Manage App Store Connect and Google Play with Mağaza MCP

What Is Mağaza MCP?

Mağaza MCP is an open-source Model Context Protocol server that gives AI assistants access to both App Store Connect and Google Play from a single installation. It is designed for developers and app operators who need to inspect, compare, and manage iOS and Android store data without switching between separate integrations.

The server runs locally on your machine and communicates directly with Apple and Google. There is no intermediary service. Apple tools use the appstore__ prefix, Google Play tools use play__, and cross-store or general API tools use magaza__.

Its distinguishing feature is the ability to answer cross-store questions in one operation. For example, your assistant can compare the Turkish price of the same subscription on App Store and Google Play, pair corresponding iOS and Android applications, or investigate a purchase configuration problem across both stores.

Key Features

• One MCP server for two stores: Connect App Store Connect, Google Play, or both.
• Cross-store workflows: Compare subscriptions, produce a combined application overview, and diagnose in-app purchase configuration across both platforms.
• 27 focused tools: A dual-store installation exposes 27 tools for common store operations and general API access.
• Full API coverage: Search and invoke 1,440 operations from App Store Connect API v4.5, Android Publisher API v3, and Play Developer Reporting API v1beta1.
• Low context overhead: The complete API catalog is accessed through search and dispatch tools instead of exposing all 1,440 operations as separate MCP tools.
• Local credential storage: Credentials are kept in macOS Keychain when available, with a permission-restricted file fallback on systems where Keychain cannot be used.
• Confirmation for writes: Data-changing operations require an explicit onayla=true confirmation.
• Read-only mode: Write tools can be removed from the model's tool list entirely.
• No telemetry: The project does not send analytics, error reports, or usage data.

Prerequisites

Install Node.js 18 or newer before running the package. You also need suitable credentials for each store you want to connect.

App Store Connect Requirements

Create an App Store Connect API key and keep its Key ID, Issuer ID, and .p8 file available during setup. The App Manager role is sufficient for most operations. User and access management endpoints, along with some analytics reports, may require higher privileges.

The key must be an App Store Connect API key. StoreKit and push notification keys cannot be used as substitutes.

Google Play Requirements

1. Invite the service account through Play Console → Users and permissions, then grant access to the relevant applications.
2. Enable both Android Publisher API and Play Developer Reporting API in the associated Google Cloud project.

The Reporting API is required not only for crash metrics but also for application discovery. Android Publisher API does not provide an endpoint for listing all applications available to an account.

Contracts, tax details, and banking information cannot be read through these APIs. Apple does not expose that information through App Store Connect API keys.

Install Mağaza MCP

Start the interactive installer with one command:

npx magaza-mcp kur

The wizard guides you through the following steps:

1. Select App Store Connect, Google Play, or both stores.
2. Enter the App Store Connect Key ID and Issuer ID, then provide the path to the .p8 file.
3. Provide the path to the Google Play service-account JSON file.
4. Select the detected AI clients where the MCP configuration should be installed.
5. Choose whether the server should operate in read-only mode.

The installer validates the Apple and Google credentials with real API requests before saving them. Credentials are not written into the AI client's configuration file. The configuration contains only information such as which stores are enabled through MAGAZALAR.

On macOS, the credentials are stored in Keychain. If Keychain is unavailable, the project falls back to a file with 0600 permissions.

Supported MCP Clients

The installer supports Claude Code, Claude Desktop, Antigravity, Cursor, Windsurf, and Codex. It updates only the magaza-mcp entry, preserves unrelated configuration, creates a .magaza-mcp-yedek backup before writing, and performs atomic writes.

Restart any open client applications after setup so they can load the new MCP server.

Verify the Installation

Use the status and tool-list commands to confirm the result:

npx magaza-mcp durum
npx magaza-mcp durum --json
npx magaza-mcp araclar
npx magaza-mcp surum
npx magaza-mcp yardim

durum reports which stores are connected, while araclar lists the installed tools. Tools marked with ✎ can modify store data.

Basic Usage

Mağaza MCP is intended to be used through natural-language requests in your MCP-compatible assistant. Once the client has restarted, begin with a simple inventory request:

List my applications in both stores and show where each one is currently published.

When both stores are connected, magaza__genel_bakis combines the application lists, pairs matching iOS and Android products, and separates applications found in only one store.

Compare Subscription Prices

Ask the assistant to compare a subscription for a particular country:

How much does the monthly subscription for Note Keeper cost in App Store and Google Play in Turkey? Is there a difference?

The magaza__abonelik_karsilastir tool compares product identifiers, billing periods, and country-specific prices. It also converts the country code into the form expected by each store.

Diagnose Purchase Problems

For a customer who paid but did not receive premium access, use a request such as:

A customer says they paid but premium access was not activated. Check the purchase setup in both stores and summarize the likely causes.

The magaza__iap_teshis tool checks whether products are published, whether pricing exists in the relevant country, and whether a Google Play base plan is available to new subscribers. If you provide a Play purchase token, the tool can validate that token as part of the diagnosis.

Inspect App Store Connect

App Store-specific tools can list applications, releases, TestFlight builds, reviews, subscription groups, subscription prices, in-app purchases, TestFlight groups, and sales reports. Example requests include:

• Which App Store version is currently stuck in review?
• Has the TestFlight build I uploaded yesterday finished processing?
• Summarize the one-star and two-star reviews from the last week.
• Download the daily sales report for this application.

Store metadata and review responses can also be changed, but those operations require explicit confirmation.

