Clickup Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Clickup Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fork of @hauptsache.net/clickup-mcp with custom task ID support and additional features.
Model Context Protocol (MCP) server enabling AI assistants to interact with ClickUp workspaces. Get complete task context with comments and images, search across projects, create and update tasks, collaborate through comments, and track time - all through natural language.
This fork is published as @sebastienheyd/clickup-mcp and follows its own version numbers. Upstream history is merged (last sync: upstream 1.9.0, September 2026), so the two projects share their core; the fork keeps its own additions on top.
| Area | Only in this fork |
|---|---|
| Task IDs | Custom task IDs (e.g. SOI-4422) accepted wherever a task_id is expected, time tools included |
searchTasks | include_closed and archived filters |
searchSpaces | folder_id to resolve a single folder with its lists and statuses |
createTask / updateTask | Sprint points; remove_assignees; null clears due_date, start_date, time_estimate and points |
| Descriptions | description (full replacement) on updateListInfo too, and both tools echo the previous description |
| Comments | deleteComment (same guardrails as editComment) |
| Time tracking | updateTimeEntry and deleteTimeEntry; getTimeEntries shows each entry_id |
| Tooling | Makefile with the common commands; npm run cli understands key=null |
| Runtime | Node.js 20 or newer (upstream: 16) |
See CHANGELOG.md for this fork's history and the upstream changelog for theirs.
See also: Official ClickUp MCP Documentation
| Feature | This MCP | Official ClickUp MCP |
|---|---|---|
| Setup | Local npm/npx install | Remote MCP (no install) |
| Authentication | API key only | OAuth only |
| Task Context | Complete with comments, status history, inline images | Requires mutiple tool calls for full contxt |
| Image Support | Read and write: inline images with smart size budgeting, and  uploads automatically | Upload via separate tool calls; base64 capped at ~200KB |
| Search | Fuzzy search on recent tasks (limited scope) | Full ClickUp search database |
| Documents | CRUD operations | CRUD + document search |
| Time Tracking | View and create entries | Timers and entries |
| Chat Integration | Not supported | Supported |
| Connected Apps | Not supported | Connected Search |
| Best For | Coding tools, automation, context gathering | Chat apps, task management |
| Support | Community (open source) | Official ClickUp |
Choose this MCP when:
read-minimal mode optimized for development workflowsChoose Official MCP when:
Turn natural language into powerful ClickUp actions:
Agentic Coding & Development:
Time Tracking & Productivity:
Smart Search & Discovery:
Daily Workflow Management:
Rich Context & Collaboration:
Document Management:
append_description adds a dated block under the existing description and is the default for notes. description rewrites the whole description on purpose - the previous content is echoed back so a wrong replacement can be undoneFor all installation methods, you'll need:
CLICKUP_API_KEY (Profile Icon > Settings > Apps > API Token ~ usually starts with pk_)CLICKUP_TEAM_ID (The 7–10 digit number in the URL when you are in the settings)Download the pre-built bundle from our releases page. This method requires no Node.js installation.
You'll get a configuration screen where you are prompted to enter your API key and team ID.
This method automatically updates to the latest version and is preferred for users who want the newest features.
For Claude Desktop, Windsurf, Cursor and others:
Add the following to your MCP configuration file:
{
"mcpServers": {
"clickup": {
"command": "npx",
"args": [
"@sebastienheyd/clickup-mcp@latest"
],
"env": {
"CLICKUP_API_KEY": "your_api_key",
"CLICKUP_TEAM_ID": "your_team_id"
}
}
}
}Replace your_api_key and your_team_id with your actual ClickUp credentials.
Where to add this configuration:
Claude Code (CLI):
claude mcp add --scope user clickup \
--env CLICKUP_API_KEY=YOUR_KEY \
--env CLICKUP_TEAM_ID=YOUR_ID \
--env CLICKUP_MCP_MODE=read-minimal \
--env MAX_IMAGES=16 \
--env MAX_RESPONSE_SIZE_MB=4 \
-- npx -y @sebastienheyd/clickup-mcpClaude Code can handle a lot of images, thus the recommended increased limits.
Note the CLICKUP_MCP_MODE=read-minimal. This is my usage recommendation, but feel free to use one of the other modes.OpenAI Codex: Add these lines to your ~/.codex/config.toml file:
[mcp_servers.clickup]
command = "npx"
args = ["-y", "@sebastienheyd/clickup-mcp@latest"]
env = { "CLICKUP_API_KEY" = "YOUR_KEY", "CLICKUP_TEAM_ID" = "YOUR_ID", "CLICKUP_MCP_MODE" = "read-minimal" }Codex seems to not be able to handle images from MCP's. See this issue for more details.
