Secure HubSpot access for AI agents
CRM objects, campaigns, marketing emails, analytics, landing pages, and conversations via HubSpot's official MCP server
Through HubSpot, agents can read and manage CRM objects (contacts, companies, deals, tickets), query campaign and attribution data, create and analyze marketing emails, pull content analytics, manage landing pages, and search conversations — every call runs through your policies and is logged for audit.
Server URL: https://mcp.hubspot.com
Setup
- Navigate to Resources and click Add Resource
- Select HubSpot from the catalog
- Provide your HubSpot app credentials (see Bring your own app)
- Click Add
Each user connects their own HubSpot account via OAuth when they first use a HubSpot tool; there is no shared service account. Navigate to Connections to manage linked accounts.
Credential modes
HubSpot supports one mode:
- Bring your own app: a HubSpot app owned by your organization. HubSpot does not support dynamic client registration, so an app registered in a HubSpot developer account is required.
See Credential modes for the full comparison.
Bring your own app
A HubSpot developer registers an app in a HubSpot developer account, then returns to SecureAuth with the Client ID and Client Secret.
In the Agent Authority console, go to Resources → Add Resource → HubSpot and copy the redirect URI shown on the page. HubSpot is bring-your-own-app only, so the credentials form opens as soon as you select it — there's no mode to pick.
In the HubSpot developer account, create an app (or open an existing one) and configure its Auth settings:
- Under Redirect URLs, add the redirect URI you copied
- Under Scopes, add the CRM and marketing scopes your organization wants agents to use (for example,
crm.objects.contacts.read,crm.objects.companies.read,crm.objects.deals.read, and their write counterparts as needed) - Copy the Client ID and Client Secret from the app's Auth tab
Paste both back into the HubSpot configure page in the Agent Authority console, then click Add. Leave Token Endpoint Authentication on Auto-detect — HubSpot works with the detected default.
The OAuth authorization and token endpoints are served by the MCP host itself (https://mcp.hubspot.com/oauth/authorize/user and https://mcp.hubspot.com/oauth/v3/token); users pick the HubSpot account to connect during the OAuth flow.
Available tools
| Tool | Description |
|---|---|
tool_guidance | Returns required usage guidance for the other HubSpot tools; call before first use of a tool |
get_user_details | Returns details about the currently authenticated HubSpot user and portal |
get_organization_details | Returns details about the HubSpot organization (account, portal, subscriptions) |
get_crm_objects | Fetches CRM records by object type and IDs |
search_crm_objects | Searches CRM records (contacts, companies, deals, tickets, ...) with filters |
manage_crm_objects | Creates or updates CRM records |
query_crm_data | Runs analytical queries over CRM data |
get_properties | Lists property definitions for a CRM object type |
search_properties | Searches property definitions by keyword |
search_owners | Searches HubSpot owners (users assignable to records) |
read_campaign_data | Reads campaign details, analytics, and associated asset metrics |
manage_campaign_objects | Creates or updates campaign objects |
get_campaign_attribution_reports | Returns closed-won revenue/deal/contact attribution reports for campaigns |
get_marketing_email_analytics | Returns marketing email performance analytics |
manage_marketing_email | Creates or edits marketing emails |
get_content_analytics_report | Returns content (pages, blogs) analytics reports |
manage_landing_page | Creates or edits landing pages |
render_landing_page_ui | Renders a landing page preview UI |
search_conversations | Searches conversations inbox threads |
get_conversation_channel_metadata | Returns metadata about conversation channels |
submit_feedback | Submits feedback about the HubSpot MCP server to HubSpot |