Secure HubSpot access for AI agents

CRM objects, campaigns, marketing emails, analytics, landing pages, and conversations via HubSpot's official MCP server

Through HubSpot, agents can read and manage CRM objects (contacts, companies, deals, tickets), query campaign and attribution data, create and analyze marketing emails, pull content analytics, manage landing pages, and search conversations — every call runs through your policies and is logged for audit.

Server URL: https://mcp.hubspot.com

Setup

  1. Navigate to Resources and click Add Resource
  2. Select HubSpot from the catalog
  3. Provide your HubSpot app credentials (see Bring your own app)
  4. Click Add

Each user connects their own HubSpot account via OAuth when they first use a HubSpot tool; there is no shared service account. Navigate to Connections to manage linked accounts.

Credential modes

HubSpot supports one mode:

  • Bring your own app: a HubSpot app owned by your organization. HubSpot does not support dynamic client registration, so an app registered in a HubSpot developer account is required.

See Credential modes for the full comparison.

Bring your own app

A HubSpot developer registers an app in a HubSpot developer account, then returns to SecureAuth with the Client ID and Client Secret.

In the Agent Authority console, go to Resources → Add Resource → HubSpot and copy the redirect URI shown on the page. HubSpot is bring-your-own-app only, so the credentials form opens as soon as you select it — there's no mode to pick.

In the HubSpot developer account, create an app (or open an existing one) and configure its Auth settings:

  • Under Redirect URLs, add the redirect URI you copied
  • Under Scopes, add the CRM and marketing scopes your organization wants agents to use (for example, crm.objects.contacts.read, crm.objects.companies.read, crm.objects.deals.read, and their write counterparts as needed)
  • Copy the Client ID and Client Secret from the app's Auth tab

Paste both back into the HubSpot configure page in the Agent Authority console, then click Add. Leave Token Endpoint Authentication on Auto-detect — HubSpot works with the detected default.

The OAuth authorization and token endpoints are served by the MCP host itself (https://mcp.hubspot.com/oauth/authorize/user and https://mcp.hubspot.com/oauth/v3/token); users pick the HubSpot account to connect during the OAuth flow.

Available tools

ToolDescription
tool_guidanceReturns required usage guidance for the other HubSpot tools; call before first use of a tool
get_user_detailsReturns details about the currently authenticated HubSpot user and portal
get_organization_detailsReturns details about the HubSpot organization (account, portal, subscriptions)
get_crm_objectsFetches CRM records by object type and IDs
search_crm_objectsSearches CRM records (contacts, companies, deals, tickets, ...) with filters
manage_crm_objectsCreates or updates CRM records
query_crm_dataRuns analytical queries over CRM data
get_propertiesLists property definitions for a CRM object type
search_propertiesSearches property definitions by keyword
search_ownersSearches HubSpot owners (users assignable to records)
read_campaign_dataReads campaign details, analytics, and associated asset metrics
manage_campaign_objectsCreates or updates campaign objects
get_campaign_attribution_reportsReturns closed-won revenue/deal/contact attribution reports for campaigns
get_marketing_email_analyticsReturns marketing email performance analytics
manage_marketing_emailCreates or edits marketing emails
get_content_analytics_reportReturns content (pages, blogs) analytics reports
manage_landing_pageCreates or edits landing pages
render_landing_page_uiRenders a landing page preview UI
search_conversationsSearches conversations inbox threads
get_conversation_channel_metadataReturns metadata about conversation channels
submit_feedbackSubmits feedback about the HubSpot MCP server to HubSpot

On this page