@shortcut/mcp 0.13.0 → 0.15.1

package/README.md

@@ -129,63 +129,103 @@ Or you can edit the local JSON file directly:
 
 ### Stories
 
-- **get-story** - Get a single Shortcut story by ID
-- **search-stories** - Find Shortcut stories with filtering and search options
-- **get-story-branch-name** - Get the recommended branch name (based on workspace settings) for a specific story.
-- **create-story** - Create a new Shortcut story
-- **update-story** - Update an existing Shortcut story
-- **upload-file-to-story** - Upload a file and link it to a story
-- **assign-current-user-as-owner** - Assign the current user as the owner of a story
-- **unassign-current-user-as-owner** - Unassign the current user as the owner of a story
-- **create-story-comment** - Create a comment on a story
-- **add-task-to-story** - Add a task to a story
-- **update-task** - Update a task in a story
-- **add-relation-to-story** - Add a story relationship (relates to, blocks, duplicates, etc.)
-- **add-external-link-to-story** - Add an external link to a Shortcut story
-- **remove-external-link-from-story** - Remove an external link from a Shortcut story
-- **set-story-external-links** - Replace all external links on a story with a new set of links
-- **get-stories-by-external-link** - Find all stories that contain a specific external link
+- **stories-get-by-id** - Get a single Shortcut story by ID
+- **stories-search** - Find Shortcut stories with filtering and search options
+- **stories-get-branch-name** - Get the recommended branch name (based on workspace settings) for a specific story.
+- **stories-create** - Create a new Shortcut story
+- **stories-update** - Update an existing Shortcut story
+- **stories-upload-file** - Upload a file and link it to a story
+- **stories-assign-current-user** - Assign the current user as the owner of a story
+- **stories-unassign-current-user** - Unassign the current user as the owner of a story
+- **stories-create-comment** - Create a comment on a story
+- **stories-add-task** - Add a task to a story
+- **stories-update-task** - Update a task in a story
+- **stories-add-relation** - Add a story relationship (relates to, blocks, duplicates, etc.)
+- **stories-add-external-link** - Add an external link to a Shortcut story
+- **stories-remove-external-link** - Remove an external link from a Shortcut story
+- **stories-set-external-links** - Replace all external links on a story with a new set of links
+- **stories-get-by-external-link** - Find all stories that contain a specific external link
 
 ### Epics
 
-- **get-epic** - Get a Shortcut epic by ID
-- **search-epics** - Find Shortcut epics with filtering and search options
-- **create-epic** - Create a new Shortcut epic
+- **epics-get-by-id** - Get a Shortcut epic by ID
+- **epics-search** - Find Shortcut epics with filtering and search options
+- **epics-create** - Create a new Shortcut epic
 
 ### Iterations
 
-- **get-iteration-stories** - Get stories in a specific iteration by iteration ID
-- **get-iteration** - Get a Shortcut iteration by ID
-- **search-iterations** - Find Shortcut iterations with filtering and search options
-- **create-iteration** - Create a new Shortcut iteration with start/end dates
-- **get-active-iterations** - Get active iterations for the current user based on team memberships
-- **get-upcoming-iterations** - Get upcoming iterations for the current user based on team memberships
+- **iterations-get-stories** - Get stories in a specific iteration by iteration ID
+- **iterations-get-by-id** - Get a Shortcut iteration by ID
+- **iterations-search** - Find Shortcut iterations with filtering and search options
+- **iterations-create** - Create a new Shortcut iteration with start/end dates
+- **iterations-get-active** - Get active iterations for the current user based on team memberships
+- **iterations-get-upcoming** - Get upcoming iterations for the current user based on team memberships
 
 ### Objectives
 
-- **get-objective** - Get a Shortcut objective by ID
-- **search-objectives** - Find Shortcut objectives with filtering and search options
+- **objectives-get-by-id** - Get a Shortcut objective by ID
+- **objectives-search** - Find Shortcut objectives with filtering and search options
 
 ### Teams
 
-- **get-team** - Get a Shortcut team by ID
-- **list-teams** - List all Shortcut teams
+- **teams-get-by-id** - Get a Shortcut team by ID
+- **teams-list** - List all Shortcut teams
 
 ### Workflows
 
-- **get-default-workflow** - Get the default workflow for a specific team or the workspace default
-- **get-workflow** - Get a Shortcut workflow by ID
-- **list-workflows** - List all Shortcut workflows
+- **workflows-get-default** - Get the default workflow for a specific team or the workspace default
+- **workflows-get-by-id** - Get a Shortcut workflow by ID
+- **workflows-list** - List all Shortcut workflows
 
 ### Users
 
-- **get-current-user** - Get the current user information
-- **get-current-user-teams** - Get a list of teams where the current user is a member
-- **list-users** - Get all workspace users
+- **users-get-current** - Get the current user information
+- **users-get-current-teams** - Get a list of teams where the current user is a member
+- **users-list** - Get all workspace users
 
