google-play-mcp-server
MCP server that connects AI assistants to the Google Play Developer API for automated app publishing, subscription management, review monitoring, and tester management.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
WacLabs
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
gplay_list_tracksList all release tracks (internal, alpha, beta, production) with current release details. Shows version codes, release names, status, and rollout fraction for each track. Args: - package_name (string, optional): Android package name. Defaults to env var. Returns: Markdown summary of all track…
gplay_upload_bundleUpload an Android App Bundle (.aab) to a release track. This performs a complete publish workflow: create edit → upload AAB → assign to track → commit. Args: - bundle_path (string): Absolute path to the .aab file - track (string): Target track — "internal", "alpha", "beta", or "production" -…
gplay_get_app_detailsGet the store listing details for the app (title, description, etc.). Args: - language (string, optional): Language code (e.g., "en-US"). Defaults to "en-US". - package_name (string, optional): Android package name. Returns: Markdown with app title, short/full description, and contact info.
gplay_list_reviewsList user reviews from Google Play Store. Shows star ratings, review text, device info, app version, and developer replies. Args: - package_name (string, optional): Android package name. - max_results (number, optional): Max reviews to return (default 20). - translation_language (string, opt…
gplay_reply_reviewReply to a user review on Google Play Store. Args: - review_id (string): The review ID to reply to (from gplay_list_reviews) - reply_text (string): Your reply text - package_name (string, optional): Android package name. Returns: Confirmation with the posted reply. Examples: - First cal…
gplay_list_subscriptionsList all subscription products configured in Google Play Console. Shows product IDs, base plans, pricing, and offer details. Args: - package_name (string, optional): Android package name. - page_size (number, optional): Max results (default 20, max 100). Returns: Markdown summary of all sub…
gplay_get_subscriptionGet detailed information about a specific subscription product. Args: - product_id (string): The subscription product ID (e.g., "premium_monthly") - package_name (string, optional): Android package name. Returns: Detailed markdown with base plans, offers, pricing, and listings.
gplay_list_inapp_productsList all one-time in-app products (consumable and non-consumable). Args: - package_name (string, optional): Android package name. Returns: Markdown summary of all IAP products with pricing.
gplay_get_testersGet the list of tester groups for a specific release track. Note: The API only supports testers managed via Google Groups. Individual email-based testers must be managed through the Play Console UI. Args: - track (string): Release track — "internal", "alpha", "beta", or "production" - package_…
gplay_update_testersUpdate the tester Google Groups for a specific release track. This replaces the current tester groups with the provided list. Only Google Group emails are supported via the API. Args: - track (string): Release track - google_groups (array of strings): Google Group email addresses - package_n…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
GOOGLE_PLAY_PACKAGE_NAMEDefault Android package name for your app com.example.myappGOOGLE_SERVICE_ACCOUNT_KEYAbsolute path to your service account JSON key file /home/user/.config/gcloud/play-console-key.jsonTool handlers catch errors
Only 4/10 tool handlers wrap calls in try/catch (40%)
Wrap each tool handler body in try/catch and return a structured error response.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 2 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/waclabs/google-play-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check