# ShipASO

> Audit any App Store or Google Play listing: measured ranks, keyword gaps, draft copy. Read-only.

- name: io.github.airowe/shipaso
- version: 0.1.0
- connection class: R0 (autonomous)
- trust: 94/100
- quality: 85/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.airowe%2Fshipaso
- tools: https://api.protogrid.dev/v1/servers/io.github.airowe%2Fshipaso/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "shipaso": {
      "type": "http",
      "url": "https://api.shipaso.com/mcp",
      "headers": {
        "Authorization": "Bearer ${SHIPASO_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${SHIPASO_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 99
- freshness: 85
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-97% ~updated-45d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 85/100 (good)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 12 of 12 tools declare readOnlyHint or destructiveHint
- fail `tools.directory_hints`: no tool declares all four of readOnlyHint, destructiveHint, idempotentHint and openWorldHint; missing: audit_play_app (destructiveHint, idempotentHint); proof (destructiveHint, idempotentHint); audit_app (destructiveHint, idempotentHint); …
- pass `tools.token_cost`: about 2,180 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 12, about 2,180 tokens to load them all
- tool set hash: 6357d074b71c8c1911c2ca30dc8a2c8a
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.airowe/shipaso.svg)](https://protogrid.dev/servers/io.github.airowe/shipaso)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://api.shipaso.com/mcp (streamable-http, auth none, reachable true, uptime30d 0.9741379)

## Packages

_none_

## Tools (12)

- `audit_app`: Read-only listing audit: prioritized findings (severity + impact) plus a summary, derived from the live public listing. Read-only — never edits or pushes.
- `audit_play_app`: Read-only GOOGLE PLAY listing audit: screenshot grade, the 30/80/4000 title/short/long-description budget, target-term coverage in the long description (Play's keyword surface), a keyword-stuffing guard, prioritized findings + summary, and capability locks for surfaces a public read can't see. Takes a Play package id (com.foo.bar) or a play.google.com URL — NOT a free-text name (Play has no public name search). Play has NO keyword field. Reads public Play data only; never edits or pushes.
- `audit_play_app_owner`: Read-only audit of YOUR OWN Google Play app via the official Play Developer API — full fidelity including the short description (which the public page can't show), with NO capability locks. Requires a configured Play service account (GOOGLE_PLAY_SERVICE_ACCOUNT). Reads only — it opens and DISCARDS a Play 'edit' and NEVER commits, so it can't publish. Owner-only; for a competitor use audit_play_app.
- `competitor_watch`: Read-only competitor diff: resolves the named competitors and reports their current listings, what changed vs. the last seen state, and a digest line. Read-only metadata comparison; no ranking-algorithm data is invented.
- `keyword_gaps`: Read-only keyword opportunities: terms tracked competitors VISIBLY use that this app doesn't target and doesn't rank top-50 for, sorted by winnability. Inferred from competitor name/subtitle only — never their ranking algorithm.
- `localization_gaps`: Read-only localization expansion recommendations (ROI-sorted locales to add) for one of YOUR connected apps, from its most recent App Store Connect run. A static, bundled heuristic over the locales already read — no live install data is fabricated. Empty until you've run an ASC-connected pass.
- `preview_app`: Read-only ASO snapshot of any App Store app (grade, lead rank, top-10 count, sample). No account or store push — the optimized copy + push commands stay behind the human-approved loop. Works without a key.
- `proof`: Read-only, anonymized aggregate proof across all tracked apps (real rank-win numbers — no app names, no user data). This is the 'prove the rank moved' surface that closes the prepare → approve → push → prove loop. Works without a key.
- `propose_copy`: Returns a DRAFT optimized listing (name/subtitle/keywords/description) with validation for any app. THIS IS A DRAFT ONLY: it does NOT persist a proposal and does NOT push to the App Store. Publishing stays a human-approved action in ShipASO — an agent can draft and read; only a human approves and pushes.
- `rank_check`: Read-only organic rank check across the app's target keywords, plus winnability-ranked opportunities computed from those measured positions. Positions are live-measured, never fabricated.
- `screenshot_coverage`: Read-only screenshot scoring for the app's live store gallery (count, score, grade, levers to improve). Read-only — never uploads or pushes assets.
- `war_room`: Read-only head-to-head rank war room for one of YOUR connected apps: your tracked-keyword rank history vs. live competitor positions on those same keywords. Reads stored data + live competitor ranks; writes nothing.