 ### Documents
 
-- **create-document** - Create a new document in Shortcut with HTML content
+- **documents-create** - Create a new document in Shortcut with HTML content
+
+## Limit tools
+
+You can limit the tools available to the LLM by setting the `SHORTCUT_TOOLS` environment variable to a comma-separated list.
+
+- Tools can be limited by entity type by just adding the entity, eg `stories` or `epics`.
+- Individual tools can also be limitied by their full name, eg `stories-get-by-id` or `epics-search`.
+
+By default, all tools are enabled.
+
+Example:
+
+```json
+{
+  "mcpServers": {
+    "shortcut": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@shortcut/mcp@latest"
+      ],
+      "env": {
+        "SHORTCUT_API_TOKEN": "<YOUR_SHORTCUT_API_TOKEN>",
+        "SHORTCUT_TOOLS": "stories,epics,iterations-create"
+      }
+    }
+  }
+}
+```
+
+The following values are accepted in addition to the full tool names listed above under [Available Tools](#available-tools):
+
+- `users`
+- `stories`
+- `epics`
+- `iterations`
+- `objectives`
+- `teams`
+- `workflows`
+- `documents`
 
 ## Read-only mode
 

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { ShortcutClient } from "@shortcut/client";
 import { File } from "node:buffer";
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 
 //#region src/client/cache.ts
@@ -450,7 +450,41 @@ var ShortcutClientWrapper = class {
 //#endregion
 //#region package.json
 var name = "@shortcut/mcp";
-var version = "0.13.0";
+var version = "0.15.1";
+
+//#endregion
+//#region src/mcp/CustomMcpServer.ts
+var CustomMcpServer = class extends McpServer {
+	readonly;
+	tools;
+	constructor({ readonly, tools }) {
+		super({
+			name,
+			version
+		});
+		this.readonly = readonly;
+		this.tools = new Set(tools || []);
+	}
+	shouldAddTool(name$1) {
+		console.log("Checking tool:", name$1, this.tools.size);
+		if (!this.tools.size) return true;
+		const [entityType] = name$1.split("-");
+		if (this.tools.has(entityType) || this.tools.has(name$1)) return true;
+		return false;
+	}
+	addToolWithWriteAccess(...args) {
+		if (this.readonly) return null;
+		if (!this.shouldAddTool(args[0])) return null;
+		return super.tool(...args);
+	}
+	addToolWithReadAccess(...args) {
+		if (!this.shouldAddTool(args[0])) return null;
+		return super.tool(...args);
+	}
+	tool() {
+		throw new Error("Call addToolWithReadAccess or addToolWithWriteAccess instead.");
+	}
+};
 
