
Shortcut Forge (Apple Shortcuts MCP)
io.github.Hyunki6040Published by GitHub account Hyunki6040v0.2.1Updated Oct 24, 2026
Apple Shortcuts MCP: build, lint and sign iOS Shortcuts (.shortcut) from Claude, Codex or any LLM.
Overview
Local MCP server that turns a plain-language automation request into a linted, signed Apple Shortcuts .shortcut file for iPhone.
- What you can do
- Build shortcuts from a JSON spec, always linted and signed on macOS
- Browse and fetch 20+ community shortcuts, or start from templates such as supplement-tracker and water-log
- Lint any unsigned shortcut against 15 semantic rules and inspect it as an indented outline
- Sign shortcuts, publish them with a manifest for self-updates, and package submissions to the library
- Get reference material on the spec, pitfalls, lint rules, health types and iOS 27, plus a prompt for chatbots without MCP
- When to use it
- Useful when you want an assistant you already use to generate a complete, importable iOS Shortcut rather than step-by-step instructions, or to diagnose why an exported shortcut fails on the device. Building and linting work anywhere; signing requires a Mac.
- Requirements
- Runs locally as a Python package via uvx (or uv tool install / pipx). Signing needs macOS with Apple's shortcuts sign command; building and linting run on any platform. Optional environment variable SHORTCUT_FORGE_OUT sets the output folder for generated shortcuts. No authentication declared.
Installation
In SourceWeft
- Open Shortcut Forge (Apple Shortcuts MCP) in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
[shortcut-forge: Apple Shortcuts MCP server. Say it, the AI builds it, your iPhone runs it.]
shortcut-forge: the Apple Shortcuts MCP server that ships shortcuts that actually run
Describe an automation to Claude, Codex or ChatGPT → get a signed .shortcut file → tap it on your iPhone.
Apple Shortcuts MCP · iOS Shortcuts generator · Siri Shortcuts for AI agents · iOS 27 aware · macOS auto-signing · open shortcut library
[tests] [PyPI] [iOS 27] [MCP server] [Claude, Codex, ChatGPT] [library] [MIT]
The problem (you've probably said one of these)
"I asked ChatGPT for a shortcut and got fourteen steps to tap in by hand."
"The file imported fine. Then: 'Choose a value for each parameter of this action.'"
"iOS 27 can build a shortcut from a description, but only on my iPhone 15 Pro, one shortcut at a time, and I can't review or version what it changed."
"Every MCP server I found for Shortcuts only runs shortcuts I already have."
"Every time I fix the family shortcut, everyone has to download it again."
Apple Shortcuts is the most powerful automation layer on the iPhone, and still the hardest thing to get an AI to produce. The file format is undocumented, a structurally valid plist can still break on the device, and nothing catches the difference until you're staring at an error on your phone.
The fix
shortcut-forge is an MCP server, a Claude plugin and a Python library that turns "make me a shortcut that…"
into a signed .shortcut file that has been checked against the ways shortcuts really fail on iPhone.
Apple's built-in builder is great for quick personal one-liners and lives right in the app; use it. Reach for shortcut-forge when you want an AI you already use to build something bigger, reviewable and shareable.
Install
Claude Code (plugin = MCP server + skill + /shortcut command)
Claude Desktop: double-click shortcut-forge.mcpb from Releases, or:
OpenAI Codex
ChatGPT, Gemini, any chatbot: connect over HTTP (shortcut-forge mcp --http) or, with no MCP at all, paste
prompts/LLM_PROMPT.md and drop the JSON it writes into the Mac watch folder (below).
Cursor, VS Code, Windsurf, Gemini CLI: see docs/CLIENTS.md.
Python / CLI
Mac auto-signing: drop a spec, get a shortcut
iOS only imports signed shortcuts, and only a Mac can sign them. shortcut-forge makes that invisible:
Ask ChatGPT on your phone for a spec, save it to Files, and the shortcut is ready on the same phone before you finish your coffee. In Claude Desktop / Claude Code on a Mac, signing happens inside the tool call.
