Summary

Take the hosted URL unless you specifically need stdio.

Shortcut moved its effort to the hosted endpoint, so that is where new capability appears and where the setup instructions are maintained. The package remains worth knowing about for the cases a hosted server cannot serve: a client that only speaks stdio, or a setup where a plain API token is easier to govern than an OAuth application.

What it is

Shortcut's MCP server for its project tracker. All continuing development happens on the remote server at `https://mcp.shortcut.com/mcp`, and the usage instructions live there; this repository stands as historical reference for the packaged version.

What you get

The hosted endpoint at `https://mcp.shortcut.com/mcp`, which is where the current instructions and future work are
A published package that still runs over stdio: `node dist/index.js` with a Shortcut API token, wired into Cursor through `~/.cursor/mcp.json` or into Windsurf's MCP configuration panel
An HTTP mode that authenticates MCP clients with OAuth 2.0 and PKCE, proxied through Shortcut's authorization server, with dynamic client registration and automatic token refresh
A callback proxy that lets clients using ephemeral localhost ports — VS Code, MCP Inspector — complete the flow without pre-registering each redirect URI

Requirements

A Shortcut account. For stdio, a Shortcut API token in `SHORTCUT_API_TOKEN` and nothing else. For the HTTP server, pre-registered OAuth credentials in `SHORTCUT_OAUTH_CLIENT_ID` and `SHORTCUT_OAUTH_CLIENT_SECRET`, with `MCP_SERVER_URL` (default `http://localhost:9292`) and `PORT` (default 9292) — and `{MCP_SERVER_URL}/oauth/callback` registered as an allowed redirect URI on the Shortcut auth server. The package is `@shortcut/mcp`. OAuth is HTTP-only; the stdio server is unaffected by it.

Setup effort

One command plus a key — npx -y @shortcut/mcp, then supply credentials