Shortcut MCP Server: What It Covers, and What It Doesn't
This is about Shortcut the project-management tool — the Stories-and-Epics tracker formerly called Clubhouse — not Apple Shortcuts. (Apple Shortcuts MCP servers exist too, and they’re all community projects; this post isn’t about those.)
Yes — Shortcut ships an official MCP server, and it’s the good kind. It’s remote and hosted by Shortcut at https://mcp.shortcut.com/mcp, authentication is OAuth, and there’s no API token to mint or local process to babysit. Point an MCP-compatible client at that URL, approve the OAuth prompt, and an AI can search your workspace, open Stories, update them, and write Docs.
Shortcut is one of many — the complete list of MCP servers covers every app that ships one, grouped by category.
What the Shortcut MCP server can actually touch
Model Context Protocol is the open standard that lets an AI client talk to an outside app through a shared interface. Shortcut’s implementation is unusually honest about its own coverage, and the coverage is uneven in a way worth knowing before you plan around it:
| Entity | Read | Create | Update |
|---|---|---|---|
| Stories | yes | yes | yes |
| Docs | yes | yes | yes |
| Epics | yes | yes | no |
| Iterations | yes | yes | no |
| Objectives | yes | no | no |
| Teams, Members, Workflows | yes | no | no |
Stories are the fully-supported object — including comments and sub-tasks — which makes sense, because that’s what the coding agents connecting to this thing spend their time on. Epics and Iterations you can create but not modify. Objectives, Teams, Members, and Workflows are read-only reference data the AI uses to resolve names to IDs.
In practice, that’s a good fit for the obvious use cases: “what’s assigned to me in this iteration,” “summarize what shipped in Epic 4412,” “open a Story for this bug with the repro steps from my terminal,” “move this Story to Ready for Review and comment what I changed.”
Setting it up
Because the server is remote and OAuth-based, setup is one line of config rather than an install:
- In your client’s MCP config, add a remote server with the URL
https://mcp.shortcut.com/mcp. - Restart the client and complete the OAuth prompt in your browser. You’re authorizing under your own Shortcut permissions — the AI sees what you see.
- Confirm the Shortcut tools appear, then ask it to fetch a single Story before pointing it at anything broader.
Shortcut documents this in its MCP Server help article, and officially supports Cursor, VS Code, and Claude Desktop, with the wider MCP ecosystem (Claude Code, Windsurf, Zed) working off the same URL.
One thing to know if you find older setup guides: the local npx-style server from the useshortcut/mcp-server-shortcut repo was archived on July 8, 2026. It’s MIT-licensed and still readable, but it’s read-only and Shortcut has moved all development to the hosted server. Any blog post still telling you to set SHORTCUT_API_TOKEN in a local MCP config is describing the deprecated path. Community Shortcut MCP servers also float around the registries — they work, but you’re trusting a stranger’s process with workspace write access when the vendor’s own OAuth endpoint is free.
The REST API and the token, for everything MCP doesn’t cover
MCP is a wrapper over Shortcut’s REST API v3, and the API does considerably more than the MCP tool list exposes — updating Epics, managing Labels, reordering Workflow states. When you hit the edge of the MCP server, that’s where you go.
Generating a token is a member-level action, not an admin one: go to Settings → Account → API Tokens (app.shortcut.com/settings/account/api-tokens) and create one. Then authenticate by sending it in a header, not a bearer token:
Shortcut-Token: <your-token>
Content-Type: application/jsonagainst the base URL https://api.app.shortcut.com/. The rate limit is 200 requests per minute; go over and you get a 429. Shortcut immediately invalidates any token it detects in public code, so keep it in an environment variable.
Shortcut has webhooks — MCP just can’t hear them
This is the part that trips people up, because both halves are true at once.
Shortcut has excellent outgoing webhooks. Register a URL under Settings and Shortcut notifies it on essentially any workspace change, with a payload carrying entity_type (story, epic), an action (create, update, delete), and a changes object holding old and new values for every modified attribute — so you can see exactly that a Story moved from In Development to Ready for QA. Supply a secret and you get an HMAC-SHA-256 Payload-Signature header to verify with. You can register them by hand or programmatically through the Webhooks API.
The MCP server cannot use any of it.
There is no such thing as an MCP trigger. The protocol's own working group states plainly that clients find out about server-side changes by polling for them, and a real event mechanism remains unshipped.
So the event stream exists, it’s well-designed, and your MCP connection is structurally incapable of subscribing to it. Bridging the two means standing up a public endpoint, verifying signatures, and writing the dispatch logic yourself.Two other limits follow from the same shape. The connection only lives inside a session you start — close the editor and nothing happens, because the AI never watches Shortcut, it waits to be asked. And it’s one app at a time: getting a QA-ready Story into Slack, a release doc, and a customer-facing changelog means authorizing a separate MCP server for each and hoping the client juggles them in one turn.
When you want the state change to do something
That gap — real webhooks on one side, an AI that can’t subscribe to them on the other — is where Carly fits.
Scheduled work is no longer the dividing line — ChatGPT and Claude both run tasks on a timer without anyone watching. The line that still holds is event triggers. Nothing kicks off because something happened in one of your apps; it kicks off because the clock said so, which means anything time-sensitive waits for the next run.
Carly connects to Shortcut natively and to ~260 other apps, plus anything with a public API through your own key, and its workflows are triggered and scheduled — so the Story moving to Ready for QA at 11pm is the thing that starts the work, with nobody’s editor open.- When a Story moves to Ready for QA → post it to
#qawith the diff summary and assign the on-duty reviewer. - When an Epic completes → draft the release note from its Stories and drop it in the shared doc for approval.
- Every Friday → summarize the iteration’s carryover and slipped estimates, and send it to the team lead.
The non-AI steps — routing, matching, moving data between Shortcut and everything downstream — are free and unlimited, the Zapier-style backbone. The AI steps (drafting, summarizing, deciding) start at $35/month.
If you’re already living in Cursor or Claude Code, connect the official MCP server — it’s OAuth, it’s five seconds, and it makes Story work conversational. Related reading: ChatGPT MCP servers, Codex MCP servers, connecting Claude to Shortcut, and Jira vs Linear if you’re still picking a tracker.
FAQ
Does Shortcut have an official MCP server?
Yes. Shortcut hosts and maintains a remote MCP server at https://mcp.shortcut.com/mcp, authenticated with OAuth — no API token or local install needed. It supports reading, creating, and updating Stories and Docs, creating Epics and Iterations, and reading Objectives, Teams, Members, and Workflows.
Do I need a Shortcut API token for the MCP server?
No. The hosted server uses OAuth. The older local server that required SHORTCUT_API_TOKEN was archived in July 2026 — you’d only mint a token now for direct REST API work, at Settings → Account → API Tokens.
Can the Shortcut MCP server react when a Story changes state? No. Shortcut’s outgoing webhooks do fire on Story state changes with full before/after detail, but MCP has no trigger mechanism and cannot subscribe to them. Acting on a Shortcut event automatically means either building a webhook receiver yourself or using a workflow tool like Carly that consumes the event directly.
Is “shortcut mcp” about Apple Shortcuts? Usually not. The dominant result is Shortcut the project-management tool. Separate community MCP servers do exist for driving Apple Shortcuts automations on macOS, but Apple ships no official one.
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
