# Shortcut: L4 · Runs on its own

As of 2 Oct 2026, an AI agent gets into Shortcut on its own and does 88% of the core work.

Source: https://agentdrives.com/tools/shortcut?via=md · driven 2 Oct 2026 by AgentDrives's agent · Same level in 2 drives in a row · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0

Gets in on its own: L4 · Runs on its own. Sign-up is a web form with a mailed code; an invisible reCAPTCHA let our agent through. From there, work moved to the API: an accurate OpenAPI spec and an official MCP server with dynamic OAuth registration let our agent create, move and link stories, epics, iterations, objectives and docs headless, once it had a token from the browser. Our agent started no paid plan, so there was nothing to cancel. Delete Account failed silently in the browser: the app's own call rejected it as sole owner of an organization, and the workspace stayed behind, emptied but not removed.

_Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_

L4 · Runs on its own: An agent gets in on its own, does at least 80% of the core work and can stop paying on its own: it cancels any plan it started, or there is nothing to cancel. Whether it can also remove what it made shows next to the level.

- Find: Docs for agents (llms.txt, an OpenAPI and an MCP server)
- Access: Sign-up in a browser
- Use: 88% of the work
- Pay: Card checkout
- Leave: Nothing to cancel (Can't delete its account)
- Ways in: Sign-up in a browser, 7 of 8 core tasks
- Next: pay without a person

## Level history

- 1 Oct 2026: L4 · Runs on its own
- 2 Oct 2026: L4 · Runs on its own

## Part scores

- Agent-ready setup: llms.txt found, OpenAPI found, MCP server found, CLI not found
- Not measured in this drive: Holds up, Docs match

## Who gets in

- Agents on a server: Get in on their own.
- Signed agents: The sign-up page opens.
- Agents in a person's browser: Not measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies.

## Checkpoints

- **Docs**: Headless: llms.txt on www.shortcut.com, OpenAPI 3.0.3 v4 at www.shortcut.com/openapi.json (247 operations), v3 OpenAPI on developer.shortcut.com, MCP server with OAuth discovery metadata.
- **Sign up**: In a browser: Web form only: work email, 4-digit code, workspace name, name/password/profession. Invisible reCAPTCHA script on the page let our signed agent through. 14-day trial, no card.
- **Verify**: In a browser: 4-digit code mailed within about a minute and entered in the browser (the mail also has a magic link).
- **Key**: In a browser: API token from Settings > API Tokens (shown once). OAuth: dynamic client registration works headless, but the consent click is in the browser.
- **First call**: Headless: GET /api/v4/whoami 200 with Bearer token.
- **First action**: Headless: POST /api/v4/[redacted]/stories 201, read back with GET.
- **Pay**: Not tried: No 402/x402/MPP/UCP/L402, no billing API, no MCP billing tools, no registry listings. Upgrading is plan selection in Settings > Billing with a Stripe.js card form inside the web app, which a browser agent with a card could likely complete; we have no card, entered nothing and did not reach the card fields, so the step itself is unproven (status blocked: no card).
- **Cancel**: Not needed: Nothing to cancel: our agent started no paid plan.
- **Delete**: Blocked: Delete Account in the browser silently fails: the app's call returns 422 'User is sole owner of one or more organizations.' and the UI shows nothing. Disabling the organization goes through a retention survey that did not disable anything. No API. Account and an emptied workspace remain.

## Does Shortcut have an MCP server, and can an agent connect to it?

Yes. Shortcut has an official MCP server.

A new agent can get in on its own: in the drive of 2 Oct 2026, our agent signed up, verified and got its key without a person. Through the MCP server, 1 of our agent's 1 attempt worked. An agent with only the MCP server, like a chat assistant with a connector, did 50% of the core work.

## How does an AI agent get a Shortcut API key?

In the drive of 2 Oct 2026, our agent got its Shortcut API key in a browser, without a person. API token from Settings > API Tokens (shown once). OAuth: dynamic client registration works headless, but the consent click is in the browser.

## Paying the agent way

Card checkout.

Ways to pay it offers an agent: Stripe card form (card checkout).
No card needed to start.

What would let agents pay on their own:
- Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card.
- List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev).
From the drive of 2 Oct 2026.

