io.github.cvrt-jh/clickup-mcp
NPM · @CAVORT-IT-SYSTEMS/CLICKUP-MCP
Lightweight ClickUp MCP server - 37 tools, token-optimized (95% smaller responses)
Available components
Last scanned (39 minutes ago)
Scores higher than 55% of npm servers
Category Project Management
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 27 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability75
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 3112 tokens (~77/item across 40 items; 40 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage96
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 89% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "clickup_delete_list" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 40 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Stability: 0.97 → pass security
- 3 Nov 26 0
- Stability: pass → 0.97 functional
- 28 Oct 26 0
- Stability: 0.97 → pass security
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −5
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 21 Oct 26 0
- Stability: 0.97 → pass security
- 20 Oct 26 0
- Stability: pass → 0.97 functional
- 17 Oct 26 +2
- Stability: 0.83 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@cavort-it-systems/clickup-mcp@1.1.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
clickup_add_dependency ~65
Add a dependency between tasks (waiting_on or blocking)
| Name | Type | Req | Description |
|---|---|---|---|
| dependency_of | string | – | Task ID that this task blocks |
| depends_on | string | – | Task ID this task is waiting on |
| task_id | string | yes | The task to add the dependency to |
No output schema declared.
No examples provided.
clickup_add_tag_to_task ~66
Add a tag to a task
| Name | Type | Req | Description |
|---|---|---|---|
| tag_name | string | yes | Tag name to add |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_add_task_link ~41
Link two tasks together
| Name | Type | Req | Description |
|---|---|---|---|
| links_to | string | yes | Second task ID to link to |
| task_id | string | yes | First task ID |
No output schema declared.
No examples provided.
clickup_add_task_to_list ~140
Add a task to an ADDITIONAL list (multi-homing). This does NOT move the task: its home list is unchanged and it may not appear in the target list's task query. Requires the paid Tasks-in-Multiple-Lists feature. There is no API to move a task between lists - use the ClickUp web UI (right-click -> Move) to preserve the custom ID and history.
| Name | Type | Req | Description |
|---|---|---|---|
| list_id | string | yes | ClickUp list ID |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_create_checklist ~62
Create a checklist on a task
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Checklist name |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_create_checklist_item ~50
Add an item to a checklist
| Name | Type | Req | Description |
|---|---|---|---|
| assignee | number | – | User ID to assign |
| checklist_id | string | yes | Checklist ID |
| name | string | yes | Item name |
No output schema declared.
No examples provided.
clickup_create_comment ~93
Add a comment to a task
| Name | Type | Req | Description |
|---|---|---|---|
| assignee | number | – | User ID to assign with this comment |
| comment_text | string | yes | Comment text |
| notify_all | boolean | – | Notify all assignees (default true) |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_create_list ~130
Create a new list in a folder or as a folderless list in a space
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | – | List description |
| due_date | number | – | Due date as Unix timestamp in milliseconds |
| folder_id | string | – | Folder ID (for list inside folder) |
| name | string | yes | List name |
| priority | number | – | Priority (1=urgent, 2=high, 3=normal, 4=low) |
| space_id | string | – | Space ID (for folderless list) |
| status | string | – | Status name to use as default |
No output schema declared.
No examples provided.
clickup_create_reply ~38
Add a threaded reply to a comment
| Name | Type | Req | Description |
|---|---|---|---|
| comment_id | string | yes | Comment ID |
| comment_text | string | yes | Reply text |
No output schema declared.
No examples provided.
clickup_create_space_tag ~76
Create a new tag in a space
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Tag name |
| space_id | string | yes | ClickUp space ID |
| tag_bg | string | – | Background color hex (e.g. '#000000') |
| tag_fg | string | – | Foreground color hex (e.g. '#ffffff') |
No output schema declared.