 //#endregion
 //#region src/tools/base.ts
@@ -458,9 +492,8 @@ var version = "0.13.0";
 * Base class for all tools.
 */
 var BaseTools = class {
-	constructor(client$1, isReadonly$1 = false) {
+	constructor(client$1) {
 		this.client = client$1;
-		this.isReadonly = isReadonly$1;
 	}
 	renameEntityProps(entity) {
 		if (!entity || typeof entity !== "object") return entity;
@@ -792,9 +825,9 @@ var BaseTools = class {
 //#endregion
 //#region src/tools/documents.ts
 var DocumentTools = class DocumentTools extends BaseTools {
-	static create(client$1, server$1, isReadonly$1 = false) {
-		const tools = new DocumentTools(client$1, isReadonly$1);
-		if (!isReadonly$1) server$1.tool("create-document", "Create a new document in Shortcut with a title and content. Returns the document's id, title, and app_url. Note: Use HTML markup for the content (e.g., <p>, <h1>, <ul>, <strong>) rather than Markdown.", {
+	static create(client$1, server$1) {
+		const tools = new DocumentTools(client$1);
+		server$1.addToolWithWriteAccess("documents-create", "Create a new document in Shortcut with a title and content. Returns the document's id, title, and app_url. Note: Use HTML markup for the content (e.g., <p>, <h1>, <ul>, <strong>) rather than Markdown.", {
 			title: z.string().max(256).describe("The title for the new document (max 256 characters)"),
 			content: z.string().describe("The content for the new document in HTML format (e.g., <p>Hello</p>, <h1>Title</h1>, <ul><li>Item</li></ul>)")
 		}, async ({ title, content }) => await tools.createDocument(title, content));
@@ -876,13 +909,13 @@ const user = (field) => z.string().optional().describe(`Find entities where the
 //#endregion
 //#region src/tools/epics.ts
 var EpicTools = class EpicTools extends BaseTools {
-	static create(client$1, server$1, isReadonly$1 = false) {
-		const tools = new EpicTools(client$1, isReadonly$1);
-		server$1.tool("get-epic", "Get a Shortcut epic by public ID", {
+	static create(client$1, server$1) {
+		const tools = new EpicTools(client$1);
+		server$1.addToolWithReadAccess("epics-get-by-id", "Get a Shortcut epic by public ID", {
 			epicPublicId: z.number().positive().describe("The public ID of the epic to get"),
 			full: z.boolean().optional().default(false).describe("True to return all epic fields from the API. False to return a slim version that excludes uncommon fields")
 		}, async ({ epicPublicId, full }) => await tools.getEpic(epicPublicId, full));
-		server$1.tool("search-epics", "Find Shortcut epics.", {
+		server$1.addToolWithReadAccess("epics-search", "Find Shortcut epics.", {
 			nextPageToken: z.string().optional().describe("If a next_page_token was returned from the search result, pass it in to get the next page of results.  Should be combined with the original search parameters."),
 			id: z.number().optional().describe("Find only epics with the specified public ID"),
 			name: z.string().optional().describe("Find only epics matching the specified name"),
@@ -911,7 +944,7 @@ var EpicTools = class EpicTools extends BaseTools {
 			completed: date(),
 			due: date()
 		}, async ({ nextPageToken,...params }) => await tools.searchEpics(params, nextPageToken));
-		if (!isReadonly$1) server$1.tool("create-epic", "Create a new Shortcut epic.", {
+		server$1.addToolWithWriteAccess("epics-create", "Create a new Shortcut epic.", {
 			name: z.string().describe("The name of the epic"),
 			owner: z.string().optional().describe("The user ID of the owner of the epic"),
 			description: z.string().optional().describe("A description of the epic"),
@@ -946,17 +979,17 @@ var EpicTools = class EpicTools extends BaseTools {
 //#endregion
 //#region src/tools/iterations.ts
 var IterationTools = class IterationTools extends BaseTools {
-	static create(client$1, server$1, isReadonly$1 = false) {
-		const tools = new IterationTools(client$1, isReadonly$1);
-		server$1.tool("get-iteration-stories", "Get stories in a specific iteration by iteration public ID", {
+	static create(client$1, server$1) {
+		const tools = new IterationTools(client$1);
+		server$1.addToolWithReadAccess("iterations-get-stories", "Get stories in a specific iteration by iteration public ID", {
 			iterationPublicId: z.number().positive().describe("The public ID of the iteration"),
 			includeStoryDescriptions: z.boolean().optional().default(false).describe("Indicate whether story descriptions should be included. Including descriptions may take longer and will increase the size of the response.")
 		}, async ({ iterationPublicId, includeStoryDescriptions }) => await tools.getIterationStories(iterationPublicId, includeStoryDescriptions));
-		server$1.tool("get-iteration", "Get a Shortcut iteration by public ID", {
+		server$1.addToolWithReadAccess("iterations-get-by-id", "Get a Shortcut iteration by public ID", {
 			iterationPublicId: z.number().positive().describe("The public ID of the iteration to get"),
 			full: z.boolean().optional().default(false).describe("True to return all iteration fields from the API. False to return a slim version that excludes uncommon fields")
 		}, async ({ iterationPublicId, full }) => await tools.getIteration(iterationPublicId, full));
-		server$1.tool("search-iterations", "Find Shortcut iterations.", {
+		server$1.addToolWithReadAccess("iterations-search", "Find Shortcut iterations.", {
