Clickup Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Clickup Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Lightweight ClickUp MCP server focused on task management. 37 tools with token-optimized responses — API responses automatically slimmed from thousands of characters to essentials.
ClickUp's API returns extremely verbose JSON. This server strips it down:
| Response | Before | After | Reduction |
|---|---|---|---|
clickup_whoami | ~3,500 chars | ~160 chars | 95% |
clickup_create_comment | ~1,500 chars | ~38 chars | 97% |
Less tokens = faster responses, lower costs, more context for your AI.
npm install -g @cavort-it-systems/clickup-mcpOr run directly:
npx @cavort-it-systems/clickup-mcpclaude mcp add clickup -e CLICKUP_API_TOKEN=your-token -- npx @cavort-it-systems/clickup-mcpAdd to your MCP config (~/.claude.json or Claude Desktop settings):
{
"mcpServers": {
"clickup": {
"command": "npx",
"args": ["@cavort-it-systems/clickup-mcp"],
"env": {
"CLICKUP_API_TOKEN": "your-token"
}
}
}
}git clone https://github.com/cvrt-jh/clickup-mcp.git
cd clickup-mcp
npm install && npm run buildThen configure with the built path:
claude mcp add clickup -e CLICKUP_API_TOKEN=your-token -- node /path/to/clickup-mcp/build/index.jsCLICKUP_API_TOKENAll responses are automatically trimmed to save tokens. The ClickUp API returns extremely verbose JSON — this server strips it down to what matters.
`clickup_whoami` — from ~3,500 chars to ~160:
// Before (ClickUp API raw)
{"user":{"id":12345678,"username":"Jane Doe","email":"[email protected]","color":"#0388d1",
"profilePicture":"https://attachments.clickup.com/...","initials":"JD",
"week_start_day":1,"global_font_support":true,"timezone":"Europe/Berlin"},
"teams":{"teams":[{"id":"99999999","name":"My Workspace","color":"#40BC86",
"avatar":"https://attachments2.clickup.com/...?Expires=...&Key-Pair-Id=...&Signature=...",
"members":[{"user":{"id":11111111,"username":"Bob Smith","email":"[email protected]",
"color":"#aa2fff","profilePicture":null,"initials":"BS","role":4,"role_subtype":2,
"role_key":"guest","custom_role":null,"last_active":"...","date_joined":"...",
"date_invited":"..."},"invited_by":{"id":22222222,...},
"can_see_time_spent":true,...}, ...]}]}}
// After (slimmed)
{"id":12345678,"username":"Jane Doe","email":"[email protected]",
"timezone":"Europe/Berlin","workspaces":[{"id":"99999999",
"name":"My Workspace","member_count":4}]}`clickup_create_comment` — from ~1,500 chars to 38:
// Before
{"id":90150191300876,"hist_id":"...","date":1770053982842,
"version":{"object_type":"comment","object_id":"...","workspace_id":99999999,
"operation":"c","data":{"context":{"root_parent_type":1,"is_chat":false,
"audit_context":{"userid":12345678,"current_time":...,"route":"*"},...},...},...}}
// After
{"id":90150191300876,"date":1770053982842}What gets stripped:
| Field | Where | Why |
|---|---|---|
features{} | spaces | ~50 lines of boolean flags per space |
sharing{}, permission_level | tasks | Internal access config, not useful |
watchers[] | tasks | Usually same as assignees |
| Full user objects | everywhere | Reduced to {id, username, email} |
profilePicture, initials, color | users | Visual metadata, not useful for LLMs |
version{} blobs | comment/reply creates | Internal versioning data |
invited_by, profileInfo | members | Invitation metadata |
| Pretty-print JSON | all responses | Compact single-line output |
| Empty arrays | tasks | checklists, dependencies, custom_fields omitted when empty |
clickup_whoami - Current user + workspacesclickup_get_spaces - Spaces in workspaceclickup_get_folders - Folders in spaceclickup_get_lists - Lists in folder or spaceclickup_get_list - Single list detailsclickup_create_list - Create list in folder or spaceclickup_delete_list - Delete a list (permanent)clickup_get_task - Get task by IDclickup_create_task - Create task with all fieldsclickup_update_task - Update any task fieldclickup_get_tasks - List tasks in a listclickup_search_tasks - Search tasks across workspaceclickup_set_custom_field - Set custom field valueclickup_get_space_tags - List space tagsclickup_create_space_tag - Create tagclickup_edit_space_tag - Edit tagclickup_delete_space_tag - Delete tagclickup_add_tag_to_task - Tag a taskclickup_remove_tag_from_task - Untag a taskclickup_create_checklist - Create checklistclickup_edit_checklist - Edit checklistclickup_delete_checklist - Delete checklistclickup_create_checklist_item - Add itemclickup_edit_checklist_item - Edit itemclickup_delete_checklist_item - Delete itemclickup_add_dependency - Add dependencyclickup_delete_dependency - Remove dependencyclickup_add_task_link - Link tasksclickup_delete_task_link - Unlink tasksclickup_create_comment - Add commentclickup_get_comments - Get commentsclickup_update_comment - Edit/resolve commentclickup_create_reply - Threaded replyclickup_get_replies - Get repliesclickup_delete_task - Delete a taskclickup_get_workspace_members - All workspace membersclickup_get_list_members - List-specific memberssrc/
index.ts # Entry: McpServer + StdioServerTransport
client.ts # ClickUp API v2 fetch wrapper
types.ts # Shared Zod schemas + jsonResult helper
slim.ts # Response slimming transformers
tools/
navigation.ts # 7 tools
tasks.ts # 7 tools (CRUD + custom fields + delete)
tags.ts # 6 tools
checklists.ts # 6 tools
dependencies.ts # 4 tools
comments.ts # 5 tools
members.ts # 2 toolsMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.