ClickUp

When a pull request links to a ClickUp task, MergeHarbor reads the task and checks the change against its acceptance criteria, like it does for Jira, Linear and Asana issues.

What it does in reviews

• Finds the tasks a pull request refers to. ClickUp task links (app.clickup.com/t/<id> and app.clickup.com/t/<workspace>/<custom id>) in the pull request title, description and commit messages, and CU-<id> in the branch name, title or commits (ClickUp’s own convention). Only linked tasks are read.
• Reads the task. Name, description, status, custom fields and checklists. Acceptance criteria come from an “Acceptance criteria” or “Definition of done” section in the description, from custom fields and checklists with those names.
• Checks the change against it. The review’s requirements check reports each criterion as met, not met or unclear, with evidence from the diff. Text that looks like a secret is redacted before it reaches the model. No extra model call is made.
• Optionally comments on the task. With Comment on linked issues on, MergeHarbor keeps one comment on each linked task up to date after every review: findings, confidence and requirements met, with a link to the review.

What is read and what is never read

• Read: the linked tasks, your user name and the workspaces you belong to.
• Never read: tasks nobody linked, lists, folders, spaces, docs, time tracking, attachments and other people’s profiles. MergeHarbor never lists or searches your workspace. It writes only its own comment, and only with write-back on.

Task text is cached for a short time (10 minutes by default), deleted within 24 hours, and never written to logs. Linked tasks on a pull request keep only their link, status and the requirements check.

Connect

1. In the console, open Integrations and choose Connect on ClickUp (under Issue tracking). You need the settings.manage permission.
2. Sign in to ClickUp, choose the workspaces MergeHarbor may read, and allow access.
3. Choose Test connection.

With a personal API token instead. In ClickUp, open Settings → Apps and generate a token (it starts with pk_). On the ClickUp card, choose Use a personal API token and paste it. The token acts as you, so MergeHarbor sees the tasks you can see.

ClickUp has no read-only permission: both the sign-in and the token carry the connecting person’s permissions. MergeHarbor only reads tasks, and writes only its own comment when write-back is on. Connect with a member who can see the tasks reviews need.

Per-repository settings

In Settings, you can limit the integration to some repositories, and turn on Comment on linked issues for write-back.

Limits

• Up to 3 linked tasks are used per pull request by default.
• Task text counts toward the review’s overall context limit for tickets.

Disconnect

Open the integration in Integrations and choose Disconnect. MergeHarbor deletes its tokens and cached tasks. Comments it posted stay on the tasks. Then remove MergeHarbor in ClickUp under Settings → Apps, or regenerate your personal API token.

Self-hosted installations

Create an app in ClickUp (step by step in docs/OAUTH_APPS.md, “ClickUp connections”): add the redirect URL {PUBLIC_URL}/integrations/connect/clickup/callback, then set CLICKUP_OAUTH_CLIENT_ID and CLICKUP_OAUTH_CLIENT_SECRET. Without the app, ClickUp connects with a personal API token only.