Connect an AI agent
AppStoreCopilot is a hosted remote MCP server. There is no package to install and no local process to keep running.
Remote MCP endpoint
https://appstorecopilot.com/api/mcp
Add that URL in ChatGPT, Claude, Codex, Cursor, or another client that supports remote MCP servers. When OAuth is offered, choose Connect and sign in to AppStoreCopilot in the browser. You will select one app workspace and the least authority the agent needs.
Secure one-time pairing
From a new AppStoreCopilot workspace, choose the agent-guided setup path. The product creates a single-use pairing code that expires after 15 minutes. Paste the provided setup prompt into your agent; it exchanges the code for a scoped key and never asks you to put App Store Connect or Google Play private credentials in chat.
Keep credentials out of chat
Store private keys, Google service-account JSON, API keys, and pairing codes belong only in AppStoreCopilot's secure browser handoff or your local secret store. AppStoreCopilot will never ask an agent to reveal them.
Existing API-key connections
Existing accounts can continue to configure a remote client with a scoped AppStoreCopilot key. Keep the key in the client's secret store rather than in a repository or shared configuration file.
{"mcpServers": {"appstorecopilot": {"url": "https://appstorecopilot.com/api/mcp","headers": {"Authorization": "Bearer <ASC_API_KEY>"}}}}
Verify the connection
Ask your agent:
Show my AppStoreCopilot onboarding status and the next safe action.
A normal end-user account exposes 55 reviewed launch tools. The exact list is filtered by the connection's scope; internal billing, support, analytics, experiments, Firebase administration, RevenueCat, and AppStoreSpy tools are not available to ordinary users.
Troubleshooting
The client asks you to sign in
Complete the browser authorization and select the intended app workspace. The client should reconnect automatically after consent.
A tool is missing
Tool discovery is scope-aware. Reconnect with the required authority, or use the dashboard if the operation is intentionally human-only.
The server returns 429
Respect the Retry-After header before retrying. Reuse the same idempotency key for a retryable write so a network retry cannot duplicate work.