mcp-googleplay-reviews

A small, reviews-only MCP server for Google Play, backed by the Android Publisher API v3. It lets an agent read user reviews and reply to them — and deliberately nothing else.

Why so narrow?

The capability boundary is the trust guarantee. This server exposes only the two review tools below. There is intentionally no release, track, listing, image, in-app-product, subscription, or APK/AAB upload tool, so the service account you give it can't be used to ship a release or change your store listing. Scope the service account itself narrowly too — grant only the Reply to reviews permission in Play Console.

It is also dependency-free — pure Node 18+ (fetch + built-in crypto), no third-party packages — so there is no supply chain to audit beyond this one file (index.mjs).

Tools

Tool	Description
list_reviews	List recent user reviews for an app, including any existing developer reply. Args: packageName, maxResults, translationLanguage, startToken; returns nextPageToken for paging.
reply_to_review	Reply to a review (packageName, reviewId, replyText, max 350 chars). Replying again edits the existing reply.

Note: Google Play only returns reviews where the user left text, and typically only from the last week — this is an API limitation, not a limitation of this server.

Authentication

Create a Google Cloud service account with a JSON key, enable the Google Play Android Developer API, and in Play Console → Users and permissions invite the service account's email with only the Reply to reviews permission.

Env var	What
GOOGLE_APPLICATION_CREDENTIALS	Path to the service-account JSON key file

The key is read only to sign a short-lived RS256 JWT, which is exchanged for an OAuth access token scoped to androidpublisher; the key is never logged, copied, or sent anywhere but Google's token endpoint.

Run

GOOGLE_APPLICATION_CREDENTIALS=/path/to/service-account.json \
npx -y github:ForgeHQ-Agents/mcp-googleplay-reviews

The agent passes the app's package name (e.g. com.example.app) as packageName.

Test

npm test   # node --test, zero dependencies

License

MIT