: "get_age_rating",
+    description:
+      "Get an app's age-rating declaration (the content descriptors that determine its age rating).",
+    inputSchema: {
+      type: "object",
+      properties: { appId: { type: "string" } },
+      required: ["appId"],
+    },
+    run: async (a) => {
+      const res = await client.get(`/apps/${a.appId}/appInfos`, {
+        include: "ageRatingDeclaration",
+        limit: 1,
+      });
+      const decl = (res.included || []).find(
+        (x) => x.type === "ageRatingDeclarations",
+      );
+      return decl ? { id: decl.id, ...decl.attributes } : { note: "No age-rating declaration found." };
+    },
+  },
+  {
+    name: "get_app_price_schedule",
+    description:
+      "Get an app's price schedule (base territory + manual price points). Pricing in the App Store Connect API is multi-step; this returns the schedule with its included prices for inspection.",
+    inputSchema: {
+      type: "object",
+      properties: { appId: { type: "string" } },
+      required: ["appId"],
+    },
+    run: async (a) =>
+      client.get(`/apps/${a.appId}/appPriceSchedule`, {
+        include: "baseTerritory,manualPrices",
+        "limit[manualPrices]": 50,
+      }),
+  },
+
+  // ---- Provisioning & code signing ----
+  {
+    name: "list_bundle_ids",
+    description:
+      "List registered Bundle IDs (app identifiers). Optionally filter by identifier.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        filterIdentifier: { type: "string" },
+        limit: { type: "number", description: "Max (default 200)" },
+      },
+    },
+    run: async (a) => {
+      const q = { limit: a.limit ?? 200 };
+      if (a.filterIdentifier) q["filter[identifier]"] = a.filterIdentifier;
+      const data = await client.getAll("/bundleIds", q);
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+  {
+    name: "register_bundle_id",
+    description:
+      "Register a new Bundle ID. platform: IOS, MAC_OS, or UNIVERSAL.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        identifier: { type: "string", description: "e.g. com.example.app" },
+        name: { type: "string" },
+        platform: { type: "string", description: "IOS (default), MAC_OS, UNIVERSAL" },
+      },
+      required: ["identifier", "name"],
+    },
+    run: async (a) =>
+      client.post("/bundleIds", {
+        data: {
+          type: "bundleIds",
+          attributes: {
+            identifier: a.identifier,
+            name: a.name,
+            platform: a.platform || "IOS",
+          },
+        },
+      }),
+  },
+  {
+    name: "list_devices",
+    description: "List registered devices (UDIDs) for ad-hoc/development distribution.",
+    inputSchema: {
+      type: "object",
+      properties: { limit: { type: "number", description: "Max (default 200)" } },
+    },
+    run: async (a) => {
+      const data = await client.getAll("/devices", { limit: a.limit ?? 200 });
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+  {
+    name: "register_device",
+    description: "Register a device by UDID. platform: IOS (default) or MAC_OS.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string" },
+        udid: { type: "string" },
+        platform: { type: "string", description: "IOS (default), MAC_OS" },
+      },
+      required: ["name", "udid"],
+    },
+    run: async (a) =>
+      client.post("/devices", {
+        data: {
+          type: "devices",
+          attributes: {
+            name: a.name,
+            udid: a.udid,
+            platform: a.platform || "IOS",
+          },
+        },
+      }),
+  },
+  {
+    name: "list_certificates",
+    description: "List code-signing certificates (development & distribution).",
+    inputSchema: {
+      type: "object",
+      properties: { limit: { type: "number", description: "Max (default 200)" } },
+    },
+    run: async (a) => {
+      const data = await client.getAll("/certificates", { limit: a.limit ?? 200 });
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+  {
+    name: "create_certificate",
+    description:
+      "Create a code-signing certificate from a CSR. You must generate the Certificate Signing Request yourself (openssl) and pass its PEM as csrContent. certificateType e.g. IOS_DEVELOPMENT, IOS_DISTRIBUTION, DEVELOPMENT, DISTRIBUTION.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        csrContent: { type: "string", description: "PEM contents of the CSR" },
+        certificateType: { type: "string" },
+      },
+      required: ["csrContent", "certificateType"],
+    },
+    run: async (a) =>
+      client.post("/certificates", {
+        data: {
+          type: "certificates",
+          attributes: {
