← Home

Onestore MCP guide

Connect your assistant to your App Store and Google Play management tools.

Connect my assistant

MCP server URL (HTTP + OAuth)

https://www.onestore.so/api/mcp
Add to Cursor

Install the MCP and skill

Node.js 20 or later. Download the script, then run it for your selected assistant. It adds Onestore to the configuration and installs use-onestore for your local account.

curl -fsSL https://www.onestore.so/mcp/onestore.mjs -o onestore.mjs
node onestore.mjs setup --client cursor --origin https://www.onestore.so
View / download script

Open Cursor MCP settings and authenticate Onestore.

Run setup again to update. Edited files and other connections are preserved. Cursor/Claude Code also accept --scope project. To remove this installation:

node onestore.mjs uninstall --client cursor --origin https://www.onestore.so

Also revoke the connection in Onestore to invalidate its access. The installer stores no token; your client manages OAuth.

Verify the connection

After selecting your apps and permissions, ask: “Check my Onestore connection and list my accessible apps.” The assistant should use get_connection and list_apps.

Optional network diagnostic: node onestore.mjs doctor. This checks public OAuth discovery, not your account authentication.

Read the skill · Download the skill bundle

The server also accepts an Onestore key in clients supporting an Authorization header. Create it in settings and keep it in your client’s private storage.

Choose permissions and autonomy

At sign-in, choose a workspace, applications and platforms. Access to future applications is an explicit opt-in. Connections expire within 90 days and can be revoked in settings.

  • read — read data.
  • drafts — edit drafts.
  • uploads — upload and manage files.
  • store — sync, push listings and reply to reviews.
  • publish — submit releases and manage distribution.
  • admin — change settings or delete an Onestore app’s data (owner).

Members can read and edit drafts; other capabilities require an admin or owner, and admin requires an owner. Shared drafts require both platforms. Autonomy grants no extra capabilities: prepare allows drafts/uploads, test adds test distribution, and full allows all already-granted actions. Other actions require approval.

From your build to a release

  1. The AI identifies the app, version, signing and target track. It builds with your project’s tools; iOS requires macOS/Xcode and your signing setup.
  2. It prepares an upload, sends bytes directly to storage, then finalizes the file in Onestore. Limits: .ipa 500 MiB, .aab 200 MiB.
  3. Sending to the store is a separate action. For Apple, the macOS worker uploads the build; the AI follows processing and attaches it to the version. For Google, the build’s track and status determine distribution.
  4. Submission and publication follow the connection’s rights and required approvals. The AI reports the observed state: uploaded, processing, in review or published.

A successful upload does not mean the release is published. Apple/Google agreements, declarations and review still apply. TestFlight group distribution, Apple phased rollout and final release of an approved manual Apple version are not yet exposed.

Understand operations

list_actions → plan_action → execute_operation → get_operation

The catalog supplies current schemas. Each plan preserves its parameters and target state. When approval is required, the user opens the Onestore link. After approval, the AI executes and follows the plan. Plans expire after 24 hours; changed data may require a new plan.

An uncertain operation becomes NEEDS_RECONCILIATION: inspect actual state before retrying. History and approvals are available in settings. The get_guide tool gives the AI the same procedures as the skill.

Troubleshooting

  • No tools: check the /api/mcp URL, HTTP transport and reload the connector.
  • 401: authenticate again; the connection may have expired or been revoked.
  • Missing app or forbidden: check the workspace, applications, platforms and your role.
  • Pending approval: open the approval link with the account that connected the AI.
  • Interrupted upload: do not finalize the file; prepare a new upload if the URL expired.

For support, keep the operation ID and error code. Do not send access tokens or signed upload URLs.