First-party app
Shortcut

Shortcut

Manage Shortcut stories, epics, iterations, workflows and labels — the project-management tool formerly known as Clubhouse.

stable Project ManagementDeveloper Tools

About

Shortcut ships in the w6w first-party pack. It declares 36 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.

App id
io.w6w.shortcut
Version
0.1.0
Author
w6w
Licence
MIT
Categories
Project Management · Developer Tools

Overview

Shortcut (formerly Clubhouse) is a project-management tool built around Stories — the atomic unit of work — grouped into Epics, scheduled into time-boxed Iterations, and moved through a team’s own Workflow states. This app covers that core model end to end: create, read, update, delete and search Stories; manage Epics and their comments; create and update Iterations; read Workflows and their states; and manage Labels, Projects and the comment threads on Stories and Epics.

Every Story, Epic, Iteration, Label and Project id in Shortcut’s API is a plain integer, not a UUID — the one exception being Members, which are addressed by UUID. Getting that mixed up is the most common way a request against this API 404s.

Health checks track Shortcut’s own status page. Shortcut publishes no readable request-rate headroom (only a fixed 200-requests-per-minute ceiling enforced by a 429), so that dimension is declared unavailable rather than guessed at.

Build with Shortcut

Three routes to the same 36 actions. The Workflow tab is generated from Shortcut's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

Comment on Epic

epic-comment-create

Add a comment to an Epic.

List Epic Comments

epic-comment-list

List every comment on an Epic.

Create Epic

epic-create

Create a new Epic.

Delete Epic

epic-delete

Permanently delete an Epic. This does not delete the Stories inside it.

Get Epic

epic-get

Fetch one Epic's full definition.

List Epics

epic-list

List Epics, page by page.

List Epic's Stories

epic-stories-list

List every Story that belongs to an Epic.

Update Epic

epic-update

Update an existing Epic. Only the fields you set are changed.

Create Iteration

iteration-create

Create a new, time-boxed Iteration.

Delete Iteration

iteration-delete

Permanently delete an Iteration. This does not delete the Stories inside it.

Get Iteration

iteration-get

Fetch one Iteration's full definition.

List Iterations

iteration-list

List every Iteration in the connected workspace.

List Iteration's Stories

iteration-stories-list

List every Story scheduled in an Iteration.

Update Iteration

iteration-update

Update an existing Iteration. Only the fields you set are changed.

Create Label

label-create

Create a new Label.

Delete Label

label-delete

Permanently delete a Label. It is removed from every Story and Epic it tagged.

Get Label

label-get

Fetch one Label's full definition.

List Labels

label-list

List every Label in the connected workspace.

List Label's Stories

label-stories-list

List every Story tagged with a Label.

Update Label

label-update

Update an existing Label. Only the fields you set are changed.

Get Current Member

member-get

Fetch the profile of the Member that owns the connected API token.

List Members

member-list

List every Member of the connected workspace.

Create Project

project-create

Create a new Project.

Get Project

project-get

Fetch one Project's full definition.

List Projects

project-list

List every Project in the connected workspace.

Update Project

project-update

Update an existing Project. Only the fields you set are changed.

Search

search

Free-text search across Stories, Epics, Iterations and Objectives.

Comment on Story

story-comment-create

Add a comment to a Story, optionally as a reply to another comment.

List Story Comments

story-comment-list

List every comment on a Story.

Create Story

story-create

Create a new Story.

Delete Story

story-delete

Permanently delete a Story.

Get Story

story-get

Fetch one Story's full definition.

Search Stories (filter)

story-search

Filter Stories by structured criteria such as Epic, Iteration, Label or owner.

Update Story

story-update

Update an existing Story. Only the fields you set are changed — e.g. move it to a new Workflow State by setting `workflowStateId` alone.

Get Workflow

workflow-get

Fetch one Workflow's full definition, including its states.

List Workflows

workflow-list

List every Workflow and its states.

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying Shortcut's real ids.

{
  "manifestVersion": "2",
  "name": "shortcut-example",
  "steps": [
    {
      "id": "epic-comment-create",
      "uses": {
        "app": "io.w6w.shortcut",
        "action": "epic-comment-create",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "epicId": "<epicId>",
        "text": "<text>"
      }
    }
  ]
}

Here are some of the things you can do

  • Comment on Epic

    perform
    epic-comment-create
  • List Epic Comments

    search
    epic-comment-list
  • Create Epic

    perform
    epic-create
  • Get Epic

    read
    epic-get
  • List Epics

    search
    epic-list

+31 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for Shortcut, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to Shortcut. The Workflow tab is where this app's real ids are.

Install
npm install @w6w/sdk
yarn add @w6w/sdk
pnpm add @w6w/sdk
deno add npm:@w6w/sdk
Code
import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "epic-comment-create",
  payload: {
    epicId: "<value>",
    text: "<value>",
    // authorId: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);
Install the CLI
npm install -g @w6w/cli
CLI
w6w run conn_YOUR_CONNECTION_ID --action epic-comment-create --payload '{"epicId":"<value>","text":"<value>"}'

Give an AI agent Shortcut — without giving it Shortcut's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call
{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.shortcut#epic-comment-create",
    "input": {
      "epicId": "<epicId>",
      "text": "<text>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's Shortcut connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

Shortcut's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. Shortcut itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

Shortcut declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

Shortcut platform status

Component status from status.shortcut.com. Covers the API, Web App, Search, Shortcut MCP and Shortcut Docs, plus the upstream integrations (GitHub, Atlassian Bitbucket, Slack, Zendesk, AWS, Fastly, ProductBoard) Shortcut itself depends on.

quota

API request-rate headroom