IPATool: An Open-Source CLI for Querying and Downloading App Store Packages
A cross-platform CLI that queries Apple App Store endpoints to search iOS and macOS packages, inspect historical versions, and automate .ipa and .pkg package do
For mobile engineers, reverse engineers, and security analysts examining Apple ecosystem packages, the absence of an official command-line interface for the App Store has long presented a workflow barrier. Developed by open-source creator majd, IPATool provides a streamlined command-line utility that interfaces directly with Apple App Store services to search apps, query past version histories, and download licensed .ipa and .pkg binaries across multiple platforms.
Image source: majd (GitHub: majd/ipatool)
Historically, retrieving official application binaries for testing or regression analysis required maintaining legacy iTunes versions or relying on jailbroken test devices. By facilitating authenticated, scriptable package acquisition directly from modern terminals, IPATool replaces fragile manual procedures with an automated, reproducible workflow.
Cross-Platform Architecture and Multi-OS Package Discovery
A major strength of IPATool is its cross-platform architecture, freeing Apple package operations from exclusive dependence on macOS environments.
The tool provides native builds for Windows, Linux, and macOS, allowing developers to execute package search and retrieval workflows consistently across diverse environments. Engineering teams can easily integrate iOS package inspection into Linux-based CI/CD runners or Windows-based security analysis environments without maintaining dedicated Mac hardware solely for package acquisition.
The scope of supported storefront packages spans the entire modern Apple ecosystem. IPATool can query and manage packages across iOS, iPadOS, tvOS, visionOS, and macOS. Through straightforward CLI queries using application bundle identifiers or search keywords, engineers can rapidly inspect storefront metadata, bundle versions, and internal app IDs directly from the terminal.
Apple ID Authentication, Version Inspection, and Pipeline Integration
IPATool establishes authenticated user sessions directly with Apple Storefront services to manage package licenses and retrieve installation files.
Upon execution, the utility prompts for valid Apple ID credentials and handles two-factor authentication (2FA) interactively from the command line. Once authenticated, the CLI operates strictly against the user's licensed catalog. Users can run the list-purchases command to view acquired free and paid applications linked to their account in real time.
Beyond acquiring the latest release, IPATool supports inspecting historical build manifests via list-versions. By querying the version identifiers preserved on Apple's distribution servers, developers can download specific past revisions of an application. This capability is particularly valuable when reproducing regressions, validating bug fixes across releases, or performing differential binary diffing.
To facilitate automation, IPATool provides first-class support for non-interactive execution and structured JSON output. This enables engineers to pipe results directly into automated security analysis harnesses, regression testing pipelines, and binary archiving systems.
Prerequisites, License Guardrails, and Operational Considerations
Operating as an analytical and developer tool, IPATool adheres to explicit technical and legal boundaries that users must consider during deployment.
First, valid account credentials are required. Accessing the Storefront endpoints necessitates a legitimate Apple ID with completed App Store setup and accepted terms of service, along with successful two-factor verification.
Second, IPATool is designed as a developer utility rather than a DRM circumvention or cracking tool. Package downloads are strictly restricted to applications for which the authenticated account possesses an existing purchase record or official free license. Downloaded binaries retain standard Apple FairPlay encryption and digital signatures.
Finally, operators should account for endpoint rate management. Because IPATool interacts with internal Apple Storefront APIs, excessive high-frequency querying or massive concurrent batch requests can trigger temporary rate limits or session revocations. Production pipelines should incorporate sensible request pacing and backoff strategies.