clickup-mcp (TwoFeetUp/clickup-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 59 tools. No publisher has claimed this listing.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

TwoFeetUp

Source: ModelScope

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 16 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 2 credentials: ANTHROPIC_API_KEY, CLICKUP_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes59 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

manage_container

Unified tool for creating, updating, or deleting ClickUp lists and folders. Consolidates list and folder CRUD operations. Specify type (list/folder) and action (create/update/delete). Use IDs when available (preferred) or names. Detail levels: minimal (id/name), standard (with metadata), detailed (a

get_container

Unified tool for retrieving list or folder details. Consolidates get_list and get_folder. Use ID (preferred) or name. Supports flexible field selection and detail levels for response optimization.

manage_document

Unified document management tool for ClickUp documents. DOCUMENT OPERATIONS: - create: Create new document in a container (space, folder, or list) - update: Update document properties (name, visibility) PARENT CONTAINER TYPES (for create action): - Type 4: Space - Type 5: Folder - Type 6: List (mo

manage_document_page

Unified page management tool for document pages. PAGE OPERATIONS: - create: Create new page in a document - update: Update page content, name, or subtitle - get: Retrieve specific page(s) with content - list: List all pages in a document with optional depth control CONTENT EDITING MODES (update ac

list_documents

List and discover ClickUp documents with flexible filtering. DISCOVERY MODES: - No parameters: List all documents in workspace - By container: parent_id + parent_type to list from specific space/folder/list - By creator: creator ID to find documents by specific user - By status: Filter deleted, arc

create_document

Creates a document in a ClickUp space, folder, or list. Requires name, parent info, visibility and create_page flag. Example usage: - For list: parent: {"id": "901407953112", "type": 6} - For space: parent: {"id": "90141392755", "type": 4} - For folder: parent: {"id": "90144231850", "type": 5} Not

get_document

Gets details of a ClickUp document. Use documentId (preferred) or search by title in a container.

list_document_pages

Lists all pages in a document with optional depth control

get_document_pages

Gets the content of specific pages from a document

create_document_page

Creates a new page in a ClickUp document

update_document_page

Updates an existing page in a ClickUp document. Supports updating name, subtitle, and content with different edit modes (replace/append/prepend).

create_folder

Creates folder in ClickUp space. Use spaceId (preferred) or spaceName + folder name. Optional: override_statuses for folder-specific statuses. Use create_list_in_folder to add lists after creation.

get_folder

Gets folder details. Use folderId (preferred) or folderName + (spaceId/spaceName). Helps understand folder structure before creating/updating lists.

update_folder

Updates folder properties. Use folderId (preferred) or folderName + (spaceId/spaceName). At least one update field (name/override_statuses) required. Changes apply to all lists in folder.

delete_folder

PERMANENTLY deletes folder and all contents. Use folderId (preferred/safest) or folderName + (spaceId/spaceName). WARNING: Cannot be undone, all lists/tasks deleted, folderName risky if not unique.

create_list

Creates a list in a ClickUp space. Use spaceId (preferred) or spaceName + list name. Name is required. For lists in folders, use create_list_in_folder. Optional: content, dueDate, priority, assignee, status.

create_list_in_folder

Creates a list in a ClickUp folder. Use folderId (preferred) or folderName + space info + list name. Name is required. When using folderName, spaceId/spaceName required as folder names may not be unique. Optional: content, status.

get_list

Gets details of a ClickUp list. Use listId (preferred) or listName. Returns list details including name, content, and space info. ListId more reliable as names may not be unique.

update_list

Updates a ClickUp list. Use listId (preferred) or listName + at least one update field (name/content/status). ListId more reliable as names may not be unique. Only specified fields updated.

delete_list

PERMANENTLY deletes a ClickUp list and all its tasks. Use listId (preferred/safest) or listName. WARNING: Cannot be undone, all tasks will be deleted, listName risky if not unique.

find_members

Unified member management tool for workspace members. Find members by name/email, resolve assignees to user IDs, or list all members. Returns members matching the query, resolved user IDs, or the complete member list depending on parameters provided. Uses intelligent caching for efficiency.

get_workspace_members

Returns all members (users) in the ClickUp workspace/team. Useful for resolving assignees by name or email.

find_member_by_name

Finds a member in the ClickUp workspace by name or email. Returns the member object if found, or null if not found.

resolve_assignees

Resolves an array of assignee names or emails to ClickUp user IDs. Returns an array of user IDs, or errors for any that cannot be resolved.

operate_tags

Unified tag management for ClickUp workspaces. SPACE SCOPE - Manage tags in a space: - list: Get all tags in a space - create: Create a new tag (requires tagName, optional colors) - update: Update existing tag (requires tagName, at least one property to update) - delete: Remove tag from space (requ

get_space_tags

Gets all tags in a ClickUp space. Use spaceId (preferred) or spaceName. Tags are defined at space level - check available tags before adding to tasks.