## What an agent can do

- Create, update, prioritise and move stories across workflow states
- Group stories into epics and connect epics to objectives
- Plan an iteration with dates and assign stories
- Write a markdown doc and link it to an epic (after Docs is switched on once in the UI)
- Comment, add checklists, link stories (blocks), attach linked files, label, set custom field values
- Bulk-update stories in one request
- Create teams
- Connect an agent through the official MCP server with dynamic client registration
- Clean up created stories, epics, iterations, objectives, labels, files, templates and docs via API

## What it cannot do

- Sign up, verify and get a token without a browser: Sign-up is a web form; tokens are created only in Settings > API Tokens or via an OAuth consent click
- Turn on Docs (and other workspace features): POST /documents returns 403 'docs feature is not enabled'; there is no API to enable it
- Put an epic on the Roadmap: Roadmap membership is UI-only
- Create a story from a template server-side: story_template_id is stored as a reference only; contents must be copied by the client (v4 rejects the field)
- Configure webhooks: No webhook endpoints in the API
- Buy or change a plan: No billing API or agent payment rail; card form in the web app
- Delete the account: Delete Account fails silently (422 sole owner); org disable is a retention survey

## Tips for the owner

1. Make Delete Account work for sole owners
2. Allow sign-up and token issue without browser
3. Let the API enable workspace features
4. Add a billing API or agent payment rail
5. Expose roadmap and webhook settings in API
6. Bring v3-only document features to v4
7. Apply entity templates server-side on create

Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).

## Also in Project management

- [Basecamp](https://agentdrives.com/tools/basecamp.md?via=md): L4 · Runs on its own · [Shortcut vs Basecamp](https://agentdrives.com/compare/basecamp-vs-shortcut?via=md)
- [Plane](https://agentdrives.com/tools/plane.md?via=md): L4 · Runs on its own · [Shortcut vs Plane](https://agentdrives.com/compare/plane-vs-shortcut?via=md)
- [GitHub](https://agentdrives.com/tools/github.md?via=md): L4 · Runs on its own · [Shortcut vs GitHub](https://agentdrives.com/compare/github-vs-shortcut?via=md)
- [monday.com](https://agentdrives.com/tools/monday.md?via=md): L3 · Does the work · [Shortcut vs monday.com](https://agentdrives.com/compare/monday-vs-shortcut?via=md)
- [Asana](https://agentdrives.com/tools/asana.md?via=md): L1 · Needs a person · [Shortcut vs Asana](https://agentdrives.com/compare/asana-vs-shortcut?via=md)
- [ClickUp](https://agentdrives.com/tools/clickup.md?via=md): L1 · Needs a person · [Shortcut vs ClickUp](https://agentdrives.com/compare/clickup-vs-shortcut?via=md)
- [Jira](https://agentdrives.com/tools/atlassian.md?via=md): L1 · Needs a person · [Shortcut vs Jira](https://agentdrives.com/compare/atlassian-vs-shortcut?via=md)
- [Linear](https://agentdrives.com/tools/linear.md?via=md): L1 · Needs a person · [Shortcut vs Linear](https://agentdrives.com/compare/linear-vs-shortcut?via=md)
- [Teamwork.com](https://agentdrives.com/tools/teamwork.md?via=md): L1 · Needs a person · [Shortcut vs Teamwork.com](https://agentdrives.com/compare/shortcut-vs-teamwork?via=md)
- [Trello](https://agentdrives.com/tools/trello.md?via=md): L1 · Needs a person · [Shortcut vs Trello](https://agentdrives.com/compare/shortcut-vs-trello?via=md)
- [Wrike](https://agentdrives.com/tools/wrike.md?via=md): L1 · Needs a person · [Shortcut vs Wrike](https://agentdrives.com/compare/shortcut-vs-wrike?via=md)

## Tips for agent builders

- Sign up and create a 'Full access' API token in the browser once; everything after that works over REST v4 with Authorization: Bearer.
- Or use the official MCP server: register a client at /oauth-client-registration-flow/register, PKCE, one consent click; tokens last 30 minutes with a refresh token.
- Workspace slug is in whoami; all v4 paths are /api/v4/{slug}/...
- POST /stories needs workflow_state_id; get ids from /workflows/{id}/states.
- Use label_ids_add / custom_field_values_add / set_position on PATCH; v3-style 'labels' is rejected.
- Turn on Docs in Settings > Features before POST /documents (403 otherwise); link docs to epics and delete docs through the v3 API (Shortcut-Token header).
- Templates are not applied server-side: GET the template and copy story_contents yourself.
- Archive stories and epics before DELETE (422 otherwise).
- Turn off 'allow teammates with your email domain to join' at sign-up if your inbox domain is shared.