MCP server exposing App Store Connect TestFlight beta feedback (screenshots, crashes, crash logs) as tools.
Four tools with clear verb-noun naming (list_*, get_*, download_*) and complete input schemas. Descriptions are present and moderately detailed (80-180 chars), explaining what each tool does and what it returns. All parameters have type definitions and descriptions. However, output schemas are not formally documented, responses are described in prose ('Returns raw App Store Connect API JSON') rather than as structured JSON Schema. Error handling is present (input validation with ValueError) but lacks recovery guidance for LLMs. No tool annotations (readOnlyHint, etc.) despite all being read-only operations. Parameter descriptions could be more explicit about constraints (e.g., 'limit must be 1-200' is validated but not stated in the description text).
Download a TestFlight feedback screenshot and return it as image content. Host validation is best-effort: Apple's screenshot CDN host is not publicly documented as a fixed pattern, so we require https and accept Apple-owned hostname suffixes.
Fetch the crash log for one crash feedback submission. Returns raw App Store Connect API JSON (.data.attributes.logText holds the log).
List the most recent TestFlight crash feedback submissions for an app. Returns raw App Store Connect API JSON. asc_app_id is the app's numeric Apple ID.
List the most recent TestFlight screenshot feedback submissions for an app. Returns raw App Store Connect API JSON. asc_app_id is the app's numeric Apple ID.
Output schemas not formally documented. Descriptions state 'Returns raw App Store Connect API JSON' but do not specify field structure, types, or which fields are present. LLMs cannot plan downstream operations or extract specific fields without explicit schema.
Parameter constraints (limit 1-200, app_id digits-only, submission_id alphanumeric+dash) are validated in code but not stated in parameter descriptions. LLMs cannot read validation logic, they rely on description text to understand constraints.
No tool annotations despite all tools being read-only. FastMCP supports readOnlyHint, adding it would signal to agents that these tools are safe to call without side effects.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | 2026-07-28+ | v2 |
Error messages are raised as ValueError but lack recovery guidance. E.g., 'asc_app_id must contain digits only' does not tell the LLM how to recover (e.g., 'Call search_apps() to find the numeric ID').
download_screenshot performs host validation but description does not explicitly state which hosts are allowed. 'Apple-owned hostname suffixes' is vague, should enumerate .apple.com, .mzstatic.com, .icloud.com in the description.