+            csrContent: a.csrContent,
+            certificateType: a.certificateType,
+          },
+        },
+      }),
+  },
+  {
+    name: "revoke_certificate",
+    description: "Revoke (delete) a code-signing certificate by id.",
+    inputSchema: {
+      type: "object",
+      properties: { certificateId: { type: "string" } },
+      required: ["certificateId"],
+    },
+    run: async (a) => {
+      await client.delete(`/certificates/${a.certificateId}`);
+      return { revoked: a.certificateId };
+    },
+  },
+  {
+    name: "list_profiles",
+    description: "List provisioning profiles (includes the bundle id they target).",
+    inputSchema: {
+      type: "object",
+      properties: { limit: { type: "number", description: "Max (default 200)" } },
+    },
+    run: async (a) => {
+      const data = await client.getAll("/profiles", {
+        limit: a.limit ?? 200,
+        include: "bundleId",
+      });
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+  {
+    name: "create_profile",
+    description:
+      "Create a provisioning profile. profileType e.g. IOS_APP_DEVELOPMENT, IOS_APP_STORE, IOS_APP_ADHOC. Pass the bundleId resource id, plus certificate ids (and device ids for development/ad-hoc).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string" },
+        profileType: { type: "string" },
+        bundleId: { type: "string", description: "bundleId resource id" },
+        certificateIds: { type: "array", items: { type: "string" } },
+        deviceIds: { type: "array", items: { type: "string" } },
+      },
+      required: ["name", "profileType", "bundleId", "certificateIds"],
+    },
+    run: async (a) => {
+      const relationships = {
+        bundleId: { data: { type: "bundleIds", id: a.bundleId } },
+        certificates: {
+          data: (a.certificateIds || []).map((id) => ({
+            type: "certificates",
+            id,
+          })),
+        },
+      };
+      if (a.deviceIds && a.deviceIds.length)
+        relationships.devices = {
+          data: a.deviceIds.map((id) => ({ type: "devices", id })),
+        };
+      return client.post("/profiles", {
+        data: {
+          type: "profiles",
+          attributes: { name: a.name, profileType: a.profileType },
+          relationships,
+        },
+      });
+    },
+  },
+  {
+    name: "download_profile",
+    description:
+      "Get a provisioning profile's contents (base64 .mobileprovision in profileContent) by id.",
+    inputSchema: {
+      type: "object",
+      properties: { profileId: { type: "string" } },
+      required: ["profileId"],
+    },
+    run: async (a) => {
+      const res = await client.get(`/profiles/${a.profileId}`);
+      return { id: res.data.id, ...res.data.attributes };
+    },
+  },
+  {
+    name: "delete_profile",
+    description: "Delete a provisioning profile by id.",
+    inputSchema: {
+      type: "object",
+      properties: { profileId: { type: "string" } },
+      required: ["profileId"],
+    },
+    run: async (a) => {
+      await client.delete(`/profiles/${a.profileId}`);
+      return { deleted: a.profileId };
+    },
+  },
+
+  // ---- Game Center ----
+  {
+    name: "list_game_center_leaderboards",
+    description:
+      "List Game Center leaderboards for an app (requires Game Center enabled on the app).",
+    inputSchema: {
+      type: "object",
+      properties: { appId: { type: "string" } },
+      required: ["appId"],
+    },
+    run: async (a) => {
+      const detail = await client.get(`/apps/${a.appId}/gameCenterDetail`);
+      const detailId = detail.data && detail.data.id;
+      if (!detailId)
+        return { note: "Game Center is not enabled for this app." };
+      const data = await client.getAll(
+        `/gameCenterDetails/${detailId}/gameCenterLeaderboards`,
+      );
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+  {
+    name: "list_game_center_achievements",
+    description:
+      "List Game Center achievements for an app (requires Game Center enabled on the app).",
+    inputSchema: {
+      type: "object",
+      properties: { appId: { type: "string" } },
+      required: ["appId"],
+    },
+    run: async (a) => {
+      const detail = await client.get(`/apps/${a.appId}/gameCenterDetail`);
+      const detailId = detail.data && detail.data.id;
+      if (!detailId)
+        return { note: "Game Center is not enabled for this app." };
+      const data = await client.getAll(
+        `/gameCenterDetails/${detailId}/gameCenterAchievements`,
+      );
+      return data.map((x) => ({ id: x.id, ...x.attributes }));
+    },
+  },
+
   // ---- Generic escape hatch ----
   {
     name: "raw_request",