Shortcut MCP integration for AI agents.
Connect AI agents to Shortcut through 15 structured actions, including get epic, create epic, and create story. Review authentication, inputs, workflows, and…
- ACTION CONTRACTS
- 15
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Shortcut integration exposes
The Shortcut Agent App exposes 15 provider-backed actions for productivity and project management work. Its current contract lets an authorized agent get one shortcut epic by epic id, create one shortcut epic with the first-pass supported fields, and create one shortcut story with the first-pass supported fields. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Shortcut account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Shortcut capabilities.
Showing 12 of 15 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
get_epicREADGet one Shortcut epic by epic ID.
INPUTS: epicId
create_epicWRITECreate one Shortcut epic with the first-pass supported fields.
INPUTS: name / description / ownerIds / followerIds / requestedById
create_storyWRITECreate one Shortcut story with the first-pass supported fields.
INPUTS: name / description / workflowStateId / projectId / storyType
get_memberREADGet one Shortcut member by member UUID.
INPUTS: memberId / orgId
get_projectREADGet one Shortcut project by project ID.
INPUTS: projectId
get_storyREADGet one Shortcut story by story ID.
INPUTS: storyId
get_workflowREADGet one Shortcut workflow by workflow ID.
INPUTS: workflowId
list_epicsREADList the epics available in the connected Shortcut workspace.
INPUTS: includesDescription
list_membersREADList the members available in the connected Shortcut workspace.
INPUTS: orgId
list_projectsREADList the projects available in the connected Shortcut workspace.
list_storiesREADList the stories in one Shortcut project.
INPUTS: projectId / includesDescription
list_workflowsREADList the workflows available in the connected Shortcut workspace.
INPUT CONTRACTS
Know what the action needs before it runs.
get_epic
epicIdOPTIONAL- The Shortcut epic ID.
create_epic
nameREQUIRED- The Shortcut epic name.
descriptionOPTIONALownerIdsOPTIONAL- The Shortcut member UUIDs.
followerIdsOPTIONAL- The Shortcut member UUIDs.
requestedByIdOPTIONAL- The Shortcut member UUID.
create_story
nameREQUIRED- The Shortcut story name.
descriptionOPTIONALworkflowStateIdOPTIONAL- The Shortcut workflow state ID.
projectIdOPTIONAL- The Shortcut project ID.
storyTypeOPTIONAL- The Shortcut story type.
get_member
memberIdREQUIRED- The Shortcut member UUID.
orgIdOPTIONAL- The Shortcut organization ID.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Get Epic
Get one Shortcut epic by epic ID. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
get_epicControl Create Epic
Create one Shortcut epic with the first-pass supported fields. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
create_epicVerify with Get Member
Get one Shortcut member by member UUID. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
get_memberSAFETY BOUNDARY
Operate Shortcut with explicit limits
- Authorize Shortcut with API key and grant only the provider access required by the selected actions.
- 4 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Do not infer permission from catalog visibility. Workspace policy, connection identity, and upstream authorization still govern execution.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in Shortcut rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the Shortcut task completed successfully.
CONNECTION MODEL
API key
Shortcut API token sent with the Shortcut-Token header. Create it in Shortcut under Settings > API Tokens, then confirm the auth contract in the official REST API guide: https://developer.shortcut.com/api/rest/v3#Authentication.
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 11
- WRITE SIGNALS
- 4
- HIGH IMPACT
- 0
- REVIEW SIGNALS
- 0
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Shortcut.