Brainstead connects each client brain to ClickUp with the owner's own sign-in. The connection starts read-only, enforced at our tool proxy rather than by instructions to the model, so the agent can read tasks and docs but can't change them.
The owner switches write access on per tool, and every change and every call is logged. The agent never sees the ClickUp token: it holds only a 15-minute pass to the proxy, which adds the real token on the way out. It runs on Claude by default, or another frontier model your client chooses.
Design-partner stage · priced per client brain, not announced
How to
In the client's brain, choose Connections and pick ClickUp.
Approve access in ClickUp's sign-in window. The token is stored encrypted under the brain's own key and is never shown again.
New connections are read-only. Ask the agent to summarise this week's tickets: @brain-harbour summarise this week's ClickUp tickets.
Turn on Write access for ClickUp when the agent should create tasks. The switch is logged with your name and the time.
Turn write access off again when the job is done. The next write call is refused at the proxy, and the refusal is logged.
Shown on a real brain
On a real client brain, a request to create a ClickUp task was refused while the connection was read-only, allowed after the owner switched write access on, and refused again after it was switched off. Each step appears in the brain's audit log.
Why read-only
No AI model is immune to prompt injection: a ticket or a document can contain text that tries to steer the agent. Brainstead doesn't rely on the model refusing. The tool proxy refuses write calls while the connection is read-only, whatever the model asks for.
Reading is usually all an account team needs: summarising this week's tickets, finding the brief behind a task, or checking what the client approved last month. Write access is there for the jobs that need it, switched on deliberately and switched off again.
Audit log
Every ClickUp call the agent makes, allowed or refused, with the tool name and the time. Every change to the connection, including who switched write access on or off. The removal of the connection, and the deletion of the brain if it comes to that.
What it adds
Questions
Only after the owner switches write access on. Until then, create calls are refused at the proxy.
Not while the connection is read-only, which is the default. With write access on, every call it makes is logged.
Every tool call, every refusal, every access change and every deletion, with the brain, the tool and the time.
Switch the connection back to read-only, remove it from the brain, or revoke the app from your ClickUp account. Deleting the brain removes its connections too.
Brainstead is priced per client brain, not per seat. Pricing isn't announced yet.
It isn't a ClickUp replacement or an automation builder. It drafts and reads, and writes only when the owner allows it.
Related
Each client brain also works with Slack, Brand voice, Client isolation and ChatGPT projects vs Brainstead. See what runs today and what's in development, the security page for questionnaires, or start from the Brainstead home page.