Clio MCP Server

Clio MCP Server: Connect Claude to Clio Practice Management

Built by Oktopeak: AI transformation & automation for law firms

Digital transformation for legal and healthcare businesses. We build AI integrations, workflow automation, and custom software your firm owns outright, including this connector. → Book a 30-min call

Open-source Model Context Protocol (MCP) connector that lets Claude read live data from Clio (matters, custom fields, notes, contacts, documents, folders, tasks, calendar, and billing) without copying client information into chat windows. Built for law firms that care about attorney-client privilege, ABA Opinion 512 compliance, and keeping AI workflows inside their existing practice management stack.

TL;DR: 36 Clio tools exposed to Claude across stdio and HTTP/SSE transports. Audit-logged for ABA Opinion 512. OAuth tokens encrypted at rest with AES-256-GCM. Local-only by default: you register your own Clio developer app, and no relay server sits in between. A separate one-click "listed" variant for the Clio App Directory uses a minimal login-only broker instead, see Listed / one-click install variant. MIT license, free forever.

Who this is for: Law firm IT, legal operations teams, tech-forward partners, and engineers at legal tech companies. If you can follow a five-step terminal install, you can use this.

[!TIP] Not a developer? You don't need to be.

The README below assumes someone comfortable editing a JSON config file. If that's not you or your team, we deploy this for law firms: scoped credentials, audit log wired in, one custom workflow, training. A simpler one-command installer is also planned for v0.2.

→ See Guided MCP Setup, or book a 30-min call

Jump to: Demo · Setup · Available tools · Security & compliance · Need it deployed for you?

---

Demo

Watch Claude pull live data from Clio in under a minute (matters, contacts, tasks) without copying client information into chat.

---

Setup tips + ABA Opinion 512 compliance updates for firms building with Claude + Clio.

→ Subscribe to Oktopeak Builder Notes. Short emails, easy unsubscribe.

---

Upgrading to 2.2.0

If you installed before September 2026 you are on 2.0.1, and there is one reason to upgrade that is worth stating plainly rather than burying in a changelog.

2.0.1 writes client data to its audit log. Contact search queries, note subjects, matter descriptions and custom field values were all recorded verbatim in ~/.clio-mcp/audit.log. The log is a plain file that nothing rotates. In 2.2.0 audit entries carry ids, counts, dates and page tokens only, enforced by an allowlist rather than a denylist, with a test that fails if any tool ever starts logging content again.

npm install -g @oktopeak/clio-mcp@2.2.0   # or just restart Claude Desktop if you use npx

Your existing ~/.clio-mcp/audit.log still contains whatever the old version put there. It is worth reading before you decide what to do with it.

Also new since 2.0.1: custom fields and notes on matters and contacts, folder tools, matter relationships, a one-call activity summary across open matters, a config-level READ_ONLY mode, and full pagination on reads where a short answer would be a wrong one. See CHANGELOG.md.

Compliance & Security

This section exists because law firms evaluating AI tools have asked the right questions. Here are direct answers.

ABA Formal Opinion 512: AI and competence

ABA Opinion 512 (2023) requires attorneys using AI tools to understand how those tools work, supervise their outputs, and maintain confidentiality of client information. This connector is designed with those obligations in mind:

• Audit log. Every tool call (every time Claude queries Clio on your behalf) is appended to a local log file at ~/.clio-mcp/audit.log. Each entry records the timestamp, which tool was invoked, what arguments were passed, whether it succeeded, and the Clio user ID. The log is stored on your machine, not in any cloud service. It is append-only and never purged by the software, so your firm retains a complete record of AI-initiated data access.

• No data retention by the connector. The connector does not store matter data, client names, or any Clio content. It fetches from the API and passes results to Claude. The only thing persisted locally is your authentication token, and that is encrypted (see below).

• Twelve write tools, all logged, all optional. The connector can create matters, custom fields, notes, tasks, folders, calendar entries, time entries and activities, update matters and tasks, complete tasks, and upload documents. It never deletes anything and never touches contacts or billing records. Every write is recorded in the audit log, and READ_ONLY=true removes all twelve write tools from the server entirely (see Read-only mode), so a firm can start with read access and turn writes on when it has decided to.

Token security: encryption at rest

Your OAuth credentials are never stored in plain text. After you authenticate, the connector encrypts your access token and refresh token using AES-256-GCM, the same standard used by financial institutions, and writes the ciphertext to ~/.clio-mcp/tokens.enc. The encryption key is auto-generated on first run and stored in your OS keychain (macOS Keychain, Windows Credential Manager, or Linux Secret Service), never on the filesystem in plaintext.