No examples provided.
clickup_create_task ~248
Create a new task in a list
| Name | Type | Req | Description |
|---|---|---|---|
| assignees | array | – | Array of user IDs to assign |
| custom_fields | array | – | Custom field values to set |
| description | string | – | Task description (plain text or markdown) |
| due_date | number | – | Due date as Unix timestamp in milliseconds |
| due_date_time | boolean | – | Whether due_date includes time |
| list_id | string | yes | ClickUp list ID |
| markdown_description | string | – | Task description in markdown |
| name | string | yes | Task name |
| notify_all | boolean | – | Notify assignees (default true) |
| parent | string | – | Parent task ID (to create subtask) |
| priority | number | – | Priority: 1=urgent, 2=high, 3=normal, 4=low |
| start_date | number | – | Start date as Unix timestamp in milliseconds |
| start_date_time | boolean | – | Whether start_date includes time |
| status | string | – | Status name (must match list's statuses) |
| tags | array | – | Array of tag names |
| time_estimate | number | – | Time estimate in milliseconds |
No output schema declared.
No examples provided.
clickup_delete_checklist ~29
Delete a checklist and all its items
| Name | Type | Req | Description |
|---|---|---|---|
| checklist_id | string | yes | Checklist ID |
No output schema declared.
No examples provided.
clickup_delete_checklist_item ~39
Delete a checklist item
| Name | Type | Req | Description |
|---|---|---|---|
| checklist_id | string | yes | Checklist ID |
| checklist_item_id | string | yes | Checklist item ID |
No output schema declared.
No examples provided.
clickup_delete_dependency ~68
Remove a dependency. Note: uses query params, not body.
| Name | Type | Req | Description |
|---|---|---|---|
| dependency_of | string | – | Task ID that this task was blocking |
| depends_on | string | – | Task ID this task was waiting on |
| task_id | string | yes | The task to remove the dependency from |
No output schema declared.
No examples provided.
clickup_delete_list ~34
Delete a list. This is permanent and cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| list_id | string | yes | ClickUp list ID |
No output schema declared.
No examples provided.
clickup_delete_space_tag ~42
Delete a tag from a space
| Name | Type | Req | Description |
|---|---|---|---|
| space_id | string | yes | ClickUp space ID |
| tag_name | string | yes | Tag name to delete |
No output schema declared.
No examples provided.
clickup_delete_task ~51
Permanently delete a task
| Name | Type | Req | Description |
|---|---|---|---|
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_delete_task_link ~42
Remove a link between two tasks
| Name | Type | Req | Description |
|---|---|---|---|
| links_to | string | yes | Second task ID to unlink |
| task_id | string | yes | First task ID |
No output schema declared.
No examples provided.
clickup_edit_checklist ~50
Rename or reorder a checklist
| Name | Type | Req | Description |
|---|---|---|---|
| checklist_id | string | yes | Checklist ID |
| name | string | – | New checklist name |
| position | number | – | New position (0-indexed) |
No output schema declared.
No examples provided.
clickup_edit_checklist_item ~105
Edit a checklist item (name, resolved status, assignee, or parent)
| Name | Type | Req | Description |
|---|---|---|---|
| assignee | number | – | User ID to assign (or null to unassign) |
| checklist_id | string | yes | Checklist ID |
| checklist_item_id | string | yes | Checklist item ID |
| name | string | – | New item name |
| parent | string | – | Parent checklist item ID (to nest items) |
| resolved | boolean | – | Mark as resolved/unresolved |
No output schema declared.
No examples provided.
clickup_edit_space_tag ~82
Edit (rename or recolor) a tag in a space
| Name | Type | Req | Description |
|---|---|---|---|
| new_name | string | – | New tag name |
| space_id | string | yes | ClickUp space ID |
| tag_bg | string | – | New background color hex |
| tag_fg | string | – | New foreground color hex |
| tag_name | string | yes | Current tag name |
No output schema declared.