What people build with it
From the Open Shortcut Library. Every one is a readable spec, lint-clean in CI.
…and more: mood journal, sleep diary, grocery list, weather voice brief, low-battery nudge, water log.
Built something? Share it → Tell your AI "submit this to the shortcut-forge library".
Use it
Plain language in any MCP client:
- "Make a shortcut that asks how I slept and every Sunday has Apple Intelligence summarise the week."
- "Start from the library's expense log, but in won and with my categories."
- "Here's my exported shortcut. Why does it crash?" →
shortcut_lint+shortcut_inspect
Python: variables work in f-strings.
JSON (what the MCP tools and chatbots write): 50+ step types, plus a raw escape hatch for any action.
MCP tools
Field notes: why "it imported" isn't "it works"
We built a two-person tracker by having Claude generate the plist. It took more than a dozen import → run → screenshot rounds. Every failure was invisible at build time:
The builder can't produce these; the linter catches them in any shortcut. Full notes: PITFALLS.md.
What is a .shortcut file?
- A
.shortcutfile (not.shortor.shortcuts) is an Apple Shortcuts workflow: a binary property list (WFWorkflowActions,WFWorkflowIcon, …) where every action is an identifier likeis.workflow.actions.gettextplus parameters. Variables are "token strings" with UTF-16 offsets. - Since iOS 15, shared shortcut files must be signed. A signed file is an Apple Encrypted Archive whose first
bytes are
AEA1. Unsigned plists import on a Mac but iOS refuses them. - Signing modes:
anyone(any device can import) orpeople-who-know-me(contacts only). Only macOS can sign (shortcuts sign), which is why shortcut-forge automates the Mac side. .wflowwas the format of the old Workflow app that became Shortcuts; iCloud links (icloud.com/shortcuts/…) are snapshots created from the app and can't be generated or updated programmatically.
FAQ
Do I need a Mac? To sign, yes (Apple's rule). Building and linting run anywhere; the watch-folder agent lets
one Mac sign for every device you own.
Does my data leave my machine? No. The server runs locally; nothing is uploaded. Library shortcuts that use
remote_config fetch only the JSON URL they name.
Is this affiliated with Apple or Anthropic? No. It is an independent open-source project.
iOS 26 or older? Most actions work; Stored Content needs iOS 27 and Use Model needs Apple Intelligence (the
linter flags these as SF013).
Roadmap: the update problem (help wanted)
Today every shortcut fix means re-sign → re-share → everyone re-downloads and taps "Replace". v0.2 ships the first
answers (remote_config for data, update_check + publish for code, a signing watch folder). Next is a
Shortcut Hub: one-command publish to GitHub, a stable install URL that always serves the latest version,
settings that survive updates, a signing relay for teams, and an experimental loader pattern.
Read ROADMAP.md and pick something. Device reports from real iPhones are the most valuable
contribution of all.
Contributing
- Share a shortcut → LIBRARY.md
- Found a new way shortcuts break? Open a pitfall issue with the error screenshot and the smallest spec; it becomes a lint rule and a builder fix.
- Code → CONTRIBUTING.md · agents read AGENTS.md
MIT licensed. Not affiliated with Apple Inc. or Anthropic. "Shortcuts" and "Siri" are trademarks of Apple Inc.
If shortcut-forge saved you a round of error screenshots, a ⭐ helps the next person find it.
Keywords: Apple Shortcuts MCP, iOS Shortcuts MCP server, Siri Shortcuts AI generator, create .shortcut file programmatically, sign shortcut macOS CLI, Claude Shortcuts, Codex Shortcuts, ChatGPT Shortcuts, iOS 27 Shortcuts Stored Content, Apple Health shortcut, shortcut library.
Source: README.md at commit 530384a
Tools
0Version history
1- v0.2.1LatestOct 14, 2026
Score
50% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts