The zdw-mentioned autopkg has the capability of looking at your installed AppStore apps and checking for updates, and further can package them(with embedded receipt/DRM) to a patch mgmt system. https://github.com/autopkg/nmcspadden-recipes/tree/master/Ap... It works with any pkg deployment system, although autopkg itself ships with Munki support. Ansible and osxc by extension are about ConfigMgmt, of course, but conflating mgmt systems is common and understandable.