monday.com vs Shortcut

monday.com

The GraphQL API publishes its full schema, accepts an Idempotency-Key header on mutations and reports limits in RateLimit headers, and a documented signup API lets an agent create its own account and token. Personal tokens carry every permission their user has, daily calls stop at 1,000 below Pro, and the status page shows two long platform incidents since July 2026.

Shortcut

REST API v3 and the hosted MCP server are included on the Free plan, with downloadable OpenAPI files and OAuth scopes down to story or comment writes on the MCP side. The API still accepts the token in a query string, and no idempotency keys, Retry-After header, uptime SLA or API changelog were found in the reviewed documentation.

monday.com

1. Send an API-Version header such as 2026-10 on every call. Without it the API uses whichever version is current
2. Read the board's columns first (get_board_info or boards { columns }), then write column values as a JSON string keyed by column ID
3. Reuse one Idempotency-Key per mutation when retrying after a timeout or 5xx. After a 429, wait for Retry-After or retry_in_seconds
4. Page items with items_page and next_items_page, at most 500 a page. Cursors expire after 60 minutes
5. For a narrower grant than a personal token, connect MCP through a custom OAuth app with only scopes such as boards:read

Shortcut

1. Send the v3 token in the Shortcut-Token header. v4 (alpha) takes Authorization: Bearer with sct_ro_ or sct_rw_ tokens, and v3 tokens don't work there.
2. Create a story with name and workflow_state_id. Sending both workflow_state_id and project_id, or neither, is rejected.
3. Use GET /api/v3/search/stories with detail=slim, page_size (1 to 250) and the next token. Many other v3 list endpoints return every record at once.
4. Stay under 200 requests a minute and add your own backoff on 429, because no Retry-After header is documented.
5. For MCP, connect to https://mcp.shortcut.com/mcp and request only the scopes needed, such as read or story-write.