HubSpot MCP Server: Connect Any AI Tool to Your CRM

The HubSpot MCP server (often called the HubSpot MCP connector) is HubSpot's official Model Context Protocol endpoint at mcp.hubspot.com. It lets any MCP-compatible AI tool, from Claude and Cursor to a custom agent you build yourself, securely read and write your live CRM data over one standard protocol. It is separate from HubSpot's packaged one-click connectors for Claude and ChatGPT, and separate from the HubSpot Agent CLI. It works on every HubSpot plan at no extra cost.

What is the HubSpot MCP server?

MCP, the Model Context Protocol, is the emerging standard for how AI assistants ask external systems for data and permission to act. HubSpot's remote MCP server is the company's official implementation of that standard for CRM access: any compatible AI client can connect to a single URL, mcp.hubspot.com, authenticate over OAuth, and start reading and writing HubSpot data through natural language, without HubSpot having to build a custom integration for every AI tool on the market.

It started as a public beta in September 2025, available across every hub and tier from day one, and reached General Availability on April 13, 2026 with expanded read access and CRM write support. Don't confuse it with the packaged, one-click HubSpot connector for Claude or the connector for ChatGPT - those are HubSpot-built apps for one specific chat tool, and both actually run on this same MCP server underneath. This page is the generic, developer-facing version: the one you'd use to connect Cursor, a custom agent, or any MCP client HubSpot hasn't built a dedicated app for.

HubSpot also runs a second, unrelated MCP server for its own developer tooling (building apps and CMS assets via the CLI) - that one is local, not remote, and is not what this page covers.

What can the HubSpot MCP server read and write?

Access is broader on the read side than most people expect, and it grows with every release. Here is HubSpot's current permission model, condensed:

Nothing can be deleted through the MCP server, on any object. Custom Sensitive Data properties are never accessible, and if your portal has Sensitive Data turned on, activities (calls, emails, meetings, notes, tasks) and all conversation data are blocked entirely - a restriction specific to the MCP server that doesn't apply to HubSpot's standard APIs.

How do you connect an AI tool to the HubSpot MCP server?

Setup is developer-flavored but not hard. The order matters:

1. Create an MCP Auth App. In HubSpot, go to Development, then MCP Auth Apps, then Create MCP auth app. Name it, add a redirect URL your client will use, and HubSpot generates OAuth client credentials.
2. Point your MCP client at mcp.hubspot.com. Configure it with Streamable HTTP transport, the server URL, and your app's client ID and secret. For a first test, HubSpot recommends the open-source MCP Inspector tool, which handles the OAuth and PKCE handshake for you.
3. Complete the OAuth flow. Pick the HubSpot account to connect, review the permissions being requested, and authorize. Every user who wants to connect - not just the admin who created the app - repeats this step with their own login; the app is the shared credential, the permissions are per person.
4. Turn on your client's write-approval setting, if it has one. HubSpot's own permission model does not gate individual writes with a confirmation prompt the way its packaged Claude and ChatGPT connectors do; that has to come from your MCP client. Claude, Cursor, and most serious MCP clients support a "confirm before tool use" mode - turn it on before you grant write scopes.

How do permissions and security work?

The core model matches HubSpot's other AI integrations: every read and write is bound by the connecting user's own HubSpot permissions, not the app's theoretical maximum. Scopes aren't hand-picked when you create the app; they're set automatically by whichever MCP tools exist at install time plus whatever the connecting user chooses to grant. That has a real consequence - as HubSpot adds MCP tools, previously-installed connections may need to reauthorize to pick up the new scopes.

One nuance worth knowing before you build on this: the remote MCP server itself is fully GA. The self-service MCP Auth Apps screen you use to set it up is still labeled Beta on HubSpot's own current marketing page. In practice that has meant a smoother setup experience arriving in stages rather than instability in the data connection itself, but treat the setup flow, not the server, as the part still subject to change.

How is this different from HubSpot's other AI tools?

HubSpot now has four front doors for AI, and mixing them up is the single most common confusion we see. Here's the honest split:

Our honest take: unless you're specifically connecting a tool other than Claude or ChatGPT, or you're building a custom integration, most teams get more value faster from the packaged connectors. Reach for the raw MCP server when the AI tool you actually use isn't one of HubSpot's two packaged options.

What are the limits to know before you connect?

• No write-approval prompt from HubSpot's side. Unlike the packaged Claude and ChatGPT connectors, the raw MCP server has no built-in "needs approval" setting. That control has to come from your MCP client - if it doesn't offer one, every write happens with no human confirmation step at all.
• No custom validation rules. Pipeline stage validations and association label validations don't run on MCP-server writes, matching the behavior of HubSpot's packaged connectors. An agent can move a deal in a way the HubSpot UI would block.
• User-reported: engagement ownership doesn't follow your instructions on create. A HubSpot Community post from April 30, 2026 describes manage_crm_objects creating meetings and tasks without a documented way to set hubspot_owner_id, meeting time fields, or task due dates - new records fall back to a default owner (often the contact owner) instead of whoever the prompt named. Treat this as reported and unresolved as of this writing, not as permanent behavior; verify who a record lands on before trusting a bulk run.
• Search runs on the CRM search API, not vector search. Fuzzy, semantic-style questions work less reliably than exact filters on known properties. Give it specific field names and values when you can.
• No deletes, anywhere. Honestly, a feature. Nothing connected through the MCP server can remove records, engagements, or property values.
• Scope creep needs reauthorization. When HubSpot adds new MCP tools, already-connected users may need to reconnect to grant the new scopes - nothing breaks silently, but access doesn't expand automatically either.

