Clickup Mcp Pro — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Clickup Mcp Pro (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The most complete ClickUp MCP server — 161 typed tools + `clickup_raw` covering the entire ClickUp v2/v3 API. Built to match or beat the paid alternatives, free and open source.
ClickUp MCP Pro exposes nearly every ClickUp operation as a typed Model Context Protocol tool — so Claude Code (and any MCP client) can drive your entire workspace: tasks, lists, folders, spaces, docs, chat, goals, sprints, time tracking, custom fields, webhooks, guests and more. When a niche endpoint isn't wrapped, clickup_raw reaches the rest of the API directly, giving you 100% coverage.
CLICKUP_READONLY=true) blocks every write while keeping reads working — safe exploration."tomorrow", "in 3 days", "+2h", ISO, or epoch ms all work for any date field.find_member, find_space_by_name, find_list_by_name.Retry-After honored, actionable error messages.| Domain | Tools | Domain | Tools |
|---|---|---|---|
| Workspace / Teams | 6 | Time tracking | 14 |
| Spaces | 5 | Docs (v3) | 8 |
| Folders | 7 | Views | 7 |
| Lists | 9 | Goals & Key Results | 8 |
| Tasks (core) | 11 | Chat (v3) | 18 |
| Tasks (bulk) | 4 | Sprints | 3 |
| Task links & dependencies | 6 | Webhooks | 4 |
| Comments & threads | 10 | User groups | 4 |
| Checklists | 6 | Guests (Enterprise) | 10 |
| Attachments | 2 | Members & resolvers | 5 |
| Tags | 6 | Templates | 2 |
| Custom fields | 6 | `clickup_raw` | 1 |
ClickUp → Settings → Apps → API Token (it starts with pk_).
{
"mcpServers": {
"clickup": {
"command": "npx",
"args": ["-y", "clickup-mcp-pro"],
"env": {
"CLICKUP_API_TOKEN": "pk_your_token_here",
"CLICKUP_TEAM_ID": "9007012345"
}
}
}
}Or, running from source:
{
"mcpServers": {
"clickup": {
"command": "node",
"args": ["d:/GitHub/easypanel-mcp/projects/clickup-mcp-pro/dist/index.js"],
"env": { "CLICKUP_API_TOKEN": "pk_your_token_here" }
}
}
}File: %APPDATA%\Claude\claude_desktop_config.json (Windows) or ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) — same mcpServers block as above.
| Variable | Required | Default | Description |
|---|---|---|---|
CLICKUP_API_TOKEN | ✅ | — | Personal API token (pk_...). CLICKUP_TOKEN is also accepted. |
CLICKUP_TEAM_ID | — | — | Default Team/Workspace id used when a tool omits team_id. |
CLICKUP_READONLY | — | false | true blocks all writes (reads still work). |
CLICKUP_DISABLE_RAW | — | false | true hides the clickup_raw tool. |
CLICKUP_UPLOAD_DIR | — | — | Restrict upload_task_attachment(file_path) to this base directory. |
CLICKUP_MAX_UPLOAD_BYTES | — | 52428800 | Max attachment size (50 MB) for uploads. |
CLICKUP_TIMEOUT_MS | — | 60000 | Per-request timeout. |
CLICKUP_MAX_RETRIES | — | 3 | Max retries on 429/5xx/network errors. |
This server runs locally and acts on behalf of your token, so it's hardened against the usual ways a malicious prompt could abuse a tool call:
CLICKUP_UPLOAD_DIR to prevent arbitrary local-file exfiltration. Uploads are size-capped (CLICKUP_MAX_UPLOAD_BYTES). Note: don't place symlinks pointing outside the directory inside CLICKUP_UPLOAD_DIR... or @) and is blocked for writes under CLICKUP_READONLY=true. Set CLICKUP_DISABLE_RAW=true to remove it entirely in untrusted environments.cd projects/clickup-mcp-pro
npm install
npm run build
# Inspect interactively:
npm run inspectorget_workspaces, get_workspace_seats, get_workspace_plan, get_workspace_members, get_custom_task_types, get_authorized_user
list_spaces, get_space, create_space, update_space, delete_space, get_space_tags