 			nextPageToken: z.string().optional().describe("If a next_page_token was returned from the search result, pass it in to get the next page of results. Should be combined with the original search parameters."),
 			id: z.number().optional().describe("Find only iterations with the specified public ID"),
 			name: z.string().optional().describe("Find only iterations matching the specified name"),
@@ -972,15 +1005,15 @@ var IterationTools = class IterationTools extends BaseTools {
 			startDate: date(),
 			endDate: date()
 		}, async ({ nextPageToken,...params }) => await tools.searchIterations(params, nextPageToken));
-		if (!isReadonly$1) server$1.tool("create-iteration", "Create a new Shortcut iteration", {
+		server$1.addToolWithWriteAccess("iterations-create", "Create a new Shortcut iteration", {
 			name: z.string().describe("The name of the iteration"),
 			startDate: z.string().describe("The start date of the iteration in YYYY-MM-DD format"),
 			endDate: z.string().describe("The end date of the iteration in YYYY-MM-DD format"),
 			teamId: z.string().optional().describe("The ID of a team to assign the iteration to"),
 			description: z.string().optional().describe("A description of the iteration")
 		}, async (params) => await tools.createIteration(params));
-		server$1.tool("get-active-iterations", "Get the active Shortcut iterations for the current user based on their team memberships", { teamId: z.string().optional().describe("The ID of a team to filter iterations by") }, async ({ teamId }) => await tools.getActiveIterations(teamId));
-		server$1.tool("get-upcoming-iterations", "Get the upcoming Shortcut iterations for the current user based on their team memberships", { teamId: z.string().optional().describe("The ID of a team to filter iterations by") }, async ({ teamId }) => await tools.getUpcomingIterations(teamId));
+		server$1.addToolWithReadAccess("iterations-get-active", "Get the active Shortcut iterations for the current user based on their team memberships", { teamId: z.string().optional().describe("The ID of a team to filter iterations by") }, async ({ teamId }) => await tools.getActiveIterations(teamId));
+		server$1.addToolWithReadAccess("iterations-get-upcoming", "Get the upcoming Shortcut iterations for the current user based on their team memberships", { teamId: z.string().optional().describe("The ID of a team to filter iterations by") }, async ({ teamId }) => await tools.getUpcomingIterations(teamId));
 		return tools;
 	}
 	async getIterationStories(iterationPublicId, includeDescription) {
@@ -1057,13 +1090,13 @@ var IterationTools = class IterationTools extends BaseTools {
 //#endregion
 //#region src/tools/objectives.ts
 var ObjectiveTools = class ObjectiveTools extends BaseTools {
-	static create(client$1, server$1, isReadonly$1 = false) {
-		const tools = new ObjectiveTools(client$1, isReadonly$1);
-		server$1.tool("get-objective", "Get a Shortcut objective by public ID", {
+	static create(client$1, server$1) {
+		const tools = new ObjectiveTools(client$1);
+		server$1.addToolWithReadAccess("objectives-get-by-id", "Get a Shortcut objective by public ID", {
 			objectivePublicId: z.number().positive().describe("The public ID of the objective to get"),
 			full: z.boolean().optional().default(false).describe("True to return all objective fields from the API. False to return a slim version that excludes uncommon fields")
 		}, async ({ objectivePublicId, full }) => await tools.getObjective(objectivePublicId, full));
-		server$1.tool("search-objectives", "Find Shortcut objectives.", {
+		server$1.addToolWithReadAccess("objectives-search", "Find Shortcut objectives.", {
 			nextPageToken: z.string().optional().describe("If a next_page_token was returned from the search result, pass it in to get the next page of results. Should be combined with the original search parameters."),
 			id: z.number().optional().describe("Find objectives matching the specified id"),
 			name: z.string().optional().describe("Find objectives matching the specified name"),
@@ -1105,13 +1138,13 @@ var ObjectiveTools = class ObjectiveTools extends BaseTools {
 //#endregion
 //#region src/tools/stories.ts
 var StoryTools = class StoryTools extends BaseTools {
-	static create(client$1, server$1, isReadonly$1 = false) {
-		const tools = new StoryTools(client$1, isReadonly$1);
-		server$1.tool("get-story", "Get a Shortcut story by public ID", {
+	static create(client$1, server$1) {
+		const tools = new StoryTools(client$1);
+		server$1.addToolWithReadAccess("stories-get-by-id", "Get a Shortcut story by public ID", {
 			storyPublicId: z.number().positive().describe("The public ID of the story to get"),
 			full: z.boolean().optional().default(false).describe("True to return all story fields from the API. False to return a slim version that excludes uncommon fields")
 		}, async ({ storyPublicId, full }) => await tools.getStory(storyPublicId, full));
-		server$1.tool("search-stories", "Find Shortcut stories.", {
+		server$1.addToolWithReadAccess("stories-search", "Find Shortcut stories.", {
 			nextPageToken: z.string().optional().describe("If a next_page_token was returned from the search result, pass it in to get the next page of results. Should be combined with the original search parameters."),
