Shortcuts Bridge

io.github.IsaiahDupreePublished by GitHub account IsaiahDupreev1.0.0Updated Oct 24, 2026

MCP connector that lets ChatGPT list, search, and run your Apple Shortcuts via a local Mac agent

VerifiedStreamable HTTPWeb executableProductivity & WorkflowDeveloper Tools

Overview

AI-generated overview

Remote MCP connector that lets ChatGPT list, search and run your Apple Shortcuts on your own Mac through a small local agent.

What you can do
  • List and search the shortcuts installed on your Mac, and list their folders (read-only lookups)
  • Run a shortcut by name, optionally passing text input, and return its output
  • Trigger any automation you have already built, from a chat conversation
  • Manage the local agent: check pairing status, view recent activity, stop auto-start
When to use it
Useful when you want to trigger existing Apple Shortcuts from ChatGPT — for example a morning briefing, focus-mode setup, or a script that drives apps or web APIs — while the shortcuts themselves stay on your Mac.
Requirements
A remote MCP endpoint with OAuth sign-in (account created on the hosted site, then a pairing code). A Mac that is awake, with Node 18+ to run the local agent via npx, paired to the account and kept running (optionally installed as a login LaunchAgent). Self-hosting needs a Vercel account and a Supabase project with SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY and JWT_SECRET set.
Before you install
run_shortcut is open-world: a shortcut can control HomeKit, drive apps, run scripts or call web APIs, so it can take real actions on your Mac; only shortcuts you already built can run, and the client is expected to confirm first. macOS asks for per-shortcut consent the first time each one runs. The relay temporarily stores job payloads and results, and the agent token is kept in a local file. Self-hosting requires a Supabase service-role key, which is highly privileged.

Installation

In SourceWeft

  1. Open Shortcuts Bridge in the dashboard and add it to a workspace.
  2. Connect the required credentials. They are stored privately and never shown on public pages.
  3. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.IsaiahDupree%2Fshortcuts-bridge/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config. The client completes OAuth sign-in on first connect.

{
  "mcpServers": {
    "shortcuts-bridge": {
      "type": "http",
      "url": "https://shortcutsbridge.vercel.app/mcp"
    }
  }
}

README

⚡ ShortcutsBridge

Run your Apple Shortcuts from ChatGPT — on your own Mac.

[License: MIT] [npm]

ShortcutsBridge is a Model Context Protocol (MCP) connector that lets ChatGPT list, search, and run your Apple Shortcuts. Reads execute locally and requested results pass through the authenticated relay — every action runs on your own Mac through a tiny local agent. The cloud piece is only a stateless relay that shuttles requests between ChatGPT and your Mac.

  ChatGPT  ──OAuth──►  ShortcutsBridge relay  ──job queue──►  shortcuts-agent  ──►  Shortcuts.app (connector)          (Vercel, stateless)      (your Mac, polls & executes)     (via the shortcuts CLI)

Your Mac is the only place your shortcuts are ever listed or run. The relay stores only short-lived job payloads and your account record; it never sees a shortcut unless a job is in flight, and jobs expire in seconds.

Because a Shortcut can do almost anything on a Mac or iPhone — control HomeKit, drive apps, run scripts, call web APIs — run_shortcut turns ChatGPT into a trigger for any automation you've already built.

For users — 3 steps

1. Create your account at shortcutsbridge.vercel.app and generate a pairing code.

2. Install the Mac agent (needs Node 18+):

bash
npx shortcuts-agent pair <YOUR-CODE>   # link this Mac to your accountnpx shortcuts-agent install            # keep it running on every restart

The first time a given shortcut runs, macOS may ask you to allow it — click OK (once per shortcut). It's per-shortcut consent, not a blanket automation grant.

3. Connect ChatGPT: Settings → Plugins → turn on Developer mode (Security & login) → Create a custom plugin → paste the MCP Server URL https://shortcutsbridge.vercel.app/mcp → Authentication OAuth → sign in & Allow.

That's it. In a new chat: "Search my Apple Shortcuts for anything about focus" or "Run my Morning Briefing shortcut."

Your Mac must be awake with the agent running. npx shortcuts-agent install makes it start automatically at login and restart if it ever crashes.