If someone obtained the token file without the key, they would not be able to read it.

OAuth 2.0: no passwords stored

Authentication uses Clio's standard OAuth 2.0 flow. You log in through your browser on Clio's own login page. The connector never sees or handles your Clio password. CSRF protection is implemented via a cryptographic state parameter on every auth request.

Local-first architecture

The connector runs entirely on your machine. There is no Clio MCP cloud service, no relay server, no third party in the middle. Your Clio API traffic goes directly from your device to Clio's servers.

This is true for the default setup below, where you register your own Clio developer application. The one-click "listed" install variant (next section) is the one exception, and only for the login step.

Listed / one-click install variant (App Directory)

If you installed this connector via the Clio App Directory's one-click install instead of registering your own Clio developer application, you're using the listed variant. It uses one Clio application owned by Oktopeak, shared across every installing firm, instead of a separate application per firm. That means the application's client_secret cannot be distributed to your machine — it lives only on a small hosted token broker Oktopeak operates.

What that changes, precisely: matter data flows directly between your machine and Clio; only the login handshake passes through our token service. Every tool call — matters, contacts, documents, tasks, calendar, billing, everything — still goes directly from your machine to Clio's API, exactly as in the BYOC setup above. The broker never sees, stores, or logs any of it; it is only involved for the few seconds it takes to complete the OAuth login (and again, briefly, on token refresh). It stores nothing durable — no tokens, no session data survive past that single handshake.

Full data-flow documentation for security reviewers, including a sequence diagram and what the broker persists versus never persists, is in the token broker's repository: docs/DATA_FLOW.md.

Everything else — local AES-256-GCM token encryption, the audit log, and the 26 tools — is identical to the BYOC setup. Note that Clio's OAuth doesn't support requesting a narrower scope per login; the permissions your token carries are whatever the connecting Clio application was granted when it was registered in the Clio Developer Portal. For the listed app, that registration is kept to the minimum permission set the 26 tools need — the same principle you'd apply yourself when registering your own app for the BYOC setup. See Option C below for the resulting Claude Desktop config.

---

Trust Model

Three questions practitioners evaluating an AI tool for sensitive legal work should ask before installing.

Which Claude tier should we use?

The connector secures the transport between Clio and Claude. It does NOT change what Claude itself does with data once data enters a conversation. Claude's data handling depends on the tier you use, not on this connector.

• Anthropic API with zero-data-retention (ZDR): no-training, no-retention terms, enabled at the organization level on the Anthropic API. A small firm can obtain it; it is not reserved for large enterprise contracts. This is the configuration we recommend for any work involving privileged client data.
• Claude Enterprise / Team: explicit no-training guarantees, with ZDR available as an option. One way to get the configuration above, suited to firms that want a managed workspace rather than an API integration. Claude Enterprise is one option, not the only one.
• Claude Pro / Max (consumer): Anthropic does not train on consumer chat data by default and human review for safety is limited. Acceptable for non-privileged exploration. Not a substitute for a zero-data-retention deployment when handling client matter data.

If you are deploying this connector at a firm, pair it with a zero-data-retention configuration (the Anthropic API with ZDR at the organization level, or Claude Enterprise with ZDR). If you are an individual lawyer testing it on personal or non-privileged data, Claude Pro is reasonable for the testing phase but should not become the long-term setup for client work.

One caveat on model choice: the no-retention default is model-dependent. The newest and most capable model may require retention and opt-in review, so pin the model deliberately and re-check the retention terms on every vendor release.

Access vs retention: the distinction most evaluations miss

A common assumption is that logging equals compliance: if there is a record of what was accessed, the firm is covered. That conflates two separate things, and the gap between them is where privileged content gets exposed.

• Retention is what happens to the data after the request: whether it persists in training sets, vendor logs, or any system once the answer is returned.
• Access is whether the model saw the matter content at all, even ephemerally, in-flight, only to produce its answer.

For privileged matter content, access is the exposure. The moment privileged content enters a conversation, the model has processed it, whether or not anything is retained afterward. No-retention and no-training guarantees constrain what happens to the data later; they do not undo the fact that it was seen, and the firm's audit log records only that access happened, not that it was permissible.