 			id: z.number().optional().describe("Find only stories with the specified public ID"),
 			name: z.string().optional().describe("Find only stories matching the specified name"),
@@ -1162,103 +1195,101 @@ var StoryTools = class StoryTools extends BaseTools {
 			completed: date(),
 			due: date()
 		}, async ({ nextPageToken,...params }) => await tools.searchStories(params, nextPageToken));
-		server$1.tool("get-story-branch-name", "Get a valid branch name for a specific story.", { storyPublicId: z.number().positive().describe("The public Id of the story") }, async ({ storyPublicId }) => await tools.getStoryBranchName(storyPublicId));
-		if (!isReadonly$1) {
-			server$1.tool("create-story", `Create a new Shortcut story. 
+		server$1.addToolWithReadAccess("stories-get-branch-name", "Get a valid branch name for a specific story.", { storyPublicId: z.number().positive().describe("The public Id of the story") }, async ({ storyPublicId }) => await tools.getStoryBranchName(storyPublicId));
+		server$1.addToolWithWriteAccess("stories-create", `Create a new Shortcut story. 
 Name is required, and either a Team or Workflow must be specified:
 - If only Team is specified, we will use the default workflow for that team.
 - If Workflow is specified, it will be used regardless of Team.
 The story will be added to the default state for the workflow.
 `, {
-				name: z.string().min(1).max(512).describe("The name of the story. Required."),
-				description: z.string().max(1e4).optional().describe("The description of the story"),
-				type: z.enum([
-					"feature",
-					"bug",
-					"chore"
-				]).default("feature").describe("The type of the story"),
-				owner: z.string().optional().describe("The user id of the owner of the story"),
-				epic: z.number().optional().describe("The epic id of the epic the story belongs to"),
-				iteration: z.number().optional().describe("The iteration id of the iteration the story belongs to"),
-				team: z.string().optional().describe("The team ID or mention name of the team the story belongs to. Required unless a workflow is specified."),
-				workflow: z.number().optional().describe("The workflow ID to add the story to. Required unless a team is specified.")
-			}, async ({ name: name$1, description, type, owner, epic, iteration, team, workflow }) => await tools.createStory({
-				name: name$1,
-				description,
-				type,
-				owner,
-				epic,
-				iteration,
-				team,
-				workflow
-			}));
-			server$1.tool("update-story", "Update an existing Shortcut story. Only provide fields you want to update. The story public ID will always be included in updates.", {
-				storyPublicId: z.number().positive().describe("The public ID of the story to update"),
-				name: z.string().max(512).optional().describe("The name of the story"),
-				description: z.string().max(1e4).optional().describe("The description of the story"),
-				type: z.enum([
-					"feature",
-					"bug",
-					"chore"
-				]).optional().describe("The type of the story"),
-				epic: z.number().nullable().optional().describe("The epic id of the epic the story belongs to, or null to unset"),
-				estimate: z.number().nullable().optional().describe("The point estimate of the story, or null to unset"),
-				iteration: z.number().nullable().optional().describe("The iteration id of the iteration the story belongs to, or null to unset"),
-				owner_ids: z.array(z.string()).optional().describe("Array of user UUIDs to assign as owners of the story"),
-				workflow_state_id: z.number().optional().describe("The workflow state ID to move the story to"),
-				labels: z.array(z.object({
-					name: z.string().describe("The name of the label"),
-					color: z.string().optional().describe("The color of the label"),
-					description: z.string().optional().describe("The description of the label")
-				})).optional().describe("Labels to assign to the story")
-			}, async (params) => await tools.updateStory(params));
-			server$1.tool("upload-file-to-story", "Upload a file and link it to a story.", {
-				storyPublicId: z.number().positive().describe("The public ID of the story"),
-				filePath: z.string().describe("The path to the file to upload")
-			}, async ({ storyPublicId, filePath }) => await tools.uploadFileToStory(storyPublicId, filePath));
-			server$1.tool("assign-current-user-as-owner", "Assign the current user as the owner of a story", { storyPublicId: z.number().positive().describe("The public ID of the story") }, async ({ storyPublicId }) => await tools.assignCurrentUserAsOwner(storyPublicId));
-			server$1.tool("unassign-current-user-as-owner", "Unassign the current user as the owner of a story", { storyPublicId: z.number().positive().describe("The public ID of the story") }, async ({ storyPublicId }) => await tools.unassignCurrentUserAsOwner(storyPublicId));
-			server$1.tool("create-story-comment", "Create a comment on a story", {
-				storyPublicId: z.number().positive().describe("The public ID of the story"),
-				text: z.string().min(1).describe("The text of the comment")
-			}, async (params) => await tools.createStoryComment(params));
-			server$1.tool("add-task-to-story", "Add a task to a story", {
-				storyPublicId: z.number().positive().describe("The public ID of the story"),