No examples provided.
clickup_get_comments ~83
Get comments on a task (paginated, 25 per page)
| Name | Type | Req | Description |
|---|---|---|---|
| start | number | – | Start offset for pagination |
| start_id | string | – | Comment ID to start from |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_get_folders ~46
List folders in a space (includes nested lists)
| Name | Type | Req | Description |
|---|---|---|---|
| archived | boolean | – | Include archived folders (default false) |
| space_id | string | yes | ClickUp space ID |
No output schema declared.
No examples provided.
clickup_get_list ~32
Get a single list's details including its statuses
| Name | Type | Req | Description |
|---|---|---|---|
| list_id | string | yes | ClickUp list ID |
No output schema declared.
No examples provided.
clickup_get_list_members ~32
Get members with access to a specific list
| Name | Type | Req | Description |
|---|---|---|---|
| list_id | string | yes | ClickUp list ID |
No output schema declared.
No examples provided.
clickup_get_lists ~69
Get lists in a folder, or folderless lists in a space. Provide either folder_id or space_id.
| Name | Type | Req | Description |
|---|---|---|---|
| archived | boolean | – | Include archived lists (default false) |
| folder_id | string | – | ClickUp folder ID |
| space_id | string | – | ClickUp space ID |
No output schema declared.
No examples provided.
clickup_get_replies ~28
Get threaded replies to a comment
| Name | Type | Req | Description |
|---|---|---|---|
| comment_id | string | yes | Comment ID |
No output schema declared.
No examples provided.
clickup_get_space_tags ~30
List all tags in a space
| Name | Type | Req | Description |
|---|---|---|---|
| space_id | string | yes | ClickUp space ID |
No output schema declared.
No examples provided.
clickup_get_spaces ~43
List all spaces in a workspace
| Name | Type | Req | Description |
|---|---|---|---|
| archived | boolean | – | Include archived spaces (default false) |
| team_id | string | yes | ClickUp workspace/team ID |
No output schema declared.
No examples provided.
clickup_get_task ~81
Get a task by its ID
| Name | Type | Req | Description |
|---|---|---|---|
| include_markdown_description | boolean | – | Return description as markdown |
| include_subtasks | boolean | – | Include subtasks (default false) |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_get_tasks ~211
List tasks in a list with optional filters
| Name | Type | Req | Description |
|---|---|---|---|
| archived | boolean | – | Include archived tasks |
| assignees | array | – | Filter by assignee IDs |
| date_created_gt | number | – | Created after (ms) |
| date_created_lt | number | – | Created before (ms) |
| date_updated_gt | number | – | Updated after (ms) |
| date_updated_lt | number | – | Updated before (ms) |
| due_date_gt | number | – | Due date greater than (ms) |
| due_date_lt | number | – | Due date less than (ms) |
| include_closed | boolean | – | Include closed tasks |
| include_markdown_description | boolean | – | – |
| list_id | string | yes | ClickUp list ID |
| order_by | string | – | – |
| page | number | – | Page number (0-indexed) |
| reverse | boolean | – | Reverse sort order |
| statuses | array | – | Filter by status names |
| subtasks | boolean | – | Include subtasks |
No output schema declared.
No examples provided.
clickup_get_workspace_members ~25
Get all members across all workspaces (extracted from teams response)
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
clickup_remove_tag_from_task ~66
Remove a tag from a task
| Name | Type | Req | Description |
|---|---|---|---|
| tag_name | string | yes | Tag name to remove |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_remove_task_from_list ~103
Remove a task from an ADDITIONAL list it was multi-homed into. Cannot remove a task from its home list (use clickup_delete_task for that). Requires the paid Tasks-in-Multiple-Lists feature.
| Name | Type | Req | Description |
|---|---|---|---|
| list_id | string | yes | ClickUp list ID |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_search_tasks ~202
Search tasks across an entire workspace
| Name | Type | Req | Description |
|---|---|---|---|
| assignees | array | – | – |
| date_created_gt | number | – | – |
| date_created_lt | number | – | – |
| date_updated_gt | number | – | – |
| date_updated_lt | number | – | – |
| due_date_gt | number | – | – |
| due_date_lt | number | – | – |
| folder_ids | array | – | Filter by folder IDs |
| include_closed | boolean | – | – |
| include_markdown_description | boolean | – | – |
| list_ids | array | – | Filter by list IDs |
| order_by | string | – | – |
| page | number | – | Page number (0-indexed) |
| project_ids | array | – | Filter by project IDs |
| reverse | boolean | – | – |
| space_ids | array | – | Filter by space IDs |
| statuses | array | – | – |
| subtasks | boolean | – | – |
| team_id | string | yes | ClickUp workspace/team ID |
No output schema declared.
