ClickUp Operations — governed task automation for RailCall

I built ClickUp Operations, a free, signed RailCall module for small
agencies, product teams, support teams, and operations leads that want useful
ClickUp automation without invisible write access.

What it covers

The module exposes 10 practical commands:

• discover Workspaces;
• browse Spaces, Folders, and Lists;
• list and inspect tasks;
• create and update tasks;
• add comments; and
• delete tasks.

The six read commands are declared side-effect free. The four mutations are
declared external and follow RailCall's preview → explicit approval → execute →
signed receipt flow. Comment notifications default to off, and delete always
requires a fresh approval.

Install

railcall market install enis-arik-dev/clickup-operations

Create a ClickUp personal API token, then open RailCall Studio → Integrations
→ ClickUp → Configure and save it as api_key. The handler reads it only with
vault_get("clickup"); the token is not stored in module files, environment
variables, database records, logs, or receipts.

Working example

Run clickup.list_workspaces with:

{}

Expected output shape:

{"workspaces":[{"id":"…","name":"Acme Workspace","color":"…","avatar":null}]}

The live pre-publish test used the real ClickUp API, returned one authorized
Workspace, and produced an executed signed receipt with
external_api_touched: true. No ClickUp data was changed.

Security and verification

• Network sandbox: api.clickup.com only
• Subprocesses: disabled
• Filesystem writes: disabled
• Offline tests: 14 passing
• Bundle: Ed25519 signed and locally verified
• Station load: all 10 commands registered

Inputs are schema-validated, unsupported fields are dropped, and API failures
raise clear errors without leaking credentials.

Known limitations

• Personal API tokens only; OAuth is not included in v0.1.0.
• Task listing returns one ClickUp page per call.
• Attachments, custom fields, time tracking, and bulk operations are not yet

exposed.

• Access is limited to what the configured ClickUp user can already access.
• Delete is irreversible and always requires a fresh approval.

Marketplace listing:
https://railcall.ai/marketplace/enis-arik-dev/clickup-operations

contest:round2 · contest:2026Q3