-				taskDescription: z.string().min(1).describe("The description of the task"),
-				taskOwnerIds: z.array(z.string()).optional().describe("Array of user IDs to assign as owners of the task")
-			}, async (params) => await tools.addTaskToStory(params));
-			server$1.tool("update-task", "Update a task in a story", {
-				storyPublicId: z.number().positive().describe("The public ID of the story"),
-				taskPublicId: z.number().positive().describe("The public ID of the task"),
-				taskDescription: z.string().optional().describe("The description of the task"),
-				taskOwnerIds: z.array(z.string()).optional().describe("Array of user IDs to assign as owners of the task"),
-				isCompleted: z.boolean().optional().describe("Whether the task is completed or not")
-			}, async (params) => await tools.updateTask(params));
-			server$1.tool("add-relation-to-story", "Add a story relationship to a story", {
-				storyPublicId: z.number().positive().describe("The public ID of the story"),
-				relatedStoryPublicId: z.number().positive().describe("The public ID of the related story"),
-				relationshipType: z.enum([
-					"relates to",
-					"blocks",
-					"blocked by",
-					"duplicates",
-					"duplicated by"
-				]).optional().default("relates to").describe("The type of relationship")
-			}, async (params) => await tools.addRelationToStory(params));
-			server$1.tool("add-external-link-to-story", "Add an external link to a Shortcut story", {
-				storyPublicId: z.number().positive().describe("The public ID of the story"),
-				externalLink: z.string().url().max(2048).describe("The external link URL to add")
-			}, async ({ storyPublicId, externalLink }) => await tools.addExternalLinkToStory(storyPublicId, externalLink));
-			server$1.tool("remove-external-link-from-story", "Remove an external link from a Shortcut story", {
-				storyPublicId: z.number().positive().describe("The public ID of the story"),
-				externalLink: z.string().url().max(2048).describe("The external link URL to remove")
-			}, async ({ storyPublicId, externalLink }) => await tools.removeExternalLinkFromStory(storyPublicId, externalLink));
-			server$1.tool("set-story-external-links", "Replace all external links on a story with a new set of links", {
-				storyPublicId: z.number().positive().describe("The public ID of the story"),
-				externalLinks: z.array(z.string().url().max(2048)).describe("Array of external link URLs to set (replaces all existing links)")
-			}, async ({ storyPublicId, externalLinks }) => await tools.setStoryExternalLinks(storyPublicId, externalLinks));
-		}
-		server$1.tool("get-stories-by-external-link", "Find all stories that contain a specific external link", { externalLink: z.string().url().max(2048).describe("The external link URL to search for") }, async ({ externalLink }) => await tools.getStoriesByExternalLink(externalLink));
+			name: z.string().min(1).max(512).describe("The name of the story. Required."),
+			description: z.string().max(1e4).optional().describe("The description of the story"),
+			type: z.enum([
+				"feature",
+				"bug",
+				"chore"
+			]).default("feature").describe("The type of the story"),
+			owner: z.string().optional().describe("The user id of the owner of the story"),
+			epic: z.number().optional().describe("The epic id of the epic the story belongs to"),
+			iteration: z.number().optional().describe("The iteration id of the iteration the story belongs to"),
+			team: z.string().optional().describe("The team ID or mention name of the team the story belongs to. Required unless a workflow is specified."),
+			workflow: z.number().optional().describe("The workflow ID to add the story to. Required unless a team is specified.")
+		}, async ({ name: name$1, description, type, owner, epic, iteration, team, workflow }) => await tools.createStory({
+			name: name$1,
+			description,
+			type,
+			owner,
+			epic,
+			iteration,
+			team,
+			workflow
+		}));
+		server$1.addToolWithWriteAccess("stories-update", "Update an existing Shortcut story. Only provide fields you want to update. The story public ID will always be included in updates.", {
+			storyPublicId: z.number().positive().describe("The public ID of the story to update"),
+			name: z.string().max(512).optional().describe("The name of the story"),
+			description: z.string().max(1e4).optional().describe("The description of the story"),
+			type: z.enum([
+				"feature",
+				"bug",
+				"chore"
+			]).optional().describe("The type of the story"),
+			epic: z.number().nullable().optional().describe("The epic id of the epic the story belongs to, or null to unset"),
+			estimate: z.number().nullable().optional().describe("The point estimate of the story, or null to unset"),
+			iteration: z.number().nullable().optional().describe("The iteration id of the iteration the story belongs to, or null to unset"),
+			owner_ids: z.array(z.string()).optional().describe("Array of user UUIDs to assign as owners of the story"),
+			workflow_state_id: z.number().optional().describe("The workflow state ID to move the story to"),
+			labels: z.array(z.object({
+				name: z.string().describe("The name of the label"),
+				color: z.string().optional().describe("The color of the label"),
+				description: z.string().optional().describe("The description of the label")
