PubShip

PubShip

Google Play developer workflows, from your own computer. Inspect releases, understand reviews and reports, and prepare explicitly authorized changes from your MCP client.

Start locally

Use your own service account with permissions for your apps in Play Console. Keep its private JSON outside this repository. Grant only the permissions needed for your intended operations. Never paste credentials into an assistant conversation.

export GOOGLE_APPLICATION_CREDENTIALS=/absolute/private/path/service-account.json
export GOOGLE_PLAY_PACKAGES=com.example.app
uvx pubship

This starts the stdio server, which waits for an MCP client. For a credential-free installation check:

uvx pubship --check

The commands above install the published PyPI package. A source checkout may contain changes that are not yet published; after uv sync, use uv run pubship --check to check the local version.

Connect an assistant

Claude Code

claude mcp add --transport stdio pubship -- uvx pubship

Set the environment variables above in the shell launching your client. Restart the client after changing its environment.

Codex

codex mcp add pubship -- uvx pubship

Cursor and Gemini CLI

Client manifests in this repository declare the local service-account key path and package names. See client setup for configuration and the Gemini CLI installation command. For agent-assisted installation, read llms-install.md. Provide only the key file path, never its contents.

Generic MCP harness

Configure a stdio server with executable uvx, argument pubship, and your local environment. For clients that require explicit configuration:

{
  "mcpServers": {
    "pubship": {
      "command": "uvx",
      "args": ["pubship"],
      "env": {
        "GOOGLE_APPLICATION_CREDENTIALS": "/absolute/private/path/service-account.json",
        "GOOGLE_PLAY_PACKAGES": "com.example.app"
      }
    }
  }
}

Client configuration stays on your computer. Consult setup for alternate authentication modes, enabled APIs, reports and permission boundaries.

What can it do?

The pinned inventory contains 172 method definitions. 170 have implementations, one subscription-archive method is unsupported by Google, and voided-purchases access is deliberately disabled by project policy. Disabled operations cannot be called through local or self-host tools.

• Read releases, reviews, Android vitals and scoped bulk reports.
• Inspect catalog, subscription, product and account resources with separate sensitive-data grants.
• Prepare and review writes with explicit app/method permissions and single-use execution.
• Keep local file transfers bounded and separate publication from edit staging.

Reads are the default. Optional writes and sensitive reads require explicit configuration. Provider text is untrusted data. Missing data is not zero; a submitted change is not necessarily published. No operation count is a claim of live Google verification.

Explore the contracts and boundaries

• Complete method inventory
• Related synthetic tests
• Edit lifecycle
• Purchase operations
• Artifact transfers
• Self-host configuration

Self-hosting for your own accounts

pubship-server retains the HTTP implementation for infrastructure you control. It refuses to start without PUBSHIP_SERVER_ALLOWED_EMAILS. Sign-in requires a signed Google ID token, a verified exact email match and nonce binding before any Google credentials are persisted. Removing an account from the allowlist invalidates its stored grants on next use. Legacy grants without verified identity must reconnect. Enrollment stays closed until the operator explicitly enables it.

There is no project-run Google-connected service. See the local-first decision and self-host setup.

Release notes

PubShip 0.24.2 improves tool descriptions and approval hints, and checks the same definitions across source and packaged installs. See the changelog for earlier versions. Source versions can precede package publication.

Development

Tool definition quality documents the TDQS 1.2 offline checks, reviewed heuristic findings and MCP contract regression coverage. Offline lint is not a model-scored grade.

env -u GOOGLE_APPLICATION_CREDENTIALS uv sync --frozen --all-extras --group browser --group tdqs
env -u GOOGLE_APPLICATION_CREDENTIALS uv run --frozen --all-extras --group browser --group tdqs pytest
env -u GOOGLE_APPLICATION_CREDENTIALS uv run ruff check .
env -u GOOGLE_APPLICATION_CREDENTIALS uv run ruff format --check .
env -u GOOGLE_APPLICATION_CREDENTIALS uv run python scripts/generate_catalog.py --check
env -u GOOGLE_APPLICATION_CREDENTIALS uv run python scripts/generate_verification.py --check
env -u GOOGLE_APPLICATION_CREDENTIALS uv run python scripts/distribution_metadata.py --check
env -u GOOGLE_APPLICATION_CREDENTIALS uv build
env -u GOOGLE_APPLICATION_CREDENTIALS uv run python scripts/check_artifacts.py

Tests use fake providers. Browser tests require installed Playwright engines; backup integration tests require age. Record unavailable platform checks honestly. See contribution policy, release process, and security reporting.

Intended use

PubShip helps developers automate their own Google Play distribution work. It runs on your computer or on infrastructure you control, with your own Google credentials and Play Console permissions. The PubShip project does not run a hosted service and never receives your credentials. Use it only for apps and developer accounts that you or your organization own, and follow Google's Play Developer API Terms. Hosted PubShip instances run by others are not provided or endorsed by the PubShip project.

PubShip is an independent open-source project and is not affiliated with, endorsed by, or sponsored by Google. Google, Google Play and Android are trademarks of Google LLC.

License

PubShip is free software under the GNU Affero General Public License v3.0 only (AGPL-3.0-only). Copyright (C) 2026 Denys Vorobyov. For other license terms, contact [email protected].

Trademarks · Third-party notices · Website