# clickup_create_entity_attachment

A write tool on the Clickup MCP server.

Agent View of the PolicyLayer registry record for `clickup_create_entity_attachment`. HTML page: https://policylayer.com/tools/clickup-mcp/clickup-create-entity-attachment

## Facts

- Tool: `clickup_create_entity_attachment`
- Server: Clickup (`trustxai/clickup-mcp`) — https://policylayer.com/tools/clickup-mcp.md
- Homepage: https://github.com/trustxai/clickup-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "clickup_create_entity_attachment",
    "arguments": {}
  }
}
```

## Why clickup_create_entity_attachment is rated Medium

The verb 'create' and noun 'attachment' together indicate this tool writes/creates data within ClickUp. Creating attachments is reversible (can be deleted), so it is Write rather than Destructive. Medium severity reflects that attachment uploads could be abused to inject malicious content or clutter workspaces, but the blast radius is contained to that specific entity.

From the tool's own definition: "Tool name 'clickup_create_entity_attachment' indicates creation of attachments (a data modification operation). No description provided, limiting evidence but not contradicting the classification."

## Use case

AI agents use clickup_create_entity_attachment to create or update resources in Clickup, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Clickup environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Clickup:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "clickup_create_entity_attachment": {
      "limits": [
        {
          "counter": "clickup_create_entity_attachment_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Clickup (165)

- `clickup_delete_chat_channel` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-chat-channel.md
- `clickup_delete_chat_message` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-chat-message.md
- `clickup_delete_chat_reaction` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-chat-reaction.md
- `clickup_delete_checklist` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-checklist.md
- `clickup_delete_checklist_item` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-checklist-item.md
- `clickup_delete_comment` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-comment.md
- `clickup_delete_dependency` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-dependency.md
- `clickup_delete_folder` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-folder.md
- `clickup_delete_goal` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-goal.md
- `clickup_delete_key_result` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-key-result.md
- `clickup_delete_list` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-list.md
- `clickup_delete_space` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-space.md
- `clickup_delete_space_tag` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-space-tag.md
- `clickup_delete_task` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-task.md
- `clickup_delete_task_link` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-task-link.md
- `clickup_delete_time_entry` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-time-entry.md
- `clickup_delete_user_group` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-user-group.md
- `clickup_delete_view` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-view.md
- `clickup_delete_webhook` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-delete-webhook.md
- `clickup_remove_guest_from_folder` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-remove-guest-from-folder.md
- `clickup_remove_guest_from_list` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-remove-guest-from-list.md
- `clickup_remove_guest_from_task` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-remove-guest-from-task.md
- `clickup_remove_guest_from_workspace` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-remove-guest-from-workspace.md
- `clickup_remove_tag_from_task` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-remove-tag-from-task.md
- `clickup_remove_task_from_list` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-remove-task-from-list.md
- `clickup_remove_user_from_workspace` — Destructive — https://policylayer.com/tools/clickup-mcp/clickup-remove-user-from-workspace.md
- `clickup_start_time_entry` — Execute — https://policylayer.com/tools/clickup-mcp/clickup-start-time-entry.md
- `clickup_get_bulk_tasks_time_in_status` — Read — https://policylayer.com/tools/clickup-mcp/clickup-get-bulk-tasks-time-in-status.md
- `clickup_get_chat_channel` — Read — https://policylayer.com/tools/clickup-mcp/clickup-get-chat-channel.md
- `clickup_get_chat_channel_followers` — Read — https://policylayer.com/tools/clickup-mcp/clickup-get-chat-channel-followers.md
- …and 135 more: https://policylayer.com/tools/clickup-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=clickup-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/clickup-mcp