Inspect Google Play

Google Play tools cover applications, release tracks, reviews, subscriptions, base-plan pricing, one-time products, purchase validation, voided purchases, and Android vitals crash rates. Example requests include:

• Which version is on the production track, and what percentage of users receives it?
• Has the crash rate increased during the last 14 days?
• Is this purchase token valid, and is the subscription still active?
• Show refunded or revoked purchases from the available period.

Google only exposes approximately the most recent week of reviews through the relevant API. Voided-purchase data is limited to the last 30 days.

Safely Perform Write Operations

Tools such as appstore__yorum_yanitla, appstore__metin_guncelle, and play__yorum_yanitla can alter store data. They do not execute immediately on the first request. Instead, the server returns the proposed action and expected request body.

After reviewing the proposal, approve it and have the assistant repeat the operation with:

onayla=true

This confirmation gate is enforced by the server rather than relying solely on the MCP client's interface.

Enable Read-Only Mode

For auditing, reporting, or cautious experimentation, start the server in read-only mode:

npx magaza-mcp --salt-okunur

You can also set:

SALT_OKUNUR=1

With both stores connected, read-only mode reduces the exposed list from 27 tools to 24. Write-specific tools disappear so the model cannot see or call them. The general magaza__cagir dispatcher remains available because it is also required for read operations, but it rejects write operations in read-only mode.

Use the Full API Catalog

The focused tools cover common workflows, but Mağaza MCP also provides access to 1,440 API operations. Instead of placing every operation in the model context, it exposes three general tools:

• magaza__endpoint_ara searches the connected stores' API catalogs and returns matching operation names, HTTP methods, paths, and parameters.
• magaza__sema displays the request-body schema for an operation, which is particularly useful before POST or PATCH requests.
• magaza__cagir invokes the selected operation and fills path parameters automatically.

A useful advanced prompt is:

Search the connected store API for an endpoint that manages this resource. Show me the request schema before attempting any write.

The catalogs are generated from Apple's official App Store Connect OpenAPI specification and Google's Android Publisher and Play Developer Reporting discovery documents. Deprecated Apple operations remain searchable when they are still the only route to a capability, but their summaries begin with [ESKİMİŞ] and they rank lower in search results.

Understand Tool Isolation

The server avoids mixing the stores through several design rules:

• Every store-specific tool has an explicit prefix.
• A tool with the appstore__ prefix never calls Google Play, and a play__ tool never calls Apple.
• Tools for an unselected store are not loaded into memory or shown to the model.
• Cross-store tools exist only when both stores are enabled.
• The magaza argument accepted by dispatch tools is restricted to the stores configured during installation.

A dual-store installation loads 27 tools. App Store-only installations load 14, while Play-only installations load 13. This keeps the MCP context aligned with the configured environment.

Advanced Security Tips

• Do not paste credentials into chat: Run npx magaza-mcp kur yourself and enter credential paths through the local wizard.
• Use read-only mode for analysis: Enable it when you only need release, review, pricing, purchase, or health information.
• Review every proposed write: Confirm the application, resource, locale, and request body before approving onayla=true.
• Grant minimum permissions: Use App Manager on Apple unless a required endpoint explicitly needs more access, and limit the Google service account to the relevant applications.
• Keep system time accurate: Apple JWTs have a 20-minute lifetime, so substantial clock drift can cause authentication failures.

The server validates and encodes path parameters, rejects traversal attempts such as . and .., and validates hosts for absolute URLs. Network traffic is limited to Apple's API, Android Publisher API, Play Developer Reporting API, and Google's OAuth token endpoint.

Troubleshooting

Apple Returns 401

Verify that the Key ID, Issuer ID, and .p8 file belong to the same App Store Connect API key. Check the machine's clock because an incorrectly timed JWT may be rejected. Also confirm that the file is not a StoreKit or push notification key.

Apple Returns 403

The API key may not have the role required for that operation. App Manager covers most workflows, but user management and some reports require additional privileges. Contract, tax, and banking data cannot be retrieved through the API regardless of role.

Google Play Returns 403

Confirm that the service account was invited in Play Console and has access to the target application. Permission changes can take several minutes to propagate. Also verify that Android Publisher API and Play Developer Reporting API are enabled in the Cloud project.

If the failure concerns the legacy inappproducts endpoint, the application may use Google's newer product model. The play__urunler tool handles this by trying oneTimeProducts first and falling back to the legacy model when necessary.

Track Information Appears Slowly

Google Play exposes release-track information through an edit session. Read tools create the session, read the data, and leave it without committing, so no store changes occur. This process requires additional HTTP requests and may therefore take longer.

Development Setup

To work on the project itself, clone the repository and install its dependencies:

git clone https://github.com/tunaarikaya/magaza-mcp.git
cd magaza-mcp
npm install
npm run build
npm run kontrol
npm run dev

npm run build compiles the TypeScript source, npm run kontrol runs type checking without emitting files, and npm run dev starts watch-mode compilation.

To regenerate API catalogs from the three specification files under spec/, run:

node scripts/uret-katalog.mjs

The generated operation catalogs are written under src/katalog/; the operation list is not intended to be maintained manually.

Conclusion

Mağaza MCP provides a practical way to operate App Store Connect and Google Play from one MCP-compatible assistant. Its cross-store tools simplify pricing comparisons, application inventories, and purchase diagnostics, while the searchable full API catalog covers less common operations. Local credential handling, confirmation gates, read-only mode, and the absence of telemetry make it suitable for workflows where store access must remain controlled.