pubship/pubship

**Google Play developer workflows, from your own computer.** Inspect releases, understand reviews and reports, and prepare explicitly authorized changes from your MCP client.
Start locally
Use your own service account with permissions for your apps in Play Console. Keep its private JSON outside this repository. Grant only the permissions needed for your intended operations. Never paste credentials into an assistant conversation.
This starts the stdio server, which waits for an MCP client. For a credential-free installation check:
The commands above install the published PyPI package. A source checkout may contain changes that are not yet published; after uv sync, use uv run pubship --check to check the local version.
Connect an assistant
Claude Code
Set the environment variables above in the shell launching your client. Restart the client after changing its environment.
Codex
Cursor and Gemini CLI
Client manifests in this repository declare the local service-account key path and package names. See client setup for configuration and the Gemini CLI installation command. For agent-assisted installation, read llms-install.md. Provide only the key file path, never its contents.
Generic MCP harness
Configure a stdio server with executable uvx, argument pubship, and your local environment. For clients that require explicit configuration:
Client configuration stays on your computer. Consult setup for alternate authentication modes, enabled APIs, reports and permission boundaries.
What can it do?
The pinned inventory contains 172 method definitions. 170 have implementations, one subscription-archive method is unsupported by Google, and voided-purchases access is deliberately disabled by project policy. Disabled operations cannot be called through local or self-host tools.
- Read releases, reviews, Android vitals and scoped bulk reports.
- Inspect catalog, subscription, product and account resources with separate sensitive-data grants.
- Prepare and review writes with explicit app/method permissions and single-use execution.
- Keep local file transfers bounded and separate publication from edit staging.
Reads are the default. Optional writes and sensitive reads require explicit configuration. Provider text is untrusted data. Missing data is not zero; a submitted change is not necessarily published. No operation count is a claim of live Google verification.
Explore the contracts and boundaries
- Complete method inventory
- Related synthetic tests
- Edit lifecycle
- Purchase operations
- Artifact transfers
- Self-host configuration
Self-hosting for your own accounts
pubship-server retains the HTTP implementation for infrastructure you control. It refuses to start without PUBSHIP_SERVER_ALLOWED_EMAILS. Sign-in requires a signed Google ID token, a verified exact email match and nonce binding before any Google credentials are persisted. Removing an account from the allowlist invalidates its stored grants on next use. Legacy grants without verified identity must reconnect. Enrollment stays closed until the operator explicitly enables it.