+			})).optional().describe("Labels to assign to the story")
+		}, async (params) => await tools.updateStory(params));
+		server$1.addToolWithWriteAccess("stories-upload-file", "Upload a file and link it to a story.", {
+			storyPublicId: z.number().positive().describe("The public ID of the story"),
+			filePath: z.string().describe("The path to the file to upload")
+		}, async ({ storyPublicId, filePath }) => await tools.uploadFileToStory(storyPublicId, filePath));
+		server$1.addToolWithWriteAccess("stories-assign-current-user", "Assign the current user as the owner of a story", { storyPublicId: z.number().positive().describe("The public ID of the story") }, async ({ storyPublicId }) => await tools.assignCurrentUserAsOwner(storyPublicId));
+		server$1.addToolWithWriteAccess("stories-unassign-current-user", "Unassign the current user as the owner of a story", { storyPublicId: z.number().positive().describe("The public ID of the story") }, async ({ storyPublicId }) => await tools.unassignCurrentUserAsOwner(storyPublicId));
+		server$1.addToolWithWriteAccess("stories-create-comment", "Create a comment on a story", {
+			storyPublicId: z.number().positive().describe("The public ID of the story"),
+			text: z.string().min(1).describe("The text of the comment")
+		}, async (params) => await tools.createStoryComment(params));
+		server$1.addToolWithWriteAccess("stories-add-task", "Add a task to a story", {
+			storyPublicId: z.number().positive().describe("The public ID of the story"),
+			taskDescription: z.string().min(1).describe("The description of the task"),
+			taskOwnerIds: z.array(z.string()).optional().describe("Array of user IDs to assign as owners of the task")
+		}, async (params) => await tools.addTaskToStory(params));
+		server$1.addToolWithWriteAccess("stories-update-task", "Update a task in a story", {
+			storyPublicId: z.number().positive().describe("The public ID of the story"),
+			taskPublicId: z.number().positive().describe("The public ID of the task"),
+			taskDescription: z.string().optional().describe("The description of the task"),
+			taskOwnerIds: z.array(z.string()).optional().describe("Array of user IDs to assign as owners of the task"),
+			isCompleted: z.boolean().optional().describe("Whether the task is completed or not")
+		}, async (params) => await tools.updateTask(params));
+		server$1.addToolWithWriteAccess("stories-add-relation", "Add a story relationship to a story", {
+			storyPublicId: z.number().positive().describe("The public ID of the story"),
+			relatedStoryPublicId: z.number().positive().describe("The public ID of the related story"),
+			relationshipType: z.enum([
+				"relates to",
+				"blocks",
+				"blocked by",
+				"duplicates",
+				"duplicated by"
+			]).optional().default("relates to").describe("The type of relationship")
+		}, async (params) => await tools.addRelationToStory(params));
+		server$1.addToolWithWriteAccess("stories-add-external-link", "Add an external link to a Shortcut story", {
+			storyPublicId: z.number().positive().describe("The public ID of the story"),
+			externalLink: z.string().url().max(2048).describe("The external link URL to add")
+		}, async ({ storyPublicId, externalLink }) => await tools.addExternalLinkToStory(storyPublicId, externalLink));
+		server$1.addToolWithWriteAccess("stories-remove-external-link", "Remove an external link from a Shortcut story", {
+			storyPublicId: z.number().positive().describe("The public ID of the story"),
+			externalLink: z.string().url().max(2048).describe("The external link URL to remove")
+		}, async ({ storyPublicId, externalLink }) => await tools.removeExternalLinkFromStory(storyPublicId, externalLink));
+		server$1.addToolWithWriteAccess("stories-set-external-links", "Replace all external links on a story with a new set of links", {
+			storyPublicId: z.number().positive().describe("The public ID of the story"),
+			externalLinks: z.array(z.string().url().max(2048)).describe("Array of external link URLs to set (replaces all existing links)")
+		}, async ({ storyPublicId, externalLinks }) => await tools.setStoryExternalLinks(storyPublicId, externalLinks));
+		server$1.addToolWithReadAccess("stories-get-by-external-link", "Find all stories that contain a specific external link", { externalLink: z.string().url().max(2048).describe("The external link URL to search for") }, async ({ externalLink }) => await tools.getStoriesByExternalLink(externalLink));
 		return tools;
 	}
 	async assignCurrentUserAsOwner(storyPublicId) {
@@ -1437,13 +1468,13 @@ The story will be added to the default state for the workflow.
 //#endregion
 //#region src/tools/teams.ts
 var TeamTools = class TeamTools extends BaseTools {
-	static create(client$1, server$1, isReadonly$1 = false) {
-		const tools = new TeamTools(client$1, isReadonly$1);
-		server$1.tool("get-team", "Get a Shortcut team by public ID", {
+	static create(client$1, server$1) {
+		const tools = new TeamTools(client$1);
+		server$1.addToolWithReadAccess("teams-get-by-id", "Get a Shortcut team by public ID", {
 			teamPublicId: z.string().describe("The public ID of the team to get"),
 			full: z.boolean().optional().default(false).describe("True to return all team fields from the API. False to return a slim version that excludes uncommon fields")
