Scopes can be misconfigured; a capability that does not exist cannot be. HubSpot's decision to keep Sensitive Data Properties and PHI out of the MCP surface entirely means a customer in a regulated industry does not have to trust that every connected client got its permissions right. The rest is a full read-write CRM, which is a large grant — the user-level app model is what keeps it bounded to one person's access.
HubSpot's own endpoint. Access is governed by a user-level app and its scopes, so the connection inherits one person's permissions rather than the portal's.
- Read and write across CRM objects: contacts, companies, deals, tickets, carts, products, orders, line items, invoices, quotes, subscriptions, lists and engagements
- Read-only organisation context and marketing content — campaigns, pages and blogs
- No access to Sensitive Data Properties or PHI
OAuth 2.0 through a HubSpot user-level app. A local alternative exists for developers through the HubSpot CLI.
Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen