clickup-mcp (TwoFeetUp/clickup-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 59 tools. No publisher has claimed this listing.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
TwoFeetUp
Source: ModelScope
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
manage_containerUnified tool for creating, updating, or deleting ClickUp lists and folders. Consolidates list and folder CRUD operations. Specify type (list/folder) and action (create/update/delete). Use IDs when available (preferred) or names. Detail levels: minimal (id/name), standard (with metadata), detailed (a…
get_containerUnified tool for retrieving list or folder details. Consolidates get_list and get_folder. Use ID (preferred) or name. Supports flexible field selection and detail levels for response optimization.
manage_documentUnified document management tool for ClickUp documents. DOCUMENT OPERATIONS: - create: Create new document in a container (space, folder, or list) - update: Update document properties (name, visibility) PARENT CONTAINER TYPES (for create action): - Type 4: Space - Type 5: Folder - Type 6: List (mo…
manage_document_pageUnified page management tool for document pages. PAGE OPERATIONS: - create: Create new page in a document - update: Update page content, name, or subtitle - get: Retrieve specific page(s) with content - list: List all pages in a document with optional depth control CONTENT EDITING MODES (update ac…
list_documentsList and discover ClickUp documents with flexible filtering. DISCOVERY MODES: - No parameters: List all documents in workspace - By container: parent_id + parent_type to list from specific space/folder/list - By creator: creator ID to find documents by specific user - By status: Filter deleted, arc…
create_documentCreates a document in a ClickUp space, folder, or list. Requires name, parent info, visibility and create_page flag. Example usage: - For list: parent: {"id": "901407953112", "type": 6} - For space: parent: {"id": "90141392755", "type": 4} - For folder: parent: {"id": "90144231850", "type": 5} Not…
get_documentGets details of a ClickUp document. Use documentId (preferred) or search by title in a container.
list_document_pagesLists all pages in a document with optional depth control
get_document_pagesGets the content of specific pages from a document
create_document_pageCreates a new page in a ClickUp document
update_document_pageUpdates an existing page in a ClickUp document. Supports updating name, subtitle, and content with different edit modes (replace/append/prepend).
create_folderCreates folder in ClickUp space. Use spaceId (preferred) or spaceName + folder name. Optional: override_statuses for folder-specific statuses. Use create_list_in_folder to add lists after creation.
get_folderGets folder details. Use folderId (preferred) or folderName + (spaceId/spaceName). Helps understand folder structure before creating/updating lists.
update_folderUpdates folder properties. Use folderId (preferred) or folderName + (spaceId/spaceName). At least one update field (name/override_statuses) required. Changes apply to all lists in folder.
delete_folderPERMANENTLY deletes folder and all contents. Use folderId (preferred/safest) or folderName + (spaceId/spaceName). WARNING: Cannot be undone, all lists/tasks deleted, folderName risky if not unique.
create_listCreates a list in a ClickUp space. Use spaceId (preferred) or spaceName + list name. Name is required. For lists in folders, use create_list_in_folder. Optional: content, dueDate, priority, assignee, status.
create_list_in_folderCreates a list in a ClickUp folder. Use folderId (preferred) or folderName + space info + list name. Name is required. When using folderName, spaceId/spaceName required as folder names may not be unique. Optional: content, status.
get_listGets details of a ClickUp list. Use listId (preferred) or listName. Returns list details including name, content, and space info. ListId more reliable as names may not be unique.
update_listUpdates a ClickUp list. Use listId (preferred) or listName + at least one update field (name/content/status). ListId more reliable as names may not be unique. Only specified fields updated.
delete_listPERMANENTLY deletes a ClickUp list and all its tasks. Use listId (preferred/safest) or listName. WARNING: Cannot be undone, all tasks will be deleted, listName risky if not unique.
find_membersUnified member management tool for workspace members. Find members by name/email, resolve assignees to user IDs, or list all members. Returns members matching the query, resolved user IDs, or the complete member list depending on parameters provided. Uses intelligent caching for efficiency.
get_workspace_membersReturns all members (users) in the ClickUp workspace/team. Useful for resolving assignees by name or email.
find_member_by_nameFinds a member in the ClickUp workspace by name or email. Returns the member object if found, or null if not found.
resolve_assigneesResolves an array of assignee names or emails to ClickUp user IDs. Returns an array of user IDs, or errors for any that cannot be resolved.
