@taazkareem/clickup-mcp-server 0.11.1 → 0.11.2

package/build/license.js

@@ -9,17 +9,68 @@
  */
 import axios from 'axios';
 import { Logger } from './logger.js';
+import { createHash } from 'crypto';
 const logger = new Logger('License');
-// Your Polar.sh organization ID (configurable for sandbox testing)
-// Production: cd9f6f7c-5b51-4e5e-872b-c92dd9377bcd
-// Sandbox: 574925db-40b9-49dd-a02e-ceb1124367d3
-const POLAR_ORGANIZATION_ID = process.env.POLAR_ORGANIZATION_ID || 'cd9f6f7c-5b51-4e5e-872b-c92dd9377bcd';
+// Obfuscated organization validation
+// These constants work together to prevent tampering
+const ORG_PART_1 = 'cd9f6f7c';
+const ORG_PART_2 = '5b51';
+const ORG_PART_3 = '4e5e';
+const ORG_PART_4 = '872b';
+const ORG_PART_5 = 'c92dd9377bcd';
+// Reconstruct the org ID
+const POLAR_ORGANIZATION_ID = `${ORG_PART_1}-${ORG_PART_2}-${ORG_PART_3}-${ORG_PART_4}-${ORG_PART_5}`;
+// Checksum to detect tampering (SHA256 of the org ID)
+const EXPECTED_CHECKSUM = 'fb75c43b43948f2f4727def0b8a0eb66322706299b5807ea9faf55b4ff12950e';
+// Validate integrity at module load
+function validateIntegrity() {
+    const actualChecksum = createHash('sha256').update(POLAR_ORGANIZATION_ID).digest('hex');
+    return actualChecksum === EXPECTED_CHECKSUM;
+}
+// Sandbox org ID for testing (split similarly)
+const SANDBOX_PART_1 = '574925db';
+const SANDBOX_PART_2 = '40b9';
+const SANDBOX_PART_3 = '49dd';
+const SANDBOX_PART_4 = 'a02e';
+const SANDBOX_PART_5 = 'ceb1124367d3';
+const SANDBOX_ORG_ID = `${SANDBOX_PART_1}-${SANDBOX_PART_2}-${SANDBOX_PART_3}-${SANDBOX_PART_4}-${SANDBOX_PART_5}`;
+/**
+ * Detect if we're running from source (development) or installed npm package (production).
+ * Sandbox mode is ONLY allowed when running from source.
+ *
+ * Detection method: Check if our module path contains 'node_modules'.
+ * - Running from source: /Volumes/Code/Projects/MCP/clickup-mcp-server/build/license.js
+ * - Running from npm:    /path/to/project/node_modules/@taazkareem/clickup-mcp-server/build/license.js
+ */
+function isRunningFromSource() {
+    try {
+        // import.meta.url gives us the current module's file URL
+        const modulePath = new URL(import.meta.url).pathname;
+        // If path contains node_modules, we're installed as a package
+        return !modulePath.includes('node_modules');
+    }
+    catch {
+        // If we can't determine, assume production (safer)
+        return false;
+    }
+}
+// Allow sandbox override ONLY when running from source (development)
+// When installed from npm, this will ALWAYS be false, even if env var is set
+const IS_DEV_MODE = isRunningFromSource();
+const USE_SANDBOX = IS_DEV_MODE && process.env.POLAR_USE_SANDBOX === 'true';
+const ACTIVE_ORG_ID = USE_SANDBOX ? SANDBOX_ORG_ID : POLAR_ORGANIZATION_ID;
 // Auto-detect sandbox vs production based on org ID
-const SANDBOX_ORG_ID = '574925db-40b9-49dd-a02e-ceb1124367d3';
-const isSandbox = POLAR_ORGANIZATION_ID === SANDBOX_ORG_ID;
+const isSandbox = ACTIVE_ORG_ID === SANDBOX_ORG_ID;
+// Log mode on startup (helpful for debugging)
+if (IS_DEV_MODE) {
+    console.log(`[License] Running from source (dev mode)${USE_SANDBOX ? ' - SANDBOX ENABLED' : ''}`);
+}
+else {
+    console.log('[License] Running from npm package (production mode)');
+}
 // Polar.sh API endpoint for license validation (public, no auth required)
 const POLAR_API_BASE = isSandbox ? 'https://sandbox-api.polar.sh/v1' : 'https://api.polar.sh/v1';
-const POLAR_VALIDATE_URL = process.env.POLAR_API_URL || `${POLAR_API_BASE}/customer-portal/license-keys/validate`;
+const POLAR_VALIDATE_URL = `${POLAR_API_BASE}/customer-portal/license-keys/validate`;
 // Purchase link for error messages
 const PURCHASE_URL = 'https://buy.polar.sh/polar_cl_3xQojQLgzQXKCLzsxc49YfL6z8hzSBBqh9ivy1qZdwW';
 // Global license status - validated once at startup
@@ -38,6 +89,11 @@ export function getLicenseStatus() {
  * Check if the license is valid
  */
 export function isLicenseValid() {
+    // Check integrity on every validation call
+    if (!validateIntegrity() && !USE_SANDBOX) {
+        logger.error('Code integrity check failed - possible tampering detected');
+        return false;
+    }
     return licenseStatus.isValid;
 }
 /**
@@ -74,6 +130,14 @@ Then restart your MCP client.
  * Validates a license key with Polar.sh
  */
 async function validateLicenseKey(licenseKey) {
+    // Check integrity first
+    if (!validateIntegrity() && !USE_SANDBOX) {
+        return {
+            isValid: false,
+            status: 'tampered',
+            errorMessage: 'Code integrity check failed. Please reinstall from official npm package.'
+        };
+    }
     if (!licenseKey || licenseKey.trim() === '') {
         return {
             isValid: false,
@@ -83,12 +147,12 @@ async function validateLicenseKey(licenseKey) {
     }
     try {
         logger.debug(`Validating license key with Polar.sh...`);
-        logger.debug(`PI URL: ${POLAR_VALIDATE_URL}`);
-        logger.debug(`Org ID: ${POLAR_ORGANIZATION_ID}`);
+        logger.debug(`API URL: ${POLAR_VALIDATE_URL}`);
+        logger.debug(`Org ID: ${ACTIVE_ORG_ID.substring(0, 8)}...`);
         logger.debug(`Key: ${licenseKey.substring(0, 10)}...`);
         const response = await axios.post(POLAR_VALIDATE_URL, {
             key: licenseKey.trim(),
-            organization_id: POLAR_ORGANIZATION_ID
+            organization_id: ACTIVE_ORG_ID
         }, {
             headers: {
                 'Content-Type': 'application/json'
@@ -148,12 +212,13 @@ async function validateLicenseKey(licenseKey) {
                 };
             }
         }
-        // Network or other errors - fail open with warning to avoid blocking due to temporary issues
-        logger.warn('Could not validate license key due to network error. Allowing access.');
+        // SECURITY CHANGE: Fail CLOSED instead of open
+        // If we can't validate, deny access (prevents network blocking bypass)
+        logger.error('Could not validate license key due to network error. DENYING access for security.');
         return {
-            isValid: true,
-            status: 'granted',
-            errorMessage: 'License validation skipped due to network error (allowing access)'
+            isValid: false,
+            status: 'error',
+            errorMessage: 'License validation failed - please check your network connection and try again'
         };
     }
 }

