HubSpot MCP: Setup, Permissions and Capabilities

HubSpot hosts an MCP server at https://mcp.hubspot.com for access to CRM data from compatible AI clients. Your client requests an exposed operation and the server acts using the authorized connection.

This page is a setup and permissions reference. For the underlying idea, read What is HubSpot MCP? For a buying decision, use HubSpot MCP vs Daeda AI.

The Model Context Protocol lets an AI client discover and call a server's tools. Two servers can use MCP while exposing very different operations. Connecting successfully does not prove that a particular object, write action or configuration change is supported.

The current remote-server reference includes custom objects in read access. Its CRM write list names contacts, companies, deals, tickets, line items and products, alongside supported activity, content and marketing operations. Read and write coverage are not identical.

Do not interpret custom-object record access as permission to create new object types. Likewise, do not copy a managed connector's capability table onto the direct server. Check the exact surface and operation before planning work.

Use your client's tool-discovery view. HubSpot documents calling get_user_details to inspect account, object and tool availability. The authorized tool list is more useful than the old claim that every connection exposes a fixed set of 12 tools.

Before a query, inspect the tool's fields, filters and result limits. Before a write, inspect its target, supported operation and approval behaviour. Ask the assistant to flag an unsupported request instead of silently substituting something else.

Check pagination and result completeness in the tools you actually have. A first page of matching records is not a portal-wide audit. API limits and permissions still apply.

HubSpot documents that enabling Sensitive Data blocks activity and conversation access through the remote server. Do not attempt to route around that restriction; choose a permitted task and keep the account's data policy in view.

When scopes change, reconnecting may be required to grant the new access. Review those permissions deliberately rather than assuming a reconnect is only a technical repair.

Follow HubSpot's current setup instructions for client-specific details. The main checkpoints are:

1. Create an MCP auth app in HubSpot and configure the redirect URL required by your client.
2. Configure a compatible client for https://mcp.hubspot.com using the app's OAuth credentials and PKCE support. Keep credentials out of chats and shared files.
3. Authorize the intended HubSpot account and review the requested access.
4. Inspect the available tools and run get_user_details to verify the connected account and permissions.
5. Try a small read-only request whose result you can check in HubSpot. Establish approval controls before requesting any writes.

The remote server provides CRM data access. HubSpot's separate Developer MCP Server helps developers build apps and CMS content. Choose the server for the job: CRM investigation and app development are not the same setup.

HubSpot's managed connectors have their own setup, permissions and supported-object tables. Do not assume their capabilities or limits are interchangeable with direct remote MCP.

For example, the Claude connector documentation lists custom-object record creation and updates, a ten-record bulk write limit and configurable write approval. Its Needs Approval control is an important distinction from the inaccurate claim that every native write runs without confirmation.

Try native access first for supported lookups and updates. Consider another tool when you have a concrete requirement its data or review model serves better.

The free daeda-mcp package provides local, read-only analysis of synced contacts, companies and deals. The local database does not remove the AI client's own data handling: information returned to the assistant may be sent to its provider.

Daeda AI uses managed synced context, supports multiple connected portals and saves proposed operations as Write Plans reviewed inside HubSpot. Check freshness, supported actions, permissions and any Bridge requirements. Plans can partially complete; inspect the results rather than assuming an automatic rollback.

For task-by-task examples, read when to add Daeda AI. Native approval is not the same review flow as a saved plan, but approval alone is not unique to Daeda.