clio-mcp

Connects Claude to Clio practice management, enabling AI-assisted access to matters, contacts, documents, tasks, and billing with audit logging and encryption for law firm compliance.

→ oktopeak/clio-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama github_topic

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 3 credentials: CLIO_CLIENT_SECRET, ENCRYPTION_KEY, MCP_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configCLIO_API_BASE— No https://app.clio.com/api/v4 Override for Clio EU, Canada, or Australia (e.g., https://eu.app.clio.com/api/v4)

configCLIO_AUTH_URL— No https://app.clio.com/oauth/authorize OAuth authorization endpoint

configCLIO_CLIENT_ID— "": "your_client_id",

🔐 secretCLIO_CLIENT_SECRET— "": "your_client_secret"

configCLIO_REDIRECT_PORT— No 5678 Local port for the OAuth callback (stdio mode). Change if 5678 is in use on your machine

configCLIO_REGION— No us us or eu. Controls the default Clio API and auth base URLs

configCLIO_TOKEN_URL— No https://app.clio.com/oauth/token OAuth token endpoint

🔐 secretENCRYPTION_KEY— No auto-generated Overrides OS keychain. Required only for CI/headless installs where no keychain is available. Must be a 64-character hex string.

🔐 secretMCP_API_KEY— If you set on the server, pass it as a header from mcp-remote (--header "Authorization: Bearer <key>").

configMCP_BASE_URL— TRANSPORT=http =http://127.0.0.1:3000 \

configPORT— No 3000 HTTP listen port (HTTP mode only)

configTRANSPORT— "": "stdio",

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/oktopeak-clio-mcp-1dbywb)](https://m8ven.ai/mcp/oktopeak-clio-mcp-1dbywb)

commit: 63e0441c376d1f45942cc0942d754bfb3c95bc56

code hash: b5c014050574d330401a0973cd559c2a23d718da656ce28ddab2bfc62dba43bd

verified: 6/18/2026, 10:45:38 AM

view raw JSON →