create_space_tag

Purpose: Create a new tag in a ClickUp space. Valid Usage: 1. Provide spaceId (preferred if available) 2. Provide spaceName (will be resolved to a space ID) Requirements: - tagName: REQUIRED - EITHER spaceId OR spaceName: REQUIRED Notes: - New tag will be available for all tasks in the space - Yo

update_space_tag

Purpose: Update an existing tag in a ClickUp space. Valid Usage: 1. Provide spaceId (preferred if available) 2. Provide spaceName (will be resolved to a space ID) Requirements: - tagName: REQUIRED - EITHER spaceId OR spaceName: REQUIRED - At least one of newTagName, tagBg, tagFg, or colorCommand m

delete_space_tag

Purpose: Delete a tag from a ClickUp space. Valid Usage: 1. Provide spaceId (preferred if available) 2. Provide spaceName (will be resolved to a space ID) Requirements: - tagName: REQUIRED - EITHER spaceId OR spaceName: REQUIRED Warning: - This will remove the tag from all tasks in the space - Th

add_tag_to_task

Adds existing tag to task. Use taskId (preferred) or taskName + optional listName. Tag must exist in space (use get_space_tags to verify, create_space_tag if needed). WARNING: Will fail if tag doesn't exist.

remove_tag_from_task

Removes tag from task. Use taskId (preferred) or taskName + optional listName. Only removes tag-task association, tag remains in space. For multiple tasks, provide listName to disambiguate.

apply_template

List workspace task templates or create tasks from templates. Actions: list (show available templates), create (new task from template). Templates preserve subtasks, descriptions, and structure.

get_workspace_hierarchy

Gets complete workspace hierarchy (spaces, folders, lists). Returns tree structure with names and IDs for navigation. Resets all caches - useful after making changes or if not picking up expected results.

attach_task_file

Attaches file to task. Use taskId (preferred) or taskName + optional listName. File sources: 1) base64 + filename (≤10MB), 2) URL (http/https), 3) local path (absolute), 4) chunked for large files. WARNING: taskName without listName may match multiple tasks.

create_bulk_tasks

Creates multiple tasks in one list. Use listId (preferred) or listName + array of tasks (each needs name). Configure batch size/concurrency via options. Tasks can have custom fields as {id, value} array and assignees as array of user IDs, emails, or usernames.

update_bulk_tasks

Updates multiple tasks efficiently. For each task: use taskId (preferred) or taskName + listName. At least one update field per task. Supports assignees as array of user IDs, emails, or usernames. Configure batch size/concurrency via options. WARNING: taskName without listName will fail.

move_bulk_tasks

Moves multiple tasks to one list using ClickUp's native move endpoint. For each task: use taskId (preferred) or taskName + listName. Target list: use targetListId/Name. Configure batch size/concurrency via options. If a source status cannot be mapped deterministically, the task move fails explicitly

delete_bulk_tasks

PERMANENTLY deletes multiple tasks. For each task: use taskId (preferred/safest) or taskName + listName. Configure batch size/concurrency via options. WARNING: Cannot be undone, taskName without listName is dangerous.

manage_task

Modify tasks with action-based routing. Actions: create (new task), update (modify fields), delete (remove), move (to different list), duplicate (copy to another list), add_dependency (task A waits for task B), remove_dependency, add_link (bidirectional link between tasks), remove_link. Flexible tas

search_tasks

Search and retrieve tasks with rich filtering. Works 3 ways: (1) Single task by taskId/taskName/customTaskId, (2) List search by listId/listName, (3) Workspace-wide search by providing ANY filter (assignees, tags, statuses, dates, etc.) - automatically searches across all accessible lists. Returns p

task_comments

Manage task comments. Actions: get (retrieve comments), create (add new comment). Flexible task identification: taskId, taskName, or customTaskId. Comments can mention users and notify assignees.

task_time_tracking

Track time on tasks. Actions: get_entries (retrieve), start (begin timer), stop (end timer), add_entry (manual entry), delete_entry (remove entry), get_current (running timer). Flexible task identification: taskId, taskName, or customTaskId. Supports duration in multiple formats and billable/tags me

attach_file_to_task

Attach files to tasks. Supports URL attachments (links, images, documents) and file uploads. Use taskId (preferred), taskName, or customTaskId to identify task. Files are attached to task and visible in attachments section.

create_task

Creates a single task in a ClickUp list. Use listId (preferred) or listName. Required: name + list info. For multiple tasks use create_bulk_tasks. Can create subtasks via parent param. Supports custom fields as array of {id, value}. Supports assignees as array of user IDs, emails, or usernames.

