ClickUp MCP Server (Nazruden)
ClickUp task and workspace data access for AI assistants via personal API tokens.
Data last scanned today · Reviewed today
Overview
This implementation provides an interface for MCP-compatible AI clients to interact with ClickUp workspaces. It functions by requiring a personal API token, which the server uses to authenticate requests sent to the ClickUp platform. The server operates via Stdio, aligning with the standard MCP execution model. Users configure their client environments with the necessary ClickUp tokens to initiate connectivity.
Our verdict
The ClickUp MCP Server (Nazruden) carries a high risk level with a security score of 35/100. This assessment is driven by its status as a community-maintained project rather than an official vendor release and the lack of an independent editorial security review. Because authentication methods and the handling of the personal API token have not been formally audited, it is recommended primarily for users comfortable with the inherent risks of experimental, non-official software.
- Uses only 5 direct dependencies
- Provides documented setup instructions
- Released under the MIT license
- High risk score due to lack of security review
- Not maintained by the official ClickUp organization
- Encryption mechanism for API tokens is currently unused
Setup
{
"mcpServers": {
"nazruden-clickup-mcp-server": {
"args": [
"-y",
"@nazruden/clickup-server"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| clickup_create_task | Create a new task in a ClickUp list. | medium |
| clickup_update_task | Update an existing task's properties. | medium |
| clickup_get_teams | Retrieve all accessible teams (Workspaces in ClickUp API v2). | low |
| clickup_get_lists | Get all lists in a specific folder. | low |
| clickup_create_board | Create a new board in a ClickUp space. | medium |
| clickup_get_spaces | Retrieves all Spaces for a given Workspace (Team). | low |
| clickup_create_space | Creates a new Space within a Workspace. | medium |
| clickup_get_space | Retrieves details for a specific Space. | low |
| clickup_update_space | Updates an existing Space. | medium |
| clickup_delete_space | Deletes a Space. | high |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›How do I authenticate this server with my ClickUp account?
You must obtain a Personal API Token from the 'Apps' section in your ClickUp 'My Settings' and provide it to the server using the CLICKUP_PERSONAL_TOKEN environment variable.
›Is the ENCRYPTION_KEY environment variable used to protect my API token?
No, while the codebase includes an encryption mechanism, it is currently not utilized for encrypting the Personal API Token.
›Can I use the PORT environment variable to run this server over HTTP?
The server operates using Stdio by default, and the PORT environment variable is not used in this mode.
›What are the limitations regarding ClickUp Doc management?
ClickUp's API for Docs has limitations where complex embeds or advanced formatting may not be fully supported, and direct deletion of documents is not supported via the V3 endpoint.
›Are there additional logging options available?
Yes, you can adjust the verbosity of the server logs by setting the LOG_LEVEL environment variable to error, warn, info, or debug.
Badge
Maintain this server? Add the live badge to your README.