operate_tagsUnified tag management for ClickUp workspaces. SPACE SCOPE - Manage tags in a space: - list: Get all tags in a space - create: Create a new tag (requires tagName, optional colors) - update: Update existing tag (requires tagName, at least one property to update) - delete: Remove tag from space (requ…
get_space_tagsGets all tags in a ClickUp space. Use spaceId (preferred) or spaceName. Tags are defined at space level - check available tags before adding to tasks.
create_space_tagPurpose: Create a new tag in a ClickUp space. Valid Usage: 1. Provide spaceId (preferred if available) 2. Provide spaceName (will be resolved to a space ID) Requirements: - tagName: REQUIRED - EITHER spaceId OR spaceName: REQUIRED Notes: - New tag will be available for all tasks in the space - Yo…
update_space_tagPurpose: Update an existing tag in a ClickUp space. Valid Usage: 1. Provide spaceId (preferred if available) 2. Provide spaceName (will be resolved to a space ID) Requirements: - tagName: REQUIRED - EITHER spaceId OR spaceName: REQUIRED - At least one of newTagName, tagBg, tagFg, or colorCommand m…
delete_space_tagPurpose: Delete a tag from a ClickUp space. Valid Usage: 1. Provide spaceId (preferred if available) 2. Provide spaceName (will be resolved to a space ID) Requirements: - tagName: REQUIRED - EITHER spaceId OR spaceName: REQUIRED Warning: - This will remove the tag from all tasks in the space - Th…
add_tag_to_taskAdds existing tag to task. Use taskId (preferred) or taskName + optional listName. Tag must exist in space (use get_space_tags to verify, create_space_tag if needed). WARNING: Will fail if tag doesn't exist.
remove_tag_from_taskRemoves tag from task. Use taskId (preferred) or taskName + optional listName. Only removes tag-task association, tag remains in space. For multiple tasks, provide listName to disambiguate.
apply_templateList workspace task templates or create tasks from templates. Actions: list (show available templates), create (new task from template). Templates preserve subtasks, descriptions, and structure.
get_workspace_hierarchyGets complete workspace hierarchy (spaces, folders, lists). Returns tree structure with names and IDs for navigation. Resets all caches - useful after making changes or if not picking up expected results.
attach_task_fileAttaches file to task. Use taskId (preferred) or taskName + optional listName. File sources: 1) base64 + filename (≤10MB), 2) URL (http/https), 3) local path (absolute), 4) chunked for large files. WARNING: taskName without listName may match multiple tasks.
create_bulk_tasksCreates multiple tasks in one list. Use listId (preferred) or listName + array of tasks (each needs name). Configure batch size/concurrency via options. Tasks can have custom fields as {id, value} array and assignees as array of user IDs, emails, or usernames.
update_bulk_tasksUpdates multiple tasks efficiently. For each task: use taskId (preferred) or taskName + listName. At least one update field per task. Supports assignees as array of user IDs, emails, or usernames. Configure batch size/concurrency via options. WARNING: taskName without listName will fail.
move_bulk_tasksMoves multiple tasks to one list using ClickUp's native move endpoint. For each task: use taskId (preferred) or taskName + listName. Target list: use targetListId/Name. Configure batch size/concurrency via options. If a source status cannot be mapped deterministically, the task move fails explicitly…
delete_bulk_tasksPERMANENTLY deletes multiple tasks. For each task: use taskId (preferred/safest) or taskName + listName. Configure batch size/concurrency via options. WARNING: Cannot be undone, taskName without listName is dangerous.
manage_taskModify tasks with action-based routing. Actions: create (new task), update (modify fields), delete (remove), move (to different list), duplicate (copy to another list), add_dependency (task A waits for task B), remove_dependency, add_link (bidirectional link between tasks), remove_link. Flexible tas…
search_tasksSearch and retrieve tasks with rich filtering. Works 3 ways: (1) Single task by taskId/taskName/customTaskId, (2) List search by listId/listName, (3) Workspace-wide search by providing ANY filter (assignees, tags, statuses, dates, etc.) - automatically searches across all accessible lists. Returns p…
task_commentsManage task comments. Actions: get (retrieve comments), create (add new comment). Flexible task identification: taskId, taskName, or customTaskId. Comments can mention users and notify assignees.
task_time_trackingTrack time on tasks. Actions: get_entries (retrieve), start (begin timer), stop (end timer), add_entry (manual entry), delete_entry (remove entry), get_current (running timer). Flexible task identification: taskId, taskName, or customTaskId. Supports duration in multiple formats and billable/tags me…
attach_file_to_taskAttach files to tasks. Supports URL attachments (links, images, documents) and file uploads. Use taskId (preferred), taskName, or customTaskId to identify task. Files are attached to task and visible in attachments section.
