@shortcut/mcp

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    60: 	});
    61: 	return {
>>> 62: 		port: Number.parseInt(process.env.PORT || String(DEFAULT_PORT), 10),
    63: 		isReadonly,
    64: 		enabledTools,

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    4: 
    5: //#region src/server.ts
>>> 6: let apiToken = process.env.SHORTCUT_API_TKN || process.env.SHORTCUT_API_TOKEN;
    7: let isReadonly = process.env.SHORTCUT_READONLY === "true";
    8: let enabledTools = (process.env.SHORTCUT_TOOLS || "").split(",").map((tool) => tool.trim()).filter(Boolean);

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    53: 	let isReadonly = process.env.SHORTCUT_READONLY !== "false";
    54: 	let enabledTools = parseToolsList(process.env.SHORTCUT_TOOLS || "");
>>> 55: 	let httpDebug = process.env.SHORTCUT_HTTP_DEBUG === "true";
    56: 	if (process.argv.length >= 3) process.argv.slice(2).map((arg) => arg.split("=")).forEach(([name, value]) => {
    57: 		if (name === "SHORTCUT_READONLY") isReadonly = value !== "false";

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    52: function loadConfig() {
    53: 	let isReadonly = process.env.SHORTCUT_READONLY !== "false";
>>> 54: 	let enabledTools = parseToolsList(process.env.SHORTCUT_TOOLS || "");
    55: 	let httpDebug = process.env.SHORTCUT_HTTP_DEBUG === "true";
    56: 	if (process.argv.length >= 3) process.argv.slice(2).map((arg) => arg.split("=")).forEach(([name, value]) => {

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    51: });
    52: function loadConfig() {
>>> 53: 	let isReadonly = process.env.SHORTCUT_READONLY !== "false";
    54: 	let enabledTools = parseToolsList(process.env.SHORTCUT_TOOLS || "");
    55: 	let httpDebug = process.env.SHORTCUT_HTTP_DEBUG === "true";

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    6: let apiToken = process.env.SHORTCUT_API_TKN || process.env.SHORTCUT_API_TOKEN;
    7: let isReadonly = process.env.SHORTCUT_READONLY === "true";
>>> 8: let enabledTools = (process.env.SHORTCUT_TOOLS || "").split(",").map((tool) => tool.trim()).filter(Boolean);
    9: if (process.argv.length >= 3) process.argv.slice(2).map((arg) => arg.split("=")).forEach(([name, value]) => {
    10: 	if (name === "SHORTCUT_API_TKN") apiToken = value;

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    5: //#region src/server.ts
    6: let apiToken = process.env.SHORTCUT_API_TKN || process.env.SHORTCUT_API_TOKEN;
>>> 7: let isReadonly = process.env.SHORTCUT_READONLY === "true";
    8: let enabledTools = (process.env.SHORTCUT_TOOLS || "").split(",").map((tool) => tool.trim()).filter(Boolean);
    9: if (process.argv.length >= 3) process.argv.slice(2).map((arg) => arg.split("=")).forEach(([name, value]) => {

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    41: const logger = pino({
    42: 	level: process.env.LOG_LEVEL || "info",
>>> 43: 	transport: process.env.NODE_ENV !== "production" ? {
    44: 		target: "pino-pretty",
    45: 		options: {

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    40: };
    41: const logger = pino({
>>> 42: 	level: process.env.LOG_LEVEL || "info",
    43: 	transport: process.env.NODE_ENV !== "production" ? {
    44: 		target: "pino-pretty",

Decoded base64 content: u��v�,��'~(.�)�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r����m�x,�������b

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: Š䲖�x7�j�mZ��~Z0

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: j�"�p�����K��w�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��Z��R���>���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��Z��R���>���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��Z��R���>���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��Z��R���>���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��Z��R���>���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��R���z�r^�v�.)�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��R���z�r^�v�.)�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: Š䲖�x7�j�mZ��~Z0

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: Š䲖�x7�j�mZ��~Z0

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: Š䲖�x7�j�mZ��~Z0

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r����m�x,�������b

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r���)ݲ���Ƭq�^�g)

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r�^���)ݲ���g)

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: rW���R��^I�,���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: rW���R��^I�,���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��B��ޞ����"w�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ���I�,��͢�h�wD��+

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r���䞮��"{-jw

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �{�Ȩ�)�&��7�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r���䞮��"{-jw

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ���I�,��͢�h�wD��+

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Dynamic code execution via exec()

Detected by automated pattern matching (rule SC-003) with medium confidence. May be a false positive.

    65: 		let next_page_token = null;
    66: 		if (next) try {
>>> 67: 			const [, t] = /next=(.+)(?:&|$)/.exec(next) || [];
    68: 			if (t) next_page_token = t;
    69: 		} catch {}

Decoded base64 content: ��B��ޞ����"w�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��T��&�x��ڶ*'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �+-"׫jب�+h�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �+-"׫jب�+h�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��R���z�r^�v�.)�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r����A�+����Rǫ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r����A�+����Rǫ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ���y�jם{b�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ���y�jם{b�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ���y�jם{b�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ���y�jם{b�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ���y�jם{b�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ���y�jם{b�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ���y�jם{b�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r����A�+����Rǫ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r����A�+����Rǫ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r����A�+����Rǫ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��?��%���z�����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �w%�ג��� ��*m���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �w%�ג��� ��*m���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �w%�ג��� ��*m���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �+-"׫jب�+h�'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��T��&�x��ڶ*'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��T��&�x��ڶ*'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��?��%����-���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: j�"�p�����K��w�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��Z��R���>���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��R���z�r^�v�.)�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

High-entropy string (5.3 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Possible Base64-encoded payload (long encoded string)

Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.

    99: 
    100: ### Cursor
>>> 101: [![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en-US/install-mcp?name=shortcut&config=eyJlbnYiOnsiU0hPUlRDVVRfQVBJX1RPS0VOIjoiWU9VUl9UT0tFTiJ9LCJjb21tYW5kIjoibnB4IC15IEBzaG9ydGN1dC9tY3AifQ%3D%3D)
    102: 
    103: See the [official Cursor docs](https://docs.cursor.com/context/model-context-protocol) for more information.

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.