update_task

Updates task properties. Use taskId (preferred) or taskName + optional listName. At least one update field required. Custom fields supported as array of {id, value}. Supports assignees as array of user IDs, emails, or usernames. WARNING: Using taskName without listName may match multiple tasks.

move_task

Moves task to different list using ClickUp's native move endpoint. Use taskId + (listId/listName) preferred, or taskName + sourceListName + (listId/listName). If source status cannot be mapped deterministically to destination statuses, the move fails explicitly.

duplicate_task

Creates copy of task in same/different list. Use taskId + optional (listId/listName), or taskName + sourceListName + optional (listId/listName). Preserves original properties. Default: same list as original.

get_task

Gets task details by taskId (automatically handles both regular and custom IDs) or taskName. For taskName search, provide listName for faster lookup. Set subtasks=true to include all subtask details.

get_tasks

Purpose: Retrieve tasks from a list with optional filtering. Valid Usage: 1. Use listId (preferred) 2. Use listName Requirements: - EITHER listId OR listName is REQUIRED Notes: - Use filters (archived, statuses, etc.) to narrow down results - Pagination available through page parameter - Sorting

get_task_comments

Gets task comments. Use taskId (preferred) or taskName + optional listName. Use start/startId params for pagination. Task names may not be unique across lists.

create_task_comment

Creates task comment. Use taskId (preferred) or taskName + listName. Required: commentText. Optional: notifyAll to notify assignees, assignee to assign comment.

delete_task

PERMANENTLY deletes task. Use taskId (preferred/safest) or taskName + optional listName. WARNING: Cannot be undone. Using taskName without listName may match multiple tasks.

get_task_time_entries

Gets all time entries for a task with filtering options. Use taskId (preferred) or taskName + optional listName. Returns all tracked time with user info, descriptions, tags, start/end times, and durations.

start_time_tracking

Starts time tracking on a task. Use taskId (preferred) or taskName + optional listName. Optional fields: description, billable status, and tags. Only one timer can be running at a time.

stop_time_tracking

Stops the currently running time tracker. Optional fields: description and tags. Returns the completed time entry details.

add_time_entry

Adds a manual time entry to a task. Use taskId (preferred) or taskName + optional listName. Required: start time, duration. Optional: description, billable, tags.

delete_time_entry

Deletes a time entry. Required: time entry ID.

get_current_time_entry

Gets the currently running time entry, if any. No parameters needed.

get_workspace_tasks

Purpose: Retrieve tasks from across the entire workspace with powerful filtering options, including tag-based filtering. Valid Usage: 1. Apply any combination of filters (tags, lists, folders, spaces, statuses, etc.) 2. Use pagination to manage large result sets 3. Include subtasks by setting subta

// known CVEs in dependencies16 high4 medium10 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.11.3GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.11.3GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.11.3GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.6.7GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.6.7GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configALLOWED_ORIGINS
🔐 secretANTHROPIC_API_KEY
🔐 secretCLICKUP_API_KEY"": "your-api-key-here",
configCLICKUP_TEAM_ID"": "your-team-id-here"
configDISABLED_COMMANDS
configDISABLED_TOOLS
configDOCUMENT_MODEL
configDOCUMENT_MODULE
configDOCUMENT_SUPPORT
configENABLED_TOOLS
configENABLE_CORS
configENABLE_HTTPS
configENABLE_ORIGIN_VALIDATION
configENABLE_RATE_LIMIT
configENABLE_SECURITY_FEATURES
configENABLE_SPONSOR_MESSAGE
configENABLE_SSE
configENABLE_STDIO
configHTTPS_PORT
configLOG_LEVELLogging verbosity (default: "info")
configMAX_REQUEST_SIZE
configRATE_LIMIT_MAX
configRATE_LIMIT_WINDOW_MS
configREQUEST_SPACING
configSSE_PORT
configSSL_CA_PATH
configSSL_CERT_PATH
configSSL_KEY_PATH
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Dependencies

12 dependencies, 1 flagged: playwright

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

59/59 tools missing one or more hints — manage_container (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_container (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); manage_document (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +56 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 16 high severity in production deps — @modelcontextprotocol/sdk@1.11.3 (high), @modelcontextprotocol/sdk@1.11.3 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Domain consistency

npm scope @sjotie doesn't match GitHub owner twofeetup

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/twofeetup/clickup-mcp?variant=verified)](https://m8ven.ai/mcp/twofeetup/clickup-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 702808f4c98678adf0914b9c2a453d0df6f7959c
code hash: cbeb8459c542350a64a9d66451771d6ff3bcbcf007a1eb6a23361689075f4894
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client