ClickUp MCP

**Judgement:** A strong, high-coverage ClickUp integration for OpenClaw users who are comfortable with CLI/OAuth setup. Excellent for serious ClickUp-centric workflows, less ideal for casual or non-technical users due to the authentication flow. **What it’s good at** - **Deep ClickUp control:** Create/update tasks, manage comments, run timers, browse workspace hierarchy, interact with chat, and work with Docs from one MCP. - **Powerful search:** `clickup_search` can query tasks, docs, dashboards, chat, and files, which is very useful for knowledge and project assistants. - **Well-scoped writes:** No delete operations are exposed, which significantly reduces the risk of destructive automations. - **Mature surface:** The tool list maps cleanly onto key ClickUp concepts (tasks, lists, folders, members, docs), making it suitable for building rich agents. **Main risks / limitations** - **OAuth + allowlist friction:** Direct OAuth is only supported from allowlisted clients; OpenClaw users must follow a multi-step workaround via Claude Code and mcporter. This can be fragile for less technical users and depends on external client behavior not changing. - **Token handling risk:** The long-lived access token is manually extracted and stored in environment files; mismanagement of this secret would expose broad workspace access. - **Feature gaps:** No delete operations (by design), no custom fields, and no views management; some advanced ClickUp setups may therefore require fallback to the ClickUp UI. - **External dependency:** Relies on the hosted `https://mcp.clickup.com/mcp` endpoint and ClickUp’s API rate limits; outages or changes upstream will directly impact reliability. **Recommended scenarios** - Teams already using ClickUp heavily who want AI/agent workflows for task triage, reporting, time tracking, or workspace navigation. - Power users or devs comfortable with CLI tools (Claude Code, jq, env files, mcporter configs) who can safely manage OAuth tokens. - Assistants that need **read/write** access to ClickUp (not just read-only dashboards), but where destructive actions should be constrained. **Use with caution when** - You cannot securely store and manage long-lived tokens. - Non-technical users must self-manage the setup, or your environment lacks an allowlisted client needed for the OAuth bootstrap. - Your workflows heavily depend on custom fields or views, which are not exposed here.