This is why tier choice is not optional for privileged work. Zero-data-retention is the only clean answer for anything touching privileged matter content, whether you obtain it on the Anthropic API at the organization level or through Claude Enterprise: it is the configuration where the content is processed under contractual no-training, no-retention terms rather than consumer ones. If the matter is privileged and you are not on a ZDR configuration (or a local model, see below), assume the content has been exposed under terms your firm has not vetted.

The connector's own no-retention posture (it stores nothing but your encrypted token) covers the transport layer only. It says nothing about what the model tier does with content once that content enters the conversation. That second question is the one this section answers, and it is the one your firm has to answer before privileged data ever reaches Claude.

Supply-chain trust (npm package)

The connector ships as @oktopeak/clio-mcp on npm. Like every npm package, the published version can be updated at any time by the maintainer. Standard hygiene applies:

• Pin versions in production. Use an exact version such as @oktopeak/clio-mcp@2.2.0 (the current release in package.json) rather than a range like ^2.0.0. Audit before upgrading.
• Review the diff. Every release is a tagged commit on GitHub. Verify changes before pulling a new version into a firm-wide deployment.
• Build from source. If your firm requires it, clone the repo, audit the code, run from your own build artifact. We do not gate any feature behind the npm distribution.
• Maintainers. Published by Oktopeak, a public team with public commits and a public npm publisher account. Not anonymous. We respond to security reports at office@oktopeak.com.

What is encrypted, what is not

To pre-empt a common misread:

• OAuth tokens (your Clio access + refresh token) are encrypted with AES-256-GCM at rest in ~/.clio-mcp/tokens.enc. They cannot be read without the encryption key.
• The encryption key itself is auto-generated on first run and stored in the OS keychain (macOS Keychain, Windows Credential Manager, or Linux Secret Service). It never touches the filesystem in plaintext. For CI/headless installs without a keychain, you can override this by setting ENCRYPTION_KEY as a 64-character hex string in your environment.
• Audit log entries at ~/.clio-mcp/audit.log are not encrypted. They contain metadata (timestamps, tool names, parameters with secrets redacted), not Clio content.

---

Running with a local model (no third-party processor)

After the SDNY ruling in United States v. Heppner (Feb 2026) that consumer Claude is not protected by attorney-client privilege, some firms want a deployment with no third-party AI processor at all: model inference running entirely on the firm's own hardware.

This connector supports that out of the box. MCP is a protocol, not a Claude-specific feature. The same connector that talks to Claude Desktop also talks to:

• LM Studio running Llama 4 70B / DeepSeek V4 / Mistral Large locally (recommended primary path)
• Continue.dev + Ollama + a bridge (mcphost or ollama-mcp-bridge)
• Any other MCP-compatible client

Full deployment guide and example configs in docs/privilege-stack/. Strategic context (when this beats Claude Enterprise, hardware spec, validation steps) in our Privilege Stack blog post.

---

What you can do

Once connected, you can ask Claude things like:

Matters

• "Show me all open matters for Acme Corp"
• "What's the status of matter 2024-0042?"
• "List my pending matters from the last quarter"
• "Open a new matter for Acme Corp: litigation, responsible attorney John Smith"

Contacts

• "Find the contact details for Jane Smith"
• "What's the email address and phone number for client ID 8821?"
• "Show me all contacts matching 'Acme', and fetch the next page if there are more"

Documents

• "List all documents on matter 4821"
• "Get the download link for document 9934"
• "Find all documents named 'retainer' across all matters"

Tasks

• "What tasks are due this week on matter 4821?"
• "Show me all high-priority incomplete tasks"
• "Create a task on matter 4821 to file the motion by Friday, high priority"

Notes

• "Add a note to matter 4821: initial consultation completed, client confirmed retainer"
• "Create a note on this matter summarising today's call with the client"

Calendar

• "What do I have scheduled between April 28 and May 2?"
• "List all calendar entries for next week"
• "Show me my available calendars"
• "Add a court hearing for matter 4821 on June 10 at 9am"

Time entries

• "How many hours have been logged on matter 4821 this month?"
• "Show me all time entries between April 1 and April 30"

Billing

• "What's the outstanding balance on matter 4821?"
• "When was the last invoice issued for this matter?"

Users

• "List all attorneys in the firm"
• "What's the user ID for Jane Smith?"
• "Show me all staff members"

The connector retrieves live data from Clio on every request. Nothing is cached or stored by the AI.

