PubShip MCP server

PubShip

<!-- mcp-name: io.github.pubship/pubship -->

Google Play developer workflows, from your own computer. Inspect releases, understand reviews and reports, and prepare explicitly authorized changes from your MCP client.

Start locally

Use your own service account with permissions for your apps in Play Console. Keep its private JSON outside this repository. Grant only the permissions needed for your intended operations. Never paste credentials into an assistant conversation.

export GOOGLE_APPLICATION_CREDENTIALS=/absolute/private/path/service-account.json
export GOOGLE_PLAY_PACKAGES=com.example.app
uvx pubship

This starts the stdio server, which waits for an MCP client. For a credential-free installation check:

uvx pubship --check

The commands above install the published PyPI package. A source checkout may contain changes that are not yet published; after uv sync, use uv run pubship --check to check the local version.

Connect an assistant

Claude Code

claude mcp add --transport stdio pubship -- uvx pubship

Set the environment variables above in the shell launching your client. Restart the client after changing its environment.

Codex

codex mcp add pubship -- uvx pubship

Cursor and Gemini CLI

Client manifests in this repository declare the local service-account key path and package names. See client setup for configuration and the Gemini CLI installation command. For agent-assisted installation, read llms-install.md. Provide only the key file path, never its contents.

Generic MCP harness

Configure a stdio server with executable uvx, argument pubship, and your local environment. For clients that require explicit configuration:

{
  "mcpServers": {
    "pubship": {
      "command": "uvx",
      "args": ["pubship"],
      "env": {
        "GOOGLE_APPLICATION_CREDENTIALS": "/absolute/private/path/service-account.json",
        "GOOGLE_PLAY_PACKAGES": "com.example.app"
      }
    }
  }
}

Client configuration stays on your computer. Consult setup for alternate authentication modes, enabled APIs, reports and permission boundaries.

What can it do?

The pinned inventory contains 172 method definitions. 170 have implementations, one subscription-archive method is unsupported by Google, and voided-purchases access is deliberately disabled by project policy. Disabled operations cannot be called through local or self-host tools.

• Read releases, reviews, Android vitals and scoped bulk reports.
• Inspect catalog, subscription, product and account resources with separate sensitive-data grants.
• Prepare and review writes with explicit app/method permissions and single-use execution.
• Keep local file transfers bounded and separate publication from edit staging.

Reads are the default. Optional writes and sensitive reads require explicit configuration. Provider text is untrusted data. Missing data is not zero; a submitted change is not necessarily published. No operation count is a claim of live Google verification.

Explore the contracts and boundaries

Shortened. The full README is on GitHub.