list_folders, get_folder, create_folder, create_folder_from_template, update_folder, delete_folder, get_folder_views
get_lists_in_folder, get_folderless_lists, get_list, create_list_in_folder, create_folderless_list, create_list_from_template_in_folder, update_list, delete_list, get_list_views
get_tasks, get_task, get_workspace_tasks, create_task, update_task, delete_task, get_subtasks, duplicate_task, set_task_custom_field_value, remove_task_custom_field_value, get_task_members Bulk: create_bulk_tasks, update_bulk_tasks, delete_bulk_tasks, move_bulk_tasks Links & deps: add_task_link, delete_task_link, add_task_dependency, delete_task_dependency, add_task_to_list, remove_task_from_list
get_task_comments, create_task_comment, get_list_comments, create_list_comment, get_chat_view_comments, create_chat_view_comment, update_comment, delete_comment, get_threaded_comments, create_threaded_comment
create_checklist, edit_checklist, delete_checklist, create_checklist_item, edit_checklist_item, delete_checklist_item
upload_task_attachment (local path / URL / base64), list_task_attachments
get_space_tags, create_space_tag, update_space_tag, delete_space_tag, add_tag_to_task, remove_tag_from_task get_list_custom_fields, get_folder_custom_fields, get_space_custom_fields, get_workspace_custom_fields, set_custom_field_value, remove_custom_field_value
get_time_entries, get_time_entry, get_running_time_entry, start_time_entry, stop_time_entry, create_time_entry, update_time_entry, delete_time_entry, get_time_entry_history, get_all_time_entry_tags, add_tags_to_time_entries, remove_tags_from_time_entries, get_task_time_in_status, get_bulk_tasks_time_in_status
search_docs, get_doc, create_doc, get_doc_page_listing, get_doc_pages, get_doc_page, create_doc_page, update_doc_page (replace/append/prepend)
get_team_views, get_space_views, get_view, get_view_tasks, create_view, update_view, delete_view
get_goals, get_goal, create_goal, update_goal, delete_goal, create_key_result, update_key_result, delete_key_result
list_chat_channels, get_chat_channel, create_chat_channel, create_chat_channel_on_location, create_chat_direct_message, update_chat_channel, get_chat_channel_members, get_chat_channel_followers, get_chat_messages, send_chat_message, update_chat_message, delete_chat_message, get_chat_message_replies, create_chat_message_reply, get_chat_message_reactions, create_chat_message_reaction, delete_chat_message_reaction, get_chat_message_tagged_users
list_sprints, get_active_sprint, get_sprint_tasks list_webhooks, create_webhook, update_webhook, delete_webhook list_user_groups, create_user_group, update_user_group, delete_user_group invite_guest, get_guest, edit_guest, remove_guest, add_guest_to_task, remove_guest_from_task, add_guest_to_list, remove_guest_from_list, add_guest_to_folder, remove_guest_from_folder get_task_templates, create_task_from_template
get_task_assignable_members, get_list_members, find_member, find_space_by_name, find_list_by_name
clickup_raw — call any ClickUp v2/v3 endpoint directly. Example:
{ "method": "GET", "path": "/team/9007012345/space", "version": "v2" }| ClickUp MCP Pro | taazkareem (paid) | Nazruden | DiversioTeam | |
|---|---|---|---|---|
| Typed tools | 161 | ~150 | ~30 | ~28 |
| Raw escape hatch | ✅ | — | — | — |
| Readonly mode | ✅ | — | — | — |
| Chat / Goals / Sprints | ✅ | ✅ | — | — |
| Docs (v3) | ✅ | ✅ | ✅ | — |
| Time tracking | ✅ | ✅ | — | partial |
| Price | Free / MIT | Paid | Free | Free |
MIT © Helbert Paranhos / Strat Academy
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.