package/build/server.js

@@ -46,7 +46,7 @@ const isToolEnabled = (toolName) => {
 };
 export const server = new Server({
     name: "clickup-mcp-server",
-    version: "0.11.1",
+    version: "0.11.2",
 }, {
     capabilities: {
         tools: {},

package/build/services/clickup/task/task-comments.js

@@ -82,8 +82,8 @@ export class TaskServiceComments {
      * @param assignee Optional user ID to assign the comment to
      * @returns The created comment
      */
-    async createTaskComment(taskId, commentText, notifyAll = false, assignee) {
-        this.core.logOperation('createTaskComment', { taskId, commentText, notifyAll, assignee });
+    async createTaskComment(taskId, commentText, notifyAll = false, assignee, formattedComment) {
+        this.core.logOperation('createTaskComment', { taskId, commentText, notifyAll, assignee, hasFormattedComment: !!formattedComment });
         try {
             const payload = {
                 comment_text: commentText,
@@ -92,6 +92,9 @@ export class TaskServiceComments {
             if (assignee) {
                 payload.assignee = assignee;
             }
+            if (formattedComment) {
+                payload.comment = formattedComment;
+            }
             // Make the request directly without using makeRequest for better error handling
             const response = await this.core.client.post(`/task/${taskId}/comment`, payload);
             // Handle different response formats from ClickUp API

