Appfigures CLI — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Appfigures authenticated app metrics and review queries through CLI and MCP: Do interactive authorization and keyring storage remain consistent with MCP access to private app metrics?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

App-store intelligence and owned-app analytics through a local CLI/MCP server.

What we know

Appfigures CLI with `af mcp` stdio mode for app search/catalog, metrics, ranks, reviews, keywords, demographics, advertising and private tracked-app data.

Maintenance / activity evidence

@appfigures/cli 3.0.0 published 2026-08-19T00:39:09.520Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Public catalog/metrics plus private app/account writes depending on credential. Writes: Post/withdraw developer review replies; Track/untrack keywords; Modify tracked-app/account state when enabled.
OS credential-manager token or API key.
Sensitive access: Private revenue/download data, Audience/ad data, Owned-app records, Review responses

Can expose private app-business intelligence and perform write operations; use least-privilege/read-only credentials.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Do interactive authorization and keyring storage remain consistent with MCP access to private app metrics?

The bounded review of the publisher's documented Appfigures authenticated app metrics and review queries through CLI and MCP and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Can expose private app-business intelligence and perform write operations; use least-privilege/read-only credentials.
Public catalog/metrics plus private app/account writes depending on credential.
OS credential-manager token or API key.
Queries and credentials are sent to Appfigures services; local login token is stored in OS credential manager.
Reviewed write actions: Post/withdraw developer review replies; Track/untrack keywords; Modify tracked-app/account state when enabled
Sensitive access: Private revenue/download data, Audience/ad data, Owned-app records, Review responses
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
public implementation repository
complete privacy/retention/security policy
full environment-variable list
Implementation is maintained in a private monorepo; public GitHub link is an issue tracker.
Most useful features require Appfigures auth/plan.
Some commands mutate account/store state.
Full retention/security detail was not established.
GitHub issues repo is not the implementation source.

Original activity observations

@appfigures/cli 3.0.0 published 2026-08-19T00:39:09.520Z

Technical identity

npm/@appfigures/cli

Exact implementation source: https://www.npmjs.com/package/@appfigures/cli ↗
Reviewed resource type: MCP Server
Package identity: npm:@appfigures/cli

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@appfigures/cli
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
Evidence source ↗
appfigures.com/developers/keys
Source material retained for this review.
Includes references whose attribution is not established.
GitHub repository ↗
appfigures/cli
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher-documented install or connect path; prerequisites and any extra host configuration remain required.
client registration · Claude Code only · Publisher instructions
claude mcp add --transport http appfigures https://mcp.appfigures.com/mcp
Configure / authenticate
MCP100 setup guide
**Recommended:** connect hosted OAuth MCP at https://mcp.appfigures.com/mcp. `@appfigures/cli` is a CLI; its local `af mcp` is deprecated and is NOT the preferred setup. Use `npx @appfigures/cli auth login` only for CLI mode.
Check connection
Suggested check
Authenticate through OAuth host and inspect read-only app/account tools; do not perform API updates.
Remove / uninstall / revoke
MCP100 setup guide
For recommended hosted OAuth configuration: `claude mcp remove appfigures` if registered with that name, or remove the Appfigures connector in the chosen host. For CLI credentials the official `af auth logout` removes local stored sign-in; these are independent actions.
Client removal, software uninstall, persistent-data deletion and credential revocation are separate actions.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove appfigures

Official Documentation & Sources

https://www.npmjs.com/package/@appfigures/cli ↗

What it does

Appfigures CLI with `af mcp` stdio mode for app search/catalog, metrics, ranks, reviews, keywords, demographics, advertising and private tracked-app data.

Capability: Data & Databases
Resource type: MCP Server
Industry: Media & Marketing
Best fit: App-store intelligence and owned-app analytics through a local CLI/MCP server.

Representative uses

Search app stores
Query metrics/rankings/reviews
Analyze audience and keywords
Track/untrack keywords
Reply/withdraw developer review responses where permitted

Limitations

Implementation is maintained in a private monorepo; public GitHub link is an issue tracker.
Most useful features require Appfigures auth/plan.
Some commands mutate account/store state.
Full retention/security detail was not established.
GitHub issues repo is not the implementation source.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: OS credential-manager token or API key.
Permissions: Public catalog/metrics plus private app/account writes depending on credential.
Data handling: Queries and credentials are sent to Appfigures services; local login token is stored in OS credential manager.
Cost: plan_based
Risk and cautions: Can expose private app-business intelligence and perform write operations; use least-privilege/read-only credentials.

Access scope and cautions

Write actions: Post/withdraw developer review replies Track/untrack keywords Modify tracked-app/account state when enabled
Sensitive access: Private revenue/download data Audience/ad data Owned-app records Review responses
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Search app stores; Query metrics/rankings/reviews; Analyze audience and keywords; Track/untrack keywords; Reply/withdraw developer review responses where permitted.

What setup and authentication are documented?

Recorded installation/entrypoint step: npm install -g @appfigures/cli && af auth login && af mcp. Recorded transport: stdio. Recorded environment-variable notes: APPFIGURES_API_KEY (optional alternative to login). No configuration values are supplied here. Prerequisites: Node.js 22+; Appfigures account/API token. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Interactive browser login or personal access token/API key; token stored in OS credential manager.

Can it modify data or perform write operations?

Documented write actions include: Post/withdraw developer review replies; Track/untrack keywords; Modify tracked-app/account state when enabled. Recorded permission boundary: Public catalog/metrics plus private app/account writes depending on credential.

What data-handling boundary should I consider?

Queries and credentials are sent to Appfigures services; local login token is stored in OS credential manager. Recorded sensitive-access context: Private revenue/download data; Audience/ad data; Owned-app records; Review responses.

What limitations and risks should I check before use?

Can expose private app-business intelligence and perform write operations; use least-privilege/read-only credentials. Implementation is maintained in a private monorepo; public GitHub link is an issue tracker. Most useful features require Appfigures auth/plan. Some commands mutate account/store state. Full retention/security detail was not established. GitHub issues repo is not the implementation source. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

What cost model is recorded?

The reviewed cost model is plan based. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.

Is this an official MCP?

Appfigures is listed as First-party MCP in MCP100’s current evidence.