ClickUpSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server that provides a standardized interface for AI assistants to interact with the ClickUp API. This server enables AI systems to access and manipulate ClickUp data such as workspaces, spaces, folders, lists, tasks, docs, comments, and checklists.
Available Tools
get_workspaces: Get the list of workspacesget_spaces: Get spaces within a workspaceget_tasks: Get tasks from a listcreate_task: Create a new taskupdate_task: Update an existing taskget_docs_from_workspace: Get all docs from a workspacecreate_folder: Create a new folder in a spaceget_lists: Get lists in a folder or spacecreate_list: Create a new list
Installation
git clone https://github.com/nsxdavid/clickup-mcp-server.git cd clickup-mcp-server npm install
Get ClickUp API Token
- Log in to ClickUp account
- Go to Settings > Apps
- Click "Generate API Token"
- Copy the token
Configuration
Add to the MCP settings file:
{
"mcpServers": {
"clickup": {
"command": "node",
"args": ["/path/to/clickup-mcp-server/build/index.js"],
"env": {
"CLICKUP_API_TOKEN": "YOUR_API_TOKEN_HERE"
},
"disabled": false,
"autoApprove": []
}
}
}*
9e0ebc46ae1eOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add clickup-mcp-server --env CLICKUP_API_TOKEN=${CLICKUP_API_TOKEN} --env CLICKUP_CLIENT_SECRET=${CLICKUP_CLIENT_SECRET} -- npx -y [email protected]{
"mcpServers": {
"clickup-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CLICKUP_API_TOKEN": "${CLICKUP_API_TOKEN}",
"CLICKUP_CLIENT_SECRET": "${CLICKUP_CLIENT_SECRET}"
}
}
}
}Exposed tools (42)
17 read · 19 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_task_to_list | write | Add an existing task to a ClickUp list. |
create_chat_view_comment | write | Create a new comment in a ClickUp chat view. Supports notification settings. |
create_checklist | write | Create a new checklist in a ClickUp task. Returns the created checklist details. |
create_checklist_item | write | Create a new item in a ClickUp checklist. Supports optional assignee and resolved status. |
create_folder | write | Create a new folder in a ClickUp space with the specified name. |
create_folderless_list | write | Create a new list directly in a ClickUp space without placing it in a folder. |
create_list | write | Create a new list in a ClickUp folder or space with the specified name. |
create_list_comment | write | Create a new comment on a ClickUp list. Supports optional assignee and notification settings. |
create_list_from_template_in_folder | write | Create a new list in a ClickUp folder using an existing template. |
create_list_from_template_in_space | write | Create a new list in a ClickUp space using an existing template. |
create_task | write | Create a new task in a ClickUp list with specified properties like name, description, assignees, status, and dates. |
create_task_comment | write | Create a new comment on a ClickUp task. Supports optional assignee and notification settings. |
create_threaded_comment | write | Create a new threaded comment (reply) to a parent comment. Supports notification settings. |
delete_checklist | destructive | Delete a checklist from a ClickUp task. Removes the checklist and all its items. |
delete_checklist_item | destructive | Delete an item from a ClickUp checklist. |
delete_comment | destructive | Delete a comment from ClickUp. |
delete_folder | destructive | Delete a folder from ClickUp. Removes the folder and its contents. |
delete_list | destructive | Delete a list from ClickUp. Removes the list and its tasks. |
get_chat_view_comments | read | Get comments for a ClickUp chat view. Returns comment details with pagination support. |
get_doc_content | read | Get the content of a specific ClickUp doc. Returns combined content from all pages in the doc. |
get_doc_pages | read | Get the pages of a specific ClickUp doc. Returns page content in the requested format (markdown or plain text). |
get_docs_from_workspace | read | Get all docs from a ClickUp workspace. Supports pagination and filtering for deleted/archived docs. |
get_folderless_lists | read | Get lists that are not in any folder within a ClickUp space. |
get_list | read | Get details about a specific ClickUp list including its name and content. |
get_list_comments | read | Get comments for a ClickUp list. Returns comment details with pagination support. |
get_lists | read | Get lists from a ClickUp folder or space. Returns list details including name and content. |
get_space | read | Get details about a specific ClickUp space. Returns space name, settings, features, and metadata. |
get_spaces | read | Get spaces from a ClickUp workspace. Returns space details including name, settings, and features. |
get_task_comments | read | Get comments for a ClickUp task. Returns comment details including text, author, and timestamps. |
get_task_details | read | Get detailed information about a specific ClickUp task. Returns comprehensive task data including description, assignees, status, and dates. |
get_tasks | read | Get tasks from a ClickUp list. Returns task details including name, description, assignees, and status. |
get_threaded_comments | read | Get threaded comments (replies) for a parent comment. Returns comment details with pagination support. |
get_workspace_seats | read | Get information about seats (user licenses) in a ClickUp workspace. Returns details about seat allocation and availability. |
get_workspaces | read | Get a list of all ClickUp workspaces accessible to the authenticated user. Returns workspace IDs, names, and metadata. |
remove_task_from_list | destructive | Remove a task from a ClickUp list without deleting the task. |
search_docs | read | Search for docs in a ClickUp workspace using a query string. Returns matching docs with their metadata. |
update_checklist | write | Update an existing ClickUp checklist\ |
update_checklist_item | write | Update an existing ClickUp checklist item\ |
update_comment | write | Update an existing ClickUp comment\ |
update_folder | write | Update an existing ClickUp folder\ |
update_list | write | Update an existing ClickUp list\ |
update_task | write | Update an existing ClickUp task\ |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
delete_checklist, delete_checklist_item, delete_comment, delete_folder, delete_list, remove_task_from_list
@modelcontextprotocol/sdk, axios, dotenv, express, open, zod, @types/node, @typescript-eslint/eslint-plugin
Gates applied: no_behavioural_pass.
9e0ebc46ae1efull audit observations/trust-audit/mcp-server/nsxdavid__clickup-5.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 9e0ebc46ae1e | SAFE | B | 89 | first audit |
Questions
What tools does ClickUp expose?
42 in total: 17 read-only, 19 that write, and 6 that can delete or overwrite (delete_checklist, delete_checklist_item, delete_comment, delete_folder, delete_list). Every one is listed on this page with its risk.
Is ClickUp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 6 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does ClickUp need?
It reads CLICKUP_API_TOKEN and CLICKUP_CLIENT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ClickUp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as clickup-mcp-server at 1.12.0.
How current is this page?
The grade is for one exact copy of the source (9e0ebc46ae1e), read on 2026-10-08. The repository is watched and re-audited when it changes.