Managing the agent

bash
npx shortcuts-agent status      # is it paired & reachable?npx shortcuts-agent logs        # recent activitynpx shortcuts-agent uninstall   # stop auto-start

What ChatGPT can do

ToolAction
list_shortcutsList every shortcut on your Mac (read-only)
search_shortcutsFind shortcuts by keyword (read-only)
list_foldersList your Shortcuts folders (read-only)
run_shortcutRun a shortcut by name, with optional text input, and return its output

The first three are read-only catalogue lookups. run_shortcut is the only tool that does something — it's open-world (the shortcut can take real-world actions), so ChatGPT confirms with you before running one, and only shortcuts you've already built can run.

Self-hosting

You can run your own relay so nothing depends on the hosted instance.

Prereqs: a Vercel account and a Supabase project (free tiers are fine).

  1. Storage — in your Supabase project's SQL editor, run supabase/schema.sql. It creates a tiny Redis-shaped KV + queue surface (nb_* functions) with RLS on.
  2. Deploy the server/ directory to Vercel.
  3. Set env vars (see server/.env.example):
    • SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY — your project + service-role key
    • JWT_SECRET — openssl rand -hex 32
  4. Verify: curl https://YOUR-APP.vercel.app/api/health → redisConfigured, redisOk, jwtSecretSet all true.
  5. Point the agent at it: npx shortcuts-agent pair <CODE> --server https://YOUR-APP.vercel.app.

How it works

  • Auth — OAuth 2.1 with PKCE and Dynamic Client Registration (RFC 7591). ChatGPT registers itself, the user signs in on the ShortcutsBridge consent page, and ChatGPT gets a scoped MCP access token. JWTs are HMAC-signed; three kinds (session, agent, mcp) with distinct privileges. Optional email verification via Resend (RESEND_API_KEY); off unless configured, and enforcement is opt-in (REQUIRE_EMAIL_VERIFICATION).
  • Relay — MCP tool call → job pushed to jobs:<user> (TTL ≤ the caller's wait window, so an abandoned job can't run late) → the Mac agent (holding a hanging long-poll) is handed the job within ~200ms, executes it, pushes the result → the MCP handler returns it. The long-poll means jobs are delivered on arrival rather than on a fixed interval, so relay overhead is ~300ms instead of ~1s. The agent is considered "online" only while it's actively connected.
  • Agent — a dependency-free Node CLI. Tools shell out to the macOS shortcuts command-line tool (shortcuts list, shortcuts run); arguments are passed as argv (never shell-interpolated). A macOS LaunchAgent keeps it alive across logins and crashes.

Repository layout

server/    Vercel functions: OAuth + MCP endpoint + relay        (deploy this)agent/     shortcuts-agent — the npm-published Mac CLI          (users npx this)kit/       Browser automations: register the dev-mode connector AND           fill the OpenAI directory submission (see kit/README.md)supabase/  schema.sql for self-hosting the storagetest/      end-to-end OAuth + MCP integration test

Development

bash
# servercd server && cp .env.example .env.local   # fill in, then: vercel dev# end-to-end test against a live deployment (reads ../.env.local)node test/e2e-oauth.mjs# agent unit testsnode --test agent/test-agent-unit.mjs

Security & privacy

  • Shortcuts are listed and run only on your Mac. The relay temporarily stores requested content in short-lived job/result queues — job payloads live in Redis-shaped storage with a short TTL and are deleted on delivery.
  • The agent token is stored at ~/.shortcutsbridge-agent.json (mode 600).
  • No secrets are committed; see .gitignore and the .env.example files.
  • run_shortcut is marked open-world — a shortcut can take real-world actions — so ChatGPT asks before running one. Only shortcuts you've already built can run.

License

MIT © Isaiah Dupree

Production storage and owner verification

Relay 1.4 uses isolated service-role-only tables/functions on the configured shared Supabase project. Production refuses missing storage configuration, bounds RPC requests to ten seconds, and returns HTTP 503 when storage or signing configuration is unavailable. Apply the checked-in isolated-storage migration before deploying this version; it does not replace another bridge's account tables or functions.

node --env-file=.env.local test/live-storage.mjs verifies the actual persistent store, FIFO, expiry and counters using temporary integration keys. BRIDGE_SESSION_FILE=/private/owner-session.json BRIDGE_READ_TOOL=READ_TOOL node test/live-relay.mjs verifies the actual owner session, PKCE OAuth, hosted MCP and paired-Mac read; choose this bridge's inventory tool. No reviewer data counts as a live acceptance. Credentials and sessions belong outside Git.

Source: README.md at commit 709b687

Tools

0
This server asks you to sign in, so SourceWeft could not read its tools without an account and has not indexed them. What a connected account sees can depend on that account and its permissions.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

85% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts