Provider REST API

Project management

Connect Claude to ClickUp

Work ClickUp tasks and comments, and walk the spaces, folders and lists they live in. Toolspoke puts 14 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.

Connection
Provider REST API
Authentication
API token
Actions exposed
14
Cost per call (typical)
1 credit
Adapter
Maintained by Toolspoke

Connected in three steps

  1. 1

    Install ClickUp

    Open the marketplace in your workspace, add ClickUp to the project your agents work in, and it appears on the gateway immediately.

  2. 2

    Connect the credential

    Authenticate with api token. Where to get one, and what it has to be able to reach, is the next section.

  3. 3

    Point your agent at the gateway

    Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.

.mcp.json
{
  "mcpServers": {
    "toolspoke": {
      "type": "http",
      "url": "https://toolspoke.com/mcp"
    }
  }
}

One block covers every tool you have installed. ClickUp shows up in the client as soon as your policy allows it, and so does everything else you install later.

Where the address goes, per client

Claude Code

Run it in your project, then /mcp to sign in

claude mcp add --transport http toolspoke https://toolspoke.com/mcp
Claude and Claude Desktop

Settings, then Connectors, then Add custom connector

https://toolspoke.com/mcp
Cursor

~/.cursor/mcp.json, or .cursor/mcp.json for one project

{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }
Codex

~/.codex/config.toml

[mcp_servers.toolspoke]
url = "https://toolspoke.com/mcp"
VS Code

.vscode/mcp.json, or the MCP: Add Server command

{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }

What ClickUp asks for

API token. You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.

API tokenRequired
ClickUp → your avatar → Settings → Apps → API Token → Generate. Sent as the bare Authorization header value, with no Bearer prefix - that is what ClickUp expects.
pk_12345678_ABCDEFGHIJKLMNOPQRSTUVWXYZ
Default Workspace IDOptional
ClickUp calls a Workspace a `team` in its API. This is the number in your ClickUp URL after clickup.com/. Used whenever an action is called without an explicit team_id; list_workspaces shows what the token can see.
9001234567

What Claude can do in ClickUp

14 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.

Reads
10Reads
Writes
3Writes
Destructive
1Destructive

Reads

10

Fetches data and changes nothing.

  • list_workspaces

    List the Workspaces this token can see, each with its members. ClickUp's API calls a Workspace a `team`, and the id returned here is the team_id every other operation takes. Call it first when you do not know which Workspace to act on, and to find out whether the connection reaches anything at all - an empty list means the token is valid and belongs to nothing. This is also the only place ClickUp exposes Workspace-wide membership; there is no space or folder member endpoint.

  • list_spaces

    List the Spaces in a Workspace. Each Space record carries its own `statuses` array, which is where the statuses available to everything under it come from. Archived Spaces are excluded unless you ask for them.

  • list_folders

    List the Folders in a Space. Each Folder carries the Lists inside it, plus `statuses` and `override_statuses` - an empty statuses array means the Folder inherits from its Space rather than that it has none. Sub-folders come back flat, each tagged with its parent_folder.

  • list_lists

    List the Lists inside one Folder. A ClickUp Space can also hold Lists that sit in no Folder at all, and those never appear here - use list_folderless_lists for them. The list_id returned is what list_tasks and create_task take.

  • list_folderless_lists

    List the Lists that sit directly in a Space with no Folder around them. ClickUp serves these from a different endpoint than the Folder ones, so a walk that only calls list_lists silently misses them - which is how a list an agent can see in the ClickUp UI turns out to be unreachable.

  • list_statuses

    Report the statuses a List actually accepts, so create_task and update_task can be given a status ClickUp will take rather than one that is rejected. ClickUp has no statuses endpoint - statuses are a property of the List, Folder and Space records - so this reads the List itself and returns its status set alongside its name and task count. `override_statuses` false means the set is inherited from the Folder or Space above it.

  • list_members

    List the people with explicit access to a List. ClickUp's own documentation is precise about what this leaves out: it does not include anyone whose access comes from the Workspace, the Folder or the Space above the List, so an empty result does not mean nobody can see it. For Workspace-wide membership, read the members array on list_workspaces. The ids returned here are what create_task takes as assignees.