---

Requirements

Before you begin, make sure you have:

• Node.js 18 or later: nodejs.org/en/download
• Claude Desktop: claude.ai/download
• A Clio account with permission to create developer applications (ask your Clio administrator if you are unsure)

---

Setup

5 steps. 10-15 minutes the first time. You'll register a Clio Developer App, add one JSON block to your Claude Desktop config, and run an OAuth login. The encryption key is generated automatically; no manual key handling.

Before you run any of this in production, read the Compliance & Security and Trust Model sections above. If you are deploying for a firm, pair the connector with a zero-data-retention configuration (the Anthropic API with ZDR at the organization level, or Claude Enterprise); see "Which Claude tier should we use?" above.

Step 1: Clone and build

Open a terminal and run:

git clone https://github.com/oktopeak/clio-mcp.git
cd clio-mcp
npm install
npm run build

Note the full path to the folder you just cloned; you will need it in Step 3.

# On Mac/Linux, print the full path:
pwd

# Example output: /Users/yourname/clio-mcp

Step 2: Create a Clio API application

1. Go to developers.clio.com and sign in with your Clio login
2. Click Developer Apps → Add
3. Give it a name (e.g., Claude Connector)
4. Set the redirect URI to exactly: http://127.0.0.1:5678/callback
5. Save the application
6. Copy the Client ID and Client Secret; you will need them in the next step

Step 3: Configure Claude Desktop

As of v2.0.0 the connector supports two transports: stdio (the connector runs as a child process of Claude Desktop, single-user) and HTTP/SSE (the connector runs as a standalone server, supports multiple sessions and remote access). Pick one.

Open your Claude Desktop configuration file:

• Mac: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Option A: stdio (simplest, single-user)

Add the following block inside the "mcpServers" section, replacing the placeholder values with your own:

{
  "mcpServers": {
    "clio": {
      "command": "node",
      "args": ["/FULL/PATH/TO/clio-mcp/build/index.js"],
      "env": {
        "TRANSPORT": "stdio",
        "CLIO_CLIENT_ID": "your_client_id",
        "CLIO_CLIENT_SECRET": "your_client_secret"
      }
    }
  }
}

Replace /FULL/PATH/TO/clio-mcp with the path you noted in Step 1 (e.g., /Users/yourname/clio-mcp). TRANSPORT=stdio is required because the connector defaults to HTTP mode at v2.0.0.

Option B: HTTP/SSE (standalone server, multi-session)

Start the connector as a long-running server. In HTTP mode an API key is required. The server refuses to start unless MCP_API_KEY is set to a secret of at least 24 characters. Generate one first, then start the server. In a terminal, from the clio-mcp directory:

# Generate a key once and keep it somewhere safe
openssl rand -hex 32

TRANSPORT=http MCP_BASE_URL=http://127.0.0.1:3000 MCP_API_KEY=<the key you generated> \
CLIO_CLIENT_ID=your_client_id CLIO_CLIENT_SECRET=your_client_secret \
node build/index.js

Then point Claude Desktop at it via the mcp-remote bridge, passing the same key as a bearer token. (mcp-remote recommends the ${AUTH_HEADER} form because Claude Desktop does not handle spaces inside args reliably.)

{
  "mcpServers": {
    "clio": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "http://127.0.0.1:3000/mcp", "--header", "Authorization:${AUTH_HEADER}"],
      "env": { "AUTH_HEADER": "Bearer <the key you generated>" }
    }
  }
}

Every route that reaches the MCP server returns 401 Unauthorized without the key: all methods on /mcp (POST, the GET/SSE stream, DELETE) and any unknown path. Only /health and the OAuth redirect target /oauth/callback are reachable without it, because Clio's browser redirect cannot carry a bearer token.

Local development only: if you need to run the HTTP server without a key on your own machine, set MCP_ALLOW_UNAUTHENTICATED=true. The server starts with a loud warning and every route is open. Never use this on a public host or anywhere other people can reach the port; anyone who can reach the endpoint can drive the connector with your Clio access.

Option C — One-click via Clio App Directory

If you installed via the Clio App Directory, there's no developer application to register and no CLIO_CLIENT_SECRET to handle — the installer configures this for you. The resulting config uses TOKEN_BROKER_URL in place of CLIO_CLIENT_ID/CLIO_CLIENT_SECRET:

{
  "mcpServers": {
    "clio": {
      "command": "node",
      "args": ["/FULL/PATH/TO/clio-mcp/build/index.js"],
      "env": {
        "TRANSPORT": "stdio",
        "TOKEN_BROKER_URL": "https://broker.oktopeak.com"
      }
    }
  }
}

See Listed / one-click install variant above for what this changes about the data flow.

