HubSpot MCP Server
HubSpot CRM data management for AI agents with full object access.
Data last scanned today · Reviewed today
Overview
This MCP server provides a standardized interface for interacting with the HubSpot API. It enables AI assistants to perform operations across core CRM objects including companies, contacts, and deals, while supporting advanced features like association management and property validation.
Our verdict
This server carries a high-risk security score of 47/100. The primary concern is that it lacks a read-only mode, meaning every installation provides full write access to your CRM data without built-in restrictions. Additionally, the project relies on personal access tokens as it currently lacks OAuth support. Given these factors, this tool should be used with caution, ideally in sandboxed environments, and is not recommended for production CRM workflows where strict permission boundaries are required.
- Supports standard CRM objects like companies, contacts, and deals
- Includes advanced association management via CRM Associations v4
- Utilizes Zod for type-safe parameter validation
- Maintained by an official vendor organization
- No read-only mode allows default full write access
- Lacks OAuth support for secure authentication
- Last commit occurred over eight months ago
- Small contributor pool of only two people
Setup
{
"mcpServers": {
"hubspot-mcp": {
"args": [
"-y",
"@shinzolabs/hubspot-mcp"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| crm_list_objects | List CRM objects with optional filtering and pagination | low |
| crm_get_object | Get a single CRM object by ID | low |
| crm_create_object | Create a new CRM object | medium |
| crm_update_object | Update an existing CRM object | medium |
| crm_archive_object | Archive (delete) a CRM object | high |
| crm_search_objects | Search CRM objects using advanced filters | low |
| crm_batch_create_objects | Create multiple objects in a single request | medium |
| crm_batch_read_objects | Read multipl objects in a single request | low |
| crm_batch_update_objects | Update multiple objects in a single request | medium |
| crm_batch_archive_objects | Archive (delete) multiple objects in a single request | high |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What authentication method does this server support?
This server requires a HubSpot Access Token for authentication. OAuth support is currently planned as a future enhancement.
›How do I configure the server locally using npx?
You can add it to your MCP client config.json by specifying 'npx' as the command, '@shinzolabs/hubspot-mcp' as the argument, and providing your access token in the HUBSPOT_ACCESS_TOKEN environment variable.
›What is the recommended method for setting up a remote server?
The recommended method is using the Smithery CLI with the command 'npx -y @smithery/cli install @shinzo-labs/hubspot-mcp', which will prompt you for your HubSpot Access Token.
›Can I configure the port used by the server?
Yes, you can specify a custom port for the Streamable HTTP transport method by setting the PORT configuration variable; it defaults to 3000.
›Is telemetry enabled by default?
Yes, telemetry is enabled by default. You can control this behavior using the TELEMETRY_ENABLED configuration variable.
Badge
Maintain this server? Add the live badge to your README.