No examples provided.
clickup_set_custom_field ~86
Set a custom field value on a task (update_task cannot do this)
| Name | Type | Req | Description |
|---|---|---|---|
| field_id | string | yes | Custom field ID |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
| value | – | yes | Custom field value (type depends on field type) |
No output schema declared.
No examples provided.
clickup_update_comment ~67
Edit a comment's text or resolve/unresolve it
| Name | Type | Req | Description |
|---|---|---|---|
| assignee | number | – | New assignee user ID |
| comment_id | string | yes | Comment ID |
| comment_text | string | – | New comment text |
| resolved | boolean | – | Mark as resolved/unresolved |
No output schema declared.
No examples provided.
clickup_update_task ~235
Update a task. Assignees use add/rem arrays, not a flat list.
| Name | Type | Req | Description |
|---|---|---|---|
| archived | boolean | – | Archive/unarchive the task |
| assignees | object | – | Assignee changes (add/rem) |
| description | string | – | New description |
| due_date | number | – | Due date as Unix timestamp in milliseconds |
| due_date_time | boolean | – | – |
| markdown_description | string | – | New description in markdown |
| name | string | – | New task name |
| parent | string | – | Move to new parent (set null to unparent) |
| priority | number | – | Priority: 1=urgent, 2=high, 3=normal, 4=low |
| start_date | number | – | Start date as Unix timestamp in milliseconds |
| start_date_time | boolean | – | – |
| status | string | – | New status |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
| time_estimate | number | – | Time estimate in milliseconds |
No output schema declared.
No examples provided.
clickup_upload_attachment ~99
Upload a local file (screenshot, PDF, ...) as an attachment to a task
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Absolute path of the local file to upload |
| filename | string | – | Name shown in ClickUp (default: the file's own name) |
| task_id | string | yes | ClickUp task ID: internal (e.g. 86caqr85m) or custom (e.g. DEV-1217) |
No output schema declared.
No examples provided.
clickup_whoami ~23
Get current user info and list of workspaces with members
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the io.github.cvrt-jh/clickup-mcp server?
io.github.cvrt-jh/clickup-mcp runs locally as an npm package, launched with npx -y @cavort-it-systems/clickup-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @cavort-it-systems/clickup-mcp
claude mcp add cvrt-jh-clickup-mcp -- npx -y @cavort-it-systems/clickup-mcp
What is the io.github.cvrt-jh/clickup-mcp server?
io.github.cvrt-jh/clickup-mcp is listed in the public MCP registry as io.github.cvrt-jh/clickup-mcp. Lightweight ClickUp MCP server - 37 tools, token-optimized (95% smaller responses). This page covers its npm package (@cavort-it-systems/clickup-mcp).
Is the io.github.cvrt-jh/clickup-mcp server safe to use?
io.github.cvrt-jh/clickup-mcp scores 77 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.cvrt-jh/clickup-mcp server expose?
io.github.cvrt-jh/clickup-mcp exposes 40 tools: clickup_whoami, clickup_get_spaces, clickup_get_folders, clickup_get_lists, clickup_get_list, and 35 more. Their descriptions and schemas cost roughly 3,112 tokens of context every time the server is loaded.
Is the io.github.cvrt-jh/clickup-mcp server still maintained?
io.github.cvrt-jh/clickup-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.cvrt-jh/clickup-mcp server under?
io.github.cvrt-jh/clickup-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.