 		}, async ({ teamPublicId, full }) => await tools.getTeam(teamPublicId, full));
-		server$1.tool("list-teams", "List all Shortcut teams", async () => await tools.getTeams());
+		server$1.addToolWithReadAccess("teams-list", "List all Shortcut teams", async () => await tools.getTeams());
 		return tools;
 	}
 	async getTeam(teamPublicId, full = false) {
@@ -1461,11 +1492,11 @@ var TeamTools = class TeamTools extends BaseTools {
 //#endregion
 //#region src/tools/user.ts
 var UserTools = class UserTools extends BaseTools {
-	static create(client$1, server$1, isReadonly$1 = false) {
-		const tools = new UserTools(client$1, isReadonly$1);
-		server$1.tool("get-current-user", "Get the current user", async () => await tools.getCurrentUser());
-		server$1.tool("get-current-user-teams", "Get a list of teams where the current user is a member", async () => await tools.getCurrentUserTeams());
-		server$1.tool("list-users", "Get all users", async () => await tools.listMembers());
+	static create(client$1, server$1) {
+		const tools = new UserTools(client$1);
+		server$1.addToolWithReadAccess("users-get-current", "Get the current user", async () => await tools.getCurrentUser());
+		server$1.addToolWithReadAccess("users-get-current-teams", "Get a list of teams where the current user is a member", async () => await tools.getCurrentUserTeams());
+		server$1.addToolWithReadAccess("users-list", "Get all users", async () => await tools.listMembers());
 		return tools;
 	}
 	async getCurrentUser() {
@@ -1494,14 +1525,14 @@ var UserTools = class UserTools extends BaseTools {
 //#endregion
 //#region src/tools/workflows.ts
 var WorkflowTools = class WorkflowTools extends BaseTools {
-	static create(client$1, server$1, isReadonly$1 = false) {
-		const tools = new WorkflowTools(client$1, isReadonly$1);
-		server$1.tool("get-default-workflow", "Get the default workflow for a specific team or the global default if no team is specified.", { teamPublicId: z.string().optional().describe("The public ID of the team to get the default workflow for.") }, async ({ teamPublicId }) => await tools.getDefaultWorkflow(teamPublicId));
-		server$1.tool("get-workflow", "Get a Shortcut workflow by public ID", {
+	static create(client$1, server$1) {
+		const tools = new WorkflowTools(client$1);
+		server$1.addToolWithReadAccess("workflows-get-default", "Get the default workflow for a specific team or the global default if no team is specified.", { teamPublicId: z.string().optional().describe("The public ID of the team to get the default workflow for.") }, async ({ teamPublicId }) => await tools.getDefaultWorkflow(teamPublicId));
+		server$1.addToolWithReadAccess("workflows-get-by-id", "Get a Shortcut workflow by public ID", {
 			workflowPublicId: z.number().positive().describe("The public ID of the workflow to get"),
 			full: z.boolean().optional().default(false).describe("True to return all workflow fields from the API. False to return a slim version that excludes uncommon fields")
 		}, async ({ workflowPublicId, full }) => await tools.getWorkflow(workflowPublicId, full));
-		server$1.tool("list-workflows", "List all Shortcut workflows", async () => await tools.listWorkflows());
+		server$1.addToolWithReadAccess("workflows-list", "List all Shortcut workflows", async () => await tools.listWorkflows());
 		return tools;
 	}
 	async getDefaultWorkflow(teamPublicId) {
@@ -1535,27 +1566,29 @@ var WorkflowTools = class WorkflowTools extends BaseTools {
 //#region src/server.ts
 let apiToken = process.env.SHORTCUT_API_TOKEN;
 let isReadonly = process.env.SHORTCUT_READONLY === "true";
+let enabledTools = (process.env.SHORTCUT_TOOLS || "").split(",").map((tool) => tool.trim()).filter(Boolean);
 if (process.argv.length >= 3) process.argv.slice(2).map((arg) => arg.split("=")).forEach(([name$1, value]) => {
 	if (name$1 === "SHORTCUT_API_TOKEN") apiToken = value;
 	if (name$1 === "SHORTCUT_READONLY") isReadonly = value === "true";
+	if (name$1 === "SHORTCUT_TOOLS") enabledTools = value.split(",").map((tool) => tool.trim()).filter(Boolean);
 });
 if (!apiToken) {
 	console.error("SHORTCUT_API_TOKEN is required");
 	process.exit(1);
 }
-const server = new McpServer({
-	name,
-	version
+const server = new CustomMcpServer({
+	readonly: isReadonly,
+	tools: enabledTools
 });
 const client = new ShortcutClientWrapper(new ShortcutClient(apiToken));
-UserTools.create(client, server, isReadonly);
-StoryTools.create(client, server, isReadonly);
-IterationTools.create(client, server, isReadonly);
-EpicTools.create(client, server, isReadonly);
-ObjectiveTools.create(client, server, isReadonly);
-TeamTools.create(client, server, isReadonly);
-WorkflowTools.create(client, server, isReadonly);
-DocumentTools.create(client, server, isReadonly);
+UserTools.create(client, server);
+StoryTools.create(client, server);
+IterationTools.create(client, server);
+EpicTools.create(client, server);
+ObjectiveTools.create(client, server);
+TeamTools.create(client, server);
+WorkflowTools.create(client, server);
+DocumentTools.create(client, server);
 async function startServer() {
 	try {
 		const transport = new StdioServerTransport();

package/package.json

@@ -12,7 +12,7 @@
 		"modelcontextprotocol"
 	],
 	"license": "MIT",
-	"version": "0.13.0",
+	"version": "0.15.1",
 	"type": "module",
 	"main": "dist/index.js",
 	"bin": {