  • list_tasks

    List the tasks in one List, with every filter ClickUp offers. Three defaults are easy to trip over and are stated here rather than discovered: closed tasks are excluded, subtasks are excluded, and `page` starts at 0. A page holds at most 100 tasks and `last_page` on the response says whether there are more. Tasks whose home List is elsewhere but which also appear in this one are excluded unless include_timl is set. Every date filter is a Unix timestamp in milliseconds.

  • get_task

    Fetch one task in full: description, status, assignees, watchers, dates, priority, tags, custom field values and its List, Folder and Space. IMPORTANT: to address a task by the short custom id your Workspace shows (ABC-123) rather than by its internal id, you must set custom_task_ids to true AND pass team_id - ClickUp documents both together, and sending the custom id without the Workspace id is not a supported call.

  • list_comments

    Read a task's comments, newest first. Paging here is a cursor rather than a page number and needs BOTH parts: `start` is the `date` of the last comment you saw and `start_id` is that same comment's `id`. Sending one without the other does not page - it returns the first page again, which reads like the task has fewer comments than it does.

Writes

3

Creates or updates something on the other side.

  • create_task

    Create a task in a List. Only `name` is required. `status` must be one the List actually has - call list_statuses first - and assignees are numeric user ids from list_members, not names or emails. Dates are Unix timestamps in milliseconds; pass due_date_time or start_date_time as true when the timestamp carries a meaningful time of day rather than just a date. If both description and markdown_content are given, ClickUp uses markdown_content and ignores the other.

  • update_task

    Change fields on an existing task, or archive it. Pass only what you want changed. Assignees and watchers are NOT replaced the way every other field is - ClickUp takes them as an add-and-remove pair on update, so add_assignees and remove_assignees are separate arguments here and leaving both out changes neither. Set archived true to archive the task, which is reversible and is not the same as deleting it.

  • add_comment

    Post a comment on a task. `notify_all` decides whether everyone watching the task is emailed, and it defaults to false here so an agent leaving a note does not mail a team by accident - pass it as true when the comment is meant to reach people. `assignee` turns the comment into an assigned comment for that user.

Destructive

1

Deletes or permanently alters something. Worth granting on purpose.

  • delete_task

    Delete a task. ClickUp moves it to the Workspace trash, but nothing in this API lists or restores from that trash, so from here it is gone - which is why this is classified destructive and out of reach of a read-only or write grant. If the intent is to get a task out of the way rather than to remove it, call update_task with archived true instead. ClickUp answers 204 with no body.

What it will not do

Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.

It cannot call anything else
The 14 actions above are the whole of it. A call to any other name is refused before it reaches ClickUp rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
It reaches no further than your credential
Toolspoke holds no access to ClickUp of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
It never hears from ClickUp
Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in ClickUp. An agent has to ask.
It does not smooth over provider limits
Toolspoke does not retry, queue or back off around ClickUp's own rate limits. A call that ClickUp refuses comes back to the agent as a failed call.

Before you connect it

What can Claude do in ClickUp?

14 named actions: 10 that only read, 3 that write and 1 that delete or permanently alter something. They include list_workspaces, list_spaces and list_folders. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.

What credentials does the ClickUp connector need?

API token. The connector asks for api token, and optionally default workspace id. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.

Does the ClickUp connector work with Cursor and Codex, or only Claude?

Any client that speaks MCP, and every one of them gets the same 14 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.

What does the ClickUp connector not do?

The 14 actions above are the whole of it. A call to any other name is refused before it reaches ClickUp rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. Toolspoke holds no access to ClickUp of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in ClickUp. An agent has to ask. Toolspoke does not retry, queue or back off around ClickUp's own rate limits. A call that ClickUp refuses comes back to the agent as a failed call.

Can I limit which actions an agent can call?

Yes, in two places. The project switches ClickUp's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.

What gets recorded when an agent calls ClickUp?

Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and the credits spent. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.