package/build/services/clickup/task/task-service.js

@@ -74,8 +74,8 @@ export class TaskService extends TaskServiceCore {
     async getTaskComments(taskId, start, startId, includeReplies = false) {
         return this.comments.getTaskComments(taskId, start, startId, includeReplies);
     }
-    async createTaskComment(taskId, commentText, notifyAll, assignee) {
-        return this.comments.createTaskComment(taskId, commentText, notifyAll, assignee);
+    async createTaskComment(taskId, commentText, notifyAll, assignee, formattedComment) {
+        return this.comments.createTaskComment(taskId, commentText, notifyAll, assignee, formattedComment);
     }
     // ===== DELEGATED TAG METHODS =====
     async addTagToTask(taskId, tagName) {

package/build/tools/task/bulk-operations.js

@@ -124,6 +124,7 @@ export const createBulkTasksTool = {
                                         description: "ID of the custom field"
                                     },
                                     value: {
+                                        type: "string",
                                         description: "Value for the custom field. Type depends on the field type."
                                     }
                                 },
@@ -225,6 +226,7 @@ export const updateBulkTasksTool = {
                                         description: "ID of the custom field"
                                     },
                                     value: {
+                                        type: "string",
                                         description: "Value for the custom field. Type depends on the field type."
                                     }
                                 },

package/build/tools/task/handlers.js

@@ -572,17 +572,17 @@ export async function getTaskCommentsHandler(params) {
  * Handler for creating a task comment
  */
 export async function createTaskCommentHandler(params) {
-    // Validate required parameters
-    if (!params.commentText) {
-        throw new Error('Comment text is required');
+    // Validate required parameters - either commentText or formattedComment must be provided
+    if (!params.commentText && !params.formattedComment) {
+        throw new Error('Either comment text or formatted comment is required');
     }
     try {
         // Resolve the task ID
         const taskId = await getTaskId(params.taskId, params.taskName, params.listName);
         // Extract other parameters with defaults
-        const { commentText, notifyAll = false, assignee = null } = params;
+        const { commentText = '', formattedComment, notifyAll = false, assignee = null } = params;
         // Create the comment
-        return await taskService.createTaskComment(taskId, commentText, notifyAll, assignee);
+        return await taskService.createTaskComment(taskId, commentText, notifyAll, assignee, formattedComment);
     }
     catch (error) {
         // If this is a task lookup error, provide more helpful message

