Back to MCP Trust Indexm8ven
52
/ 100
9 hours ago
glama

mobile-release-mcp

MCP server for managing mobile app releases on App Store Connect and Google Play. It exposes 101 tools for iOS and Android release lifecycle and reacts to EAS/GitHub webhooks automatically.

→ Jeronimo0228/mobile-release-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 5 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: EAS_WEBHOOK_SECRET, GITHUB_WEBHOOK_SECRET, MCP_HTTP_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies5 high25 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highhono@4.7.0GHSA-3vhc-576x-3qv4

Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)

highhono@4.7.0GHSA-88fw-hqm2-52qc

hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

highhono@4.7.0GHSA-f67f-6cw9-8mq4

Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth Bypass

highhono@4.7.0GHSA-m732-5p4w-x69g

Hono Improper Authorization vulnerability

highhono@4.7.0GHSA-q5qw-h33p-qvwr

Hono vulnerable to arbitrary file access via serveStatic vulnerability

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAPPLE_ISSUER_ID— "": "00000000-0000-0000-0000-000000000000",
configAPPLE_KEY_ID— "": "ABC1234DEF",
configAPPLE_PRIVATE_KEY_BASE64— Alternative: base64-encoded key
configAPPLE_PRIVATE_KEY_PATH— "": "/path/to/AuthKey.p8",
configEAS_PROJECT_MAPPINGS— JSON map EAS project → store IDs
🔐 secretEAS_WEBHOOK_SECRET— EAS HMAC secret
🔐 secretGITHUB_WEBHOOK_SECRET— GitHub HMAC secret
configGOOGLE_SERVICE_ACCOUNT_JSON— Alternative: inline JSON
configGOOGLE_SERVICE_ACCOUNT_KEY_PATH— Path to service account JSON
configLOG_LEVEL— info debug, info, warn, error
configMCP_ALLOWED_ORIGINS— Comma-separated CORS origins (empty = disabled)
🔐 secretMCP_HTTP_API_KEY— Required in HTTP mode (≥32 chars). Bearer token for /mcp
configMCP_PORT— 3000 HTTP server port (when http)
configMCP_TOOLSET— "": "release"
configMCP_TRANSPORT— stdio stdio or http
configWEBHOOK_PORT— 3000 Webhook port in stdio mode
configWEBHOOK_REQUIRE_SECRETS— true Reject webhooks without secrets
configWEBHOOK_STORAGE
configWEBHOOK_STORAGE_PATH— Persistent webhooks — events saved to disk (), survive restarts
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/jeronimo0228-mobile-release-mcp-1kh3ej)](https://m8ven.ai/mcp/jeronimo0228-mobile-release-mcp-1kh3ej)
commit: bd2e611e3a241673638f6cb659a764d6e3cdf0a8
code hash: c5a412524a809771166f64af4fde76165165892f9d9f8a080063c7693986eaec
verified: 7/31/2026, 9:05:44 AM
view raw JSON →