Note the CLICKUP_MCP_MODE=read-minimal. This is my usage recommendation, but feel free to use one of the other modes.The ClickUp MCP supports three operational modes to balance functionality, security, and performance:
| Tool | read-minimal | read | write | Description |
|---|---|---|---|---|
getTaskById | ✅ | ✅ | ✅ | Get complete task details including comments, images, and metadata |
addComment | ❌ | ❌ | ✅ | Add comments to tasks for collaboration |
editComment | ❌ | ❌ | ✅ | Correct your own comment within 24h instead of posting a follow-up |
deleteComment | ❌ | ❌ | ✅ | Delete your own comment within 24h (deleted text is echoed back) |
updateTask | ❌ | ❌ | ✅ | Update tasks (status, priority, assignees, etc.); append to or replace descriptions |
createTask | ❌ | ❌ | ✅ | Create new tasks with full markdown support |
searchTasks | ✅ | ✅ | ✅ | Find tasks by content, keywords, assignees, or project context |
searchSpaces | ❌ | ✅ | ✅ | Browse workspace structure, project organization, and documents |
getListInfo | ❌ | ✅ | ✅ | Get list details and available statuses for task creation |
updateListInfo | ❌ | ❌ | ✅ | Append to or replace list descriptions (previous content echoed back on replace) |
getTimeEntries | ❌ | ✅ | ✅ | View time entries and analyze time spent across projects |
createTimeEntry | ❌ | ❌ | ✅ | Log time entries for task tracking |
updateTimeEntry | ❌ | ❌ | ✅ | Adjust your own time entries (duration, start, description, task) |
deleteTimeEntry | ❌ | ❌ | ✅ | Delete your own time entries (irreversible, values are echoed back) |
readDocument | ❌ | ✅ | ✅ | Get document details, page structure, and content with navigation |
searchDocuments | ❌ | ✅ | ✅ | Search documents by name and space with fuzzy matching and space filtering |
updateDocumentPage | ❌ | ❌ | ✅ | Update existing page content or name with replace/append modes |
createDocumentOrPage | ❌ | ❌ | ✅ | Create new documents with first page, or add pages/sub-pages to existing documents |
Add the mode to your MCP configuration:
{
"mcpServers": {
"clickup": {
"command": "npx",
"args": ["-y", "@sebastienheyd/clickup-mcp@latest"],
"env": {
"CLICKUP_API_KEY": "your_api_key",
"CLICKUP_TEAM_ID": "your_team_id",
"CLICKUP_MCP_MODE": "read"
}
}
}
}This MCP server can be configured using environment variables:
CLICKUP_API_KEY: (Required) Your ClickUp API key.CLICKUP_TEAM_ID: (Required) Your ClickUp Team ID (formerly Workspace ID).CLICKUP_MCP_MODE: (Optional) Controls which tools are available. Options: read-minimal, read, write (default).MAX_IMAGES: (Optional) The maximum number of images to return for a task in getTaskById. Defaults to 4.MAX_RESPONSE_SIZE_MB: (Optional) The maximum response size in megabytes for getTaskById. Uses intelligent size budgeting to fit the most important images within the limit. Defaults to 1.MAX_UPLOAD_SIZE_MB: (Optional) The maximum size of a single image uploaded when writing comments or descriptions. Defaults to 10.CLICKUP_COMMENT_EDIT_WINDOW_HOURS: (Optional) How long after creation editComment may still rewrite a comment. Defaults to 24. Set to 0 to disable comment editing entirely.CLICKUP_PRIMARY_LANGUAGE: (Optional) A hint for the primary language used in your ClickUp tasks (e.g., "de" for German, "en" for English). This helps the searchTask tool provide more tailored guidance in its description for multilingual searches.LANG: (Optional) If CLICKUP_PRIMARY_LANGUAGE is not set, the MCP will check this standard environment variable (e.g., "en_US.UTF-8", "de_DE") as a fallback to infer the primary language.The searchTask tool's description will dynamically adjust based on the detected primary language:
CLICKUP_PRIMARY_LANGUAGE or LANG suggests a known primary language (e.g., German), the tool's description will specifically recommend providing search terms in both English and that detected language (e.g., German) for optimal results.This feature aims to improve search effectiveness when the language of user queries (often English) differs from the language of the tasks in ClickUp, without making the MCP itself perform translations. The responsibility for providing bilingual search terms still lies with the agent calling the MCP, but the MCP offers more specific advice if it has a language hint.
Task descriptions and list documentation support full markdown formatting:
Task Creation with Markdown:
Create a task called "API Integration" with description:
# API Integration Requirements
## Authentication
- Implement OAuth 2.0 flow
- Add JWT token validation
- **Priority**: High security standards
## Endpoints
1. `/api/users` - User management
2. `/api/data` - Data retrieval
3. `/api/webhook` - Event notifications
## Testing
- [ ] Unit tests for auth flow
- [ ] Integration tests
- [ ] Load testing with 1000+ concurrent users
> **Note**: This replaces the legacy REST implementation
See related task: https://app.clickup.com/t/abc123Append or Replace Descriptions: By default (append_description), content is appended under the existing description:
[Existing task description content]
---
**Edit (2024-01-15):** Added new acceptance criteria based on client feedback:
- Must support mobile responsive design
- Performance requirement: < 2s load timeThis keeps existing content and a clear audit trail. To correct or restructure a description, description rewrites it entirely; the tool answers with the previous description so nothing is silently lost. The same two parameters exist on updateListInfo.
addComment, createTask and updateTask accept images as ordinary markdown. Because this server runs locally, it reads the file itself - so a local path is enough:
Ist umgesetzt. So sieht es aus:
**1. Login öffnen** – der Kunde gibt nur seine E-Mail-Adresse ein.
Accepted sources: local file paths, data: URIs, http(s) URLs (downloaded, then re-uploaded), and existing ClickUp attachment URLs (embedded without re-uploading).
Notes:
data: URI costs roughly 4/3 of its file size in the request.
displays beneath the image - so write a caption that reads well.
steps as bold lines with the image between them, as above.
extension. A file that fails aborts the write: addComment and updateTask report every broken reference and change nothing, so the markdown can be fixed and the call retried without creating duplicates. createTask validates its images before creating the task; only an upload failing afterwards is reported as a warning, since the task already exists at that point.
returned by getTaskById back and they stay; ClickUp refuses to add any other image to an existing comment, so a new image reference is rejected before anything is uploaded. Share a new image in a new comment with addComment instead.
Optimized for AI Workflows:
MAX_IMAGES, default: 4) and total response size limits (MAX_RESPONSE_SIZE_MB, default: 1MB)Current Scope:
These limitations ensure reliable performance while covering the most common use cases for both development context and productivity management.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.