package/build/tools/task/single-operations.js

@@ -109,6 +109,7 @@ export const createTaskTool = {
                             description: "ID of the custom field"
                         },
                         value: {
+                            type: "string",
                             description: "Value for the custom field. Type depends on the field type."
                         }
                     },
@@ -203,6 +204,7 @@ export const updateTaskTool = {
                             description: "ID of the custom field"
                         },
                         value: {
+                            type: "string",
                             description: "Value for the custom field. Type depends on the field type."
                         }
                     },
@@ -420,7 +422,7 @@ export const getTaskCommentsTool = {
  */
 export const createTaskCommentTool = {
     name: "create_task_comment",
-    description: `Creates task comment. Use taskId (preferred) or taskName + listName. Required: commentText. Optional: notifyAll to notify assignees, assignee to assign comment.`,
+    description: `Creates task comment with optional formatting. Use taskId (preferred) or taskName + listName. Required: commentText OR formattedComment. Optional: notifyAll to notify assignees, assignee to assign comment.`,
     inputSchema: {
         type: "object",
         properties: {
@@ -438,7 +440,162 @@ export const createTaskCommentTool = {
             },
             commentText: {
                 type: "string",
-                description: "REQUIRED: Text content of the comment to create."
+                description: "Plain text content of the comment. Required if formattedComment is not provided."
+            },
+            formattedComment: {
+                type: "array",
+                description: "Formatted comment with rich text support. Array of comment blocks supporting text styling, lists, links, mentions, etc. Takes precedence over commentText when provided.",
+                items: {
+                    type: "object",
+                    oneOf: [
+                        {
+                            description: "Text block with optional formatting and links",
+                            properties: {
+                                text: {
+                                    type: "string",
+                                    description: "Text content"
+                                },
+                                attributes: {
+                                    type: "object",
+                                    properties: {
+                                        bold: { type: "boolean" },
+                                        italic: { type: "boolean" },
+                                        underline: { type: "boolean" },
+                                        strikethrough: { type: "boolean" },
+                                        code: { type: "boolean" },
+                                        color: { type: "string" },
+                                        background_color: { type: "string" },
+                                        link: { type: "string", description: "URL for hyperlinks" }
+                                    },
+                                    description: "Text formatting attributes. Use 'link' for hyperlinks."
+                                }
+                            },
+                            required: ["text"]
+                        },
+                        {
+                            description: "User mention (@mention)",
+                            properties: {
+                                type: { type: "string", enum: ["tag"] },
+                                user: {
+                                    type: "object",
+                                    properties: {
+                                        id: { type: "number", description: "ClickUp user ID" }
+                                    },
+                                    required: ["id"]
+                                }
+                            },
+                            required: ["type", "user"]
+                        },
+                        {
+                            description: "Emoji",
+                            properties: {
+                                type: { type: "string", enum: ["emoji"] },
+                                unicode: { type: "string", description: "Unicode hex value" }
+                            },
+                            required: ["type", "unicode"]
+                        },
+                        {
+                            description: "Code block",
+                            properties: {
+                                type: { type: "string", enum: ["code_block"] },
+                                text: { type: "string", description: "Code content" },
+                                language: { type: "string", description: "Programming language (optional)" }
+                            },
+                            required: ["type", "text"]
+                        },
+                        {
+                            description: "Bulleted list",
+                            properties: {
+                                type: { type: "string", enum: ["bulleted_list"] },
+                                items: {
+                                    type: "array",
+                                    items: {
+                                        type: "object",
+                                        properties: {
+                                            text: { type: "string" },
+                                            attributes: {
+                                                type: "object",
+                                                properties: {
+                                                    bold: { type: "boolean" },
+                                                    italic: { type: "boolean" },
+                                                    underline: { type: "boolean" },
+                                                    strikethrough: { type: "boolean" },
+                                                    code: { type: "boolean" },
+                                                    color: { type: "string" },
+                                                    background_color: { type: "string" },
+                                                    link: { type: "string" }
+                                                }
+                                            }
+                                        },
+                                        required: ["text"]
+                                    }
+                                }
+                            },
+                            required: ["type", "items"]
+                        },
+                        {
+                            description: "Numbered list",
+                            properties: {
+                                type: { type: "string", enum: ["numbered_list"] },
+                                items: {
+                                    type: "array",
+                                    items: {
+                                        type: "object",
+                                        properties: {
+                                            text: { type: "string" },
+                                            attributes: {
+                                                type: "object",
+                                                properties: {
+                                                    bold: { type: "boolean" },
+                                                    italic: { type: "boolean" },
+                                                    underline: { type: "boolean" },
+                                                    strikethrough: { type: "boolean" },
+                                                    code: { type: "boolean" },
+                                                    color: { type: "string" },
+                                                    background_color: { type: "string" },
+                                                    link: { type: "string" }
+                                                }
+                                            }
+                                        },
+                                        required: ["text"]
+                                    }
+                                }
+                            },
+                            required: ["type", "items"]
+                        },
+                        {
+                            description: "Checklist",
+                            properties: {
+                                type: { type: "string", enum: ["checklist"] },
+                                items: {
+                                    type: "array",
+                                    items: {
+                                        type: "object",
+                                        properties: {
+                                            text: { type: "string" },
+                                            checked: { type: "boolean", description: "Whether item is checked" },
+                                            attributes: {
+                                                type: "object",
+                                                properties: {
+                                                    bold: { type: "boolean" },
+                                                    italic: { type: "boolean" },
+                                                    underline: { type: "boolean" },
+                                                    strikethrough: { type: "boolean" },
+                                                    code: { type: "boolean" },
+                                                    color: { type: "string" },
+                                                    background_color: { type: "string" },
+                                                    link: { type: "string" }
+                                                }
+                                            }
+                                        },
+                                        required: ["text"]
+                                    }
+                                }
+                            },
+                            required: ["type", "items"]
+                        }
+                    ]
+                }
             },
             notifyAll: {
                 type: "boolean",
@@ -449,7 +606,7 @@ export const createTaskCommentTool = {
                 description: "Optional user ID to assign the comment to."
             }
         },
-        required: ["commentText"]
+        required: []
     }
 };
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taazkareem/clickup-mcp-server",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "ClickUp MCP Server - Integrate ClickUp tasks with AI through Model Context Protocol",
   "type": "module",
   "main": "build/index.js",