HubSpot MCP server: what AI agents can read and change

HubSpot operates a remote MCP server at mcp.hubspot.com that lets Claude, ChatGPT, Gemini and other MCP clients read most CRM objects and write records only after an explicit user confirmation step, with every action bounded by the connected user's existing HubSpot permissions. In an October 2026 public beta announced in HubSpot's October 30 developer rollup, Super Admins on Enterprise tiers can grant supported AI connectors read-only access to Sensitive Data, with ChatGPT, Claude and Copilot able to read properties and engagements while Gemini and the remote MCP server reach engagements only; highly sensitive properties remain restricted and each connector must be disconnected and reauthenticated, with new permissions taking up to two hours to appear. Record writes route through a single tool, manage_crm_objects, and HubSpot's docs state it "requires explicit user confirmation before executing any create or update.

HubSpot MCP server: what AI agents can read and change HubSpot runs a remote MCP server at mcp.hubspot.com . It lets Claude, ChatGPT and other MCP clients read most CRM objects and write records after an explicit confirmation step. Every action respects the connected user's HubSpot permissions. In October 2026, HubSpot added a public beta that lets Super Admins open Sensitive Data to AI connectors, read-only, on Enterprise tiers. We build Relaticle, an open-source CRM with its own MCP server, so we track how other CRMs let agents in. This page covers what HubSpot's server reads, what it changes, and who decides. We update it when HubSpot changes the server. Last checked: October 30, 2026. HubSpot's remote MCP server documentation https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server lists these readable records: - Contacts, companies, deals, tickets and leads - Users, appointments, courses, listings, projects and services - Custom objects and segments lists - Activities calls, emails, meetings, notes, tasks and conversations Revenue objects are in beta: carts, invoices, orders, line items, products, quotes and subscriptions. The server creates and edits contacts, companies, deals, tickets, leads, line items, products and activities. It also reaches some marketing content: campaigns, landing pages and blog posts. Record writes go through one tool, manage crm objects . HubSpot's docs say it "requires explicit user confirmation before executing any create or update." Segment writes, publishing and blog post creation carry the same requirement. Any MCP client that supports OAuth with PKCE can connect. Some tools work only in Claude, ChatGPT and Gemini. Three things set the boundary. 1. The connected user. "All actions respect your existing HubSpot user permissions," per HubSpot. An agent sees what that person sees. 2. The install. You do not pick scopes one by one. They follow from the tools available when the connector is installed and what the user grants. A scope added later needs a reinstall. 3. Sensitive Data settings. With Sensitive Data turned on, activities and conversations are blocked from the MCP server by default. The practical consequence: connect agents as a user whose permissions already match the job. A sales rep's agent should not run as a Super Admin. HubSpot's October 2026 developer rollup https://developers.hubspot.com/changelog/october-2026-rollup , published October 30, announced a public beta. A Super Admin can now allow supported AI connectors to read Sensitive Data. Before, connectors had no access to those properties or engagements. | Connector | Sensitive Data it can read in the beta | |---|---| | ChatGPT, Claude, Copilot | Properties and engagements | | Gemini, remote MCP server | Engagements only | The configuration guide https://knowledge.hubspot.com/account-security/configure-ai-connector-access-sensitive-data sets the conditions: - Access is read-only. "Highly Sensitive Data properties remain restricted." - Only a Super Admin can configure it, and Sensitive Data settings must already be on. - It requires an Enterprise tier of a listed hub, such as Sales Hub or Smart CRM. - Each connector must be disconnected and reauthenticated. New permissions can take up to two hours to appear. If your account holds health, financial or similar regulated data, treat turning this on as a data-sharing decision. Whatever a connector reads becomes part of your conversation with the AI provider. Run these on a test record before you trust the connection with a real pipeline. 1. Identity. Ask the agent which user and account it is connected as. It should name the user you intended. 2. A denied read. Ask for a record or property the user cannot see. The agent should get nothing back. 3. A confirmed write. Ask it to update one test deal. You should see a confirmation step before anything changes. 4. Revocation. Remove the connector, then repeat the read. It should fail. Our access checklist for AI agents https://relaticle.com/blog/crm-ai-permissions-before-connecting-an-agent turns these into a worksheet you can keep per connection. Relaticle answers them differently, and one difference matters before you grant write access. - Credential limits. A personal access token carries chosen abilities: read, create, update and delete. A read-only token rejects writes at the server. OAuth connections use one scope and are bound to one workspace, with no read and write split. - Writes over MCP commit directly. Relaticle's MCP server has no confirmation step of its own. Any confirmation comes from your client. Rela, the built-in AI assistant, works the other way: it proposes each change as a card you approve. - No Sensitive Data tier. A connection reads what its user can see in that workspace. Use a separate workspace for data an agent should never reach. - A record of what the agent did. Records created over MCP carry mcp as their creation source. Changes appear in each record's activity log. For pricing, self-hosting and migration differences, see Relaticle vs HubSpot https://relaticle.com/blog/relaticle-vs-hubspot-an-honest-comparison . To set up a connection, start with how to connect Claude to your CRM with MCP https://relaticle.com/blog/how-to-connect-claude-to-your-crm-with-mcp . - October 30, 2026: First version. Covers the Sensitive Data beta from HubSpot's October rollup. mcp https://relaticle.com/blog/tag/mcp Related posts Comparisons https://relaticle.com/blog/relaticle-vs-hubspot-an-honest-comparison Relaticle vs HubSpot: An Honest Comparison HubSpot offers a broad customer platform with free AI and official MCP. Relaticle offers self-hosting and flat hosted CRM pricing. Comparisons https://relaticle.com/blog/relaticle-vs-espocrm-an-honest-comparison Relaticle vs EspoCRM: An Honest Comparison Compare Relaticle and EspoCRM on AI, MCP, deployment, extensions, and pricing. Check the core and extension features your team needs. Comparisons https://relaticle.com/blog/open-source-attio-alternatives-ranked-by-use-case Open-Source Attio Alternatives, Ranked by Use Case Compare Relaticle, Twenty, EspoCRM, and Frappe CRM by workflow, deployment, pricing, and migration requirements before leaving Attio.