---

If the file already has other MCP servers configured, add a comma after the last entry and then add the "clio" block.

Using Clio EU, Australia, or Canada? Set CLIO_REGION to eu, au, or ca (the default is us). Clio assigns the region when the account is created, and the value must match the Clio server your firm logs in to: app.clio.com (us), eu.app.clio.com (eu), au.app.clio.com (au), or ca.app.clio.com (ca). Check the hostname in your browser after logging in to Clio, or contact Clio support if you are unsure. See Clio regions below for the full table.

Step 4: Restart Claude Desktop

Quit Claude Desktop completely and reopen it.

[!TIP] On Windows? The same Windows-specific gotchas that hit our MyCase MCP install also hit Clio MCP: Could not attach to MCP server (direct npx invocation), UNABLE_TO_VERIFY_LEAF_SIGNATURE (corporate antivirus SSL inspection), and OAuth redirect port mismatches. The fixes (cmd /c npx wrapper, NODE_OPTIONS=--use-system-ca, port matching) are documented in our companion install guide.

→ MyCase MCP on Windows: The Install Guide We Wish Existed, written for MyCase MCP but the Windows fixes apply identically to Clio MCP.

Step 5: Authenticate with Clio

In a new Claude conversation, type:

authenticate with Clio

Claude will open your browser to Clio's login page. Log in normally. When you see "Authentication successful", return to Claude. You are connected.

To confirm everything is working, type:

check my Clio auth status

You should see your Clio user ID and token expiry time.

---

[!TIP] Not the person who edits config files?

If the five steps above look like too much, we can deploy it in your firm for you: scoped OAuth credentials, audit log wired into your stack, one custom workflow designed with your team, and training. Most law firms find this is the faster path.

→ See Guided MCP Setup, or book a 30-min scoping call

---

Available tools

Claude selects and calls these tools automatically based on your questions. You do not need to invoke them by name.

Auth (3 tools)

Matters (4 tools)

Custom fields (2 tools)

Matter stages (1 tool)

Contacts (2 tools)

Relationships (1 tool)

Documents (3 tools)

Folders (3 tools)

Tasks (4 tools)

Calendar (3 tools)

Time entries (3 tools)

Billing (1 tool)

Notes (2 tools)

Reporting (1 tool)

Users (2 tools)

Audit log (1 tool)

---

Resources

The connector also exposes two MCP resources: read-only content that compatible clients (including Claude Desktop) can surface automatically at the start of a session.

---

Configuration reference

All settings are passed as environment variables (in your Claude Desktop config for stdio mode, or in the server's environment for HTTP mode). Only CLIO_CLIENT_ID and CLIO_CLIENT_SECRET are required in all modes; MCP_BASE_URL and MCP_API_KEY are additionally required in HTTP mode.

Read-only mode

Set READ_ONLY=true and the connector never registers its twelve write tools (create_matter, update_matter, create_custom_field, create_note, create_task, update_task, complete_task, create_calendar_entry, log_time_entry, create_activity, upload_document, create_folder). They do not appear in Claude's tool list and a call to any of them is rejected by the server, so this is a server-side guarantee rather than a client-side prompt. The read tools, the auth tools and the audit export keep working. Without it, the only thing standing between Claude and a write is the approval prompt your MCP client shows, which belongs to the client, not to this connector.

For Claude Desktop, add it next to the other variables:

"env": {
  "CLIO_CLIENT_ID": "...",
  "CLIO_CLIENT_SECRET": "...",
  "TRANSPORT": "stdio",
  "READ_ONLY": "true"
}

Every tool also carries MCP annotations (readOnlyHint, destructiveHint, idempotentHint) so clients that honour them can show which calls change data before you approve them.

Clio regions

Clio hosts each firm's data in one of four regions. The region is chosen when the Clio account is created and the connector cannot change it; set CLIO_REGION to match the server your firm logs in to (the hostname in the browser address bar after login). Any value outside this list stops the connector at startup with an error naming the valid values. There is no silent fallback to the US endpoint.

---

Audit log reference

Every tool call is recorded at ~/.clio-mcp/audit.log in JSONL format (one JSON object per line). Example entry:

{"timestamp":"2026-04-23T14:05:00.123Z","session_id":"3f2e9b1c-...","machine_ip":"192.168.1.42","tool":"get_matter","args":{"matter_id":4821},"outcome":"success","clio_user_id":"10023","matter_id":4821}

Each entry contains:

Documentation truncated — see the full README on GitHub.