create_taskCreates a single task in a ClickUp list. Use listId (preferred) or listName. Required: name + list info. For multiple tasks use create_bulk_tasks. Can create subtasks via parent param. Supports custom fields as array of {id, value}. Supports assignees as array of user IDs, emails, or usernames.
update_taskUpdates task properties. Use taskId (preferred) or taskName + optional listName. At least one update field required. Custom fields supported as array of {id, value}. Supports assignees as array of user IDs, emails, or usernames. WARNING: Using taskName without listName may match multiple tasks.
move_taskMoves task to different list using ClickUp's native move endpoint. Use taskId + (listId/listName) preferred, or taskName + sourceListName + (listId/listName). If source status cannot be mapped deterministically to destination statuses, the move fails explicitly.
duplicate_taskCreates copy of task in same/different list. Use taskId + optional (listId/listName), or taskName + sourceListName + optional (listId/listName). Preserves original properties. Default: same list as original.
get_taskGets task details by taskId (automatically handles both regular and custom IDs) or taskName. For taskName search, provide listName for faster lookup. Set subtasks=true to include all subtask details.
get_tasksPurpose: Retrieve tasks from a list with optional filtering. Valid Usage: 1. Use listId (preferred) 2. Use listName Requirements: - EITHER listId OR listName is REQUIRED Notes: - Use filters (archived, statuses, etc.) to narrow down results - Pagination available through page parameter - Sorting …
get_task_commentsGets task comments. Use taskId (preferred) or taskName + optional listName. Use start/startId params for pagination. Task names may not be unique across lists.
create_task_commentCreates task comment. Use taskId (preferred) or taskName + listName. Required: commentText. Optional: notifyAll to notify assignees, assignee to assign comment.
delete_taskPERMANENTLY deletes task. Use taskId (preferred/safest) or taskName + optional listName. WARNING: Cannot be undone. Using taskName without listName may match multiple tasks.
get_task_time_entriesGets all time entries for a task with filtering options. Use taskId (preferred) or taskName + optional listName. Returns all tracked time with user info, descriptions, tags, start/end times, and durations.
start_time_trackingStarts time tracking on a task. Use taskId (preferred) or taskName + optional listName. Optional fields: description, billable status, and tags. Only one timer can be running at a time.
stop_time_trackingStops the currently running time tracker. Optional fields: description and tags. Returns the completed time entry details.
add_time_entryAdds a manual time entry to a task. Use taskId (preferred) or taskName + optional listName. Required: start time, duration. Optional: description, billable, tags.
delete_time_entryDeletes a time entry. Required: time entry ID.
get_current_time_entryGets the currently running time entry, if any. No parameters needed.
get_workspace_tasksPurpose: Retrieve tasks from across the entire workspace with powerful filtering options, including tag-based filtering. Valid Usage: 1. Apply any combination of filters (tags, lists, folders, spaces, statuses, etc.) 2. Use pagination to manage large result sets 3. Include subtasks by setting subta…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
ALLOWED_ORIGINSANTHROPIC_API_KEYCLICKUP_API_KEY"": "your-api-key-here",CLICKUP_TEAM_ID"": "your-team-id-here"DISABLED_COMMANDSDISABLED_TOOLSDOCUMENT_MODELDOCUMENT_MODULEDOCUMENT_SUPPORTENABLED_TOOLSENABLE_CORSENABLE_HTTPSENABLE_ORIGIN_VALIDATIONENABLE_RATE_LIMITENABLE_SECURITY_FEATURESENABLE_SPONSOR_MESSAGEENABLE_SSEENABLE_STDIOHTTPS_PORTLOG_LEVELLogging verbosity (default: "info")MAX_REQUEST_SIZERATE_LIMIT_MAXRATE_LIMIT_WINDOW_MSREQUEST_SPACINGSSE_PORTSSL_CA_PATHSSL_CERT_PATHSSL_KEY_PATHPORTDependencies
12 dependencies, 1 flagged: playwright
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
59/59 tools missing one or more hints — manage_container (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_container (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); manage_document (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +56 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 16 high severity in production deps — @modelcontextprotocol/sdk@1.11.3 (high), @modelcontextprotocol/sdk@1.11.3 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Domain consistency
npm scope @sjotie doesn't match GitHub owner twofeetup
Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/twofeetup/clickup-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check