How Hubjoy connects AI tools to client portals

We connect AI tools to client HubSpot portals as part of ongoing delivery work, using whichever door fits the client's stack - packaged connector, raw MCP server, or the Agent CLI. This is the process we run before an MCP connection touches a real portal:

1. Confirm the client actually needs the raw server. If Claude or ChatGPT covers it, we use the packaged connector - it ships with a real write-approval setting HubSpot maintains, which the raw MCP server does not.
2. Pick an MCP client with human-in-the-loop confirmation, and turn it on. Since HubSpot doesn't gate writes on its own for this connection, the client has to. We don't connect write scopes to a client that lacks a confirm-before-write mode.
3. Connect with a scoped user, not an admin. The connecting user's own HubSpot permissions are the real ceiling. We use an account whose access matches what the AI tool should see, never a Super Admin's view of everything.
4. Reads first, for at least a week. We run it as a question-answering layer before granting any write scope, long enough to see how it handles the client's specific property setup and naming conventions.
5. Spot-check ownership and timestamps on early writes. Given the community-reported ownership gap on created engagements, we verify who a new meeting or task actually lands on before trusting the pattern at volume.
6. Data hygiene still decides quality. An AI tool answering from stale deal stages or duplicate contacts is confidently wrong either way. We clean the portal before we expand what any AI tool can see.

The gotcha we plan around: because HubSpot puts the write-approval decision on the client rather than the server, the raw MCP server is only as safe as the tool you connect it to. A well-built client with approval gates is a very different risk profile from a script with none, even though both are talking to the identical HubSpot endpoint.

Frequently asked questions

Is "HubSpot MCP connector" the same thing as the HubSpot MCP server?

Yes. HubSpot's own name for the product is the "HubSpot MCP server" (also written as the remote HubSpot MCP server), at mcp.hubspot.com. "MCP connector" is the term a lot of practitioners and third-party guides use for the same thing, since connecting to it functions like installing a connector. This page uses both terms for that reason.

Is the HubSpot MCP server free, and which HubSpot plans support it?

Yes, it's free on every HubSpot plan, across all hubs and tiers - that was true from its September 2025 beta launch and remains true at General Availability. There's no MCP-specific fee or credit consumption; usage counts against your portal's normal API limits, and Breeze credits apply to HubSpot's own AI agents, not to this connection.

How is the HubSpot MCP server different from the HubSpot connector for Claude or ChatGPT?

The Claude connector and ChatGPT connector are packaged, one-click HubSpot apps built for those two specific chat tools, complete with their own write-approval settings. Both actually run on this same MCP server behind the scenes. The raw MCP server documented here is the generic version: connect it to Cursor, a custom agent, or any other MCP-compatible client, with more setup work and no built-in approval gate of its own.

How is the MCP server different from the HubSpot Agent CLI?

The MCP server and the packaged connectors are built for live, real-time conversation: you ask, the AI answers or acts, you're watching. The HubSpot Agent CLI is built for the opposite case - repetitive, bulk, or scheduled work that runs in the background. HubSpot positions them as complements, not alternatives.

What AI tools can connect to the HubSpot MCP server?

Any MCP client that supports OAuth 2.1 with PKCE. In practice that includes Claude (as a custom connector, separate from the packaged app), Claude Code, Cursor, VS Code, Windsurf, ChatGPT in developer mode, and a growing list of platforms like n8n and LibreChat that ship built-in HubSpot MCP configuration. If your AI tool speaks MCP and handles OAuth, it can connect.

Can the HubSpot MCP server delete records?

No. Across every object it can touch, the server supports read, create, and update, but never delete. Anything created through it can still be deleted manually inside HubSpot.

Does Sensitive Data affect what the MCP server can see?

Yes, more than it affects HubSpot's standard APIs. Custom Sensitive Data properties are never accessible through the MCP server. And if your portal has Sensitive Data turned on at all, activities - calls, emails, meetings, notes, tasks - and all conversation data are blocked entirely for MCP access, even though those same objects remain reachable through HubSpot's regular APIs.

Is the HubSpot MCP server still in beta?

The server itself is not - it reached General Availability on April 13, 2026. What's still labeled Beta, as of HubSpot's own current marketing page, is the self-service MCP Auth Apps screen you use to set up a connection. The underlying data access is stable; the setup interface is the part still evolving.

Already using Claude or ChatGPT day to day? Skip the developer setup and use HubSpot's packaged connector instead - see our guides to the HubSpot connector for Claude and the HubSpot connector for ChatGPT for setup, security, and the exact permission tables for each.

Connecting AI to your portal?

Any AI tool is only as good as the CRM it reads. We'll tell you whether your portal is ready to be operated by AI, and what to fix first if it isn't. Thirty minutes, no pitch.

Book your free HubSpot Review