Breakcold vs HubSpot API + MCP

Breakcold 60

API changelog entry on 6 November 2026 (30). More than 60 dated entries since 8 August 2026 (20). Closed service with a public API changelog, an RSS feed, a help centre and support by email; no public issue tracker (10 of 15). The CRM MCP server is not in the official MCP registry (the registry's io.github.breakcold/inboxmcp is a separate product at inbox-mcp.com), and no official SDK exists (0). No package to check (0). 30 + 20 + 10 + 0 + 0 = 60.

HubSpot API + MCP 84

Developer Platform 2026.09 and a changelog post on 15 September 2026 (30). Changelog posts on 11 August, 14 August, 27 August, 8 September and 15 September 2026 (20). Public changelog and developer community. We didn't check forum response times (12 of 15). Not in the official MCP registry under a HubSpot namespace, only third-party servers, but official SDKs are current (15). The Node SDK has test and lint CI and moved to Node 22 in 14.0.0, but still wraps the v3 APIs that lose support in September 2027 (7 of 10).

Breakcold 60

API keys take chosen read and write scopes, an optional workspace limit and an expiry, are shown once, show activity history and can be revoked. MCP also accepts OAuth with PKCE through WorkOS AuthKit. Tokens travel in headers (30). Read-only keys are possible and message sends stay drafts until sendMode is set after the user confirms (17 of 20). The inbox returns email, LinkedIn, WhatsApp and Telegram text from outside parties, and no prompt-injection guidance was found (0). API key activity history is visible to the user; no organisation audit log was found (7 of 15). A vulnerability disclosure policy (3 September 2026) with reports to support@breakcold.com, no bounty, no security.txt (404) and no SOC 2 or ISO 27001 found (6 of 20). 30 + 17 + 0 + 7 + 6 = 60.

HubSpot API + MCP 82

The remote MCP server takes only OAuth 2.1 with PKCE, with scopes set by the tools and the user's grant. REST uses OAuth apps or Service Keys, which are scoped and rotate with a 7-day grace period (30). Writes need explicit user confirmation after a proposed-changes summary, MCP has no delete tools, and turning on Sensitive Data blocks calls, emails, meetings, notes and tasks from the MCP server. No documented read-only mode (17 of 20). The server reads emails, conversations and notes written by outsiders, and we found no injection guidance beyond the Sensitive Data switch (5 of 15). Account activity history can be viewed and exported per the trust centre. Nothing MCP-specific is documented (10 of 15). PGP-signed security.txt valid until 2034, a HackerOne bug bounty, SOC 1 Type II, SOC 2 Type II and SOC 3 (20).

Breakcold 67

Closed service with a legal centre whose terms name Logike SAS, its registration and French law (15 of 30). The privacy policy of 27 October 2026 and the DPA agree, give retention periods for specific copies (deleted record snapshots 30 days, exports 7 days, import rows 90 days, call recordings 30 to 365 days) and promise breach notice without undue delay (27 of 30). The developer terms tie notice of material breaking changes to the services agreement, and the changelog gives migration steps, with no fixed notice period found (12 of 20). DPA Annex C lists providers and their functions with 30 days' notice of changes; locations are said to depend on configuration, with US and EU app regions (15 of 20). 15 + 27 + 12 + 15 = 69.

HubSpot API + MCP 85

Closed service with terms naming HubSpot, Inc. (15). Privacy policy updated 16 September 2026 with a DPA whose Annex 3 lists subprocessors. Retention reads 'a reasonable period', and the policy says HubSpot may process personal data to train its AI models (18 of 30). Dated sunsets, Pipelines v1 on 4 December 2026 (announced 14 August) and v1 to v3 APIs and legacy apps in September 2027 (announced 15 September 2026), plus date-based API versions (20). Subprocessor page and regional data centres disclosed (18 of 20).

Breakcold 45

Graded as a hosted service on the REST API and hosted MCP server. No status page is linked from the site or docs, and status.breakcold.com failed the TLS handshake (0). With no readable history the incident line scores 5. Rate limits published per organisation (600 a minute), workspace (300), identity or key (180) and route (120), for REST and MCP (15). 429 carries Retry-After and retryAfterMs, the docs give backoff guidance, and creates take an Idempotency-Key so retries return the original result (15). No SLA found in the services agreement summary, the pricing page or the docs (0). Neither surface is marked beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

HubSpot API + MCP 60

Status page at status.hubspot.com with component history (20). Twelve entries since 3 July 2026, several over an hour on core platform services, among them EU customer platform tools impaired for 3 h 9 min on 22 July, event ingestion delayed 5 hours on 28 July, workflow actions delayed 5 h 45 min on 21 August and the Salesforce integration down about 8 hours on 24 September. None names the public API or the MCP server, which is why this isn't 0 (5). Limits published per app type and tier, 100 to 190 requests per 10 seconds and 250,000 to 1,000,000 a day for private apps, 110 per 10 seconds for public apps (15). 429s carry errorType RATE_LIMIT and policyName, and responses carry X-HubSpot-RateLimit-* headers, but the usage page gives no Retry-After or backoff guidance and we found no idempotency keys for CRM writes (10 of 15). No SLA found in what we read (0). Remote MCP server GA since 13 April 2026, though about ten tools for revenue objects and quotes are beta (10).

Breakcold 15

No x402, MPP or L402 (0). Plan prices are public, and each call's cost in usage tokens is published, but the money value of a token is not (10). The 14-day trial needs a card (0). auth.md documents an agent identity endpoint that takes an identity assertion or an anonymous request followed by a claim by a person, which we read and did not call; access still needs a paid or card-backed trial account (5 of 20). 0 + 10 + 0 + 5 = 15.

HubSpot API + MCP 30

No x402, MPP or L402 (0). Plan prices public, Starter $7 a seat a month yearly or $20 monthly, Professional $90 or $100 plus $1,500 onboarding, Enterprise $150 plus $3,500, with extra HubSpot Credits at $0.010 each. API calls themselves aren't priced (10). Free CRM for up to 2 users with no card, and the API and remote MCP work on it (20). A person signs up in a browser and creates the MCP connector or app (0).

Breakcold 67

72 MCP tools (5), with tools_search and capabilities_list to find tools by capability or granted scope, and scopes that limit which tools apply (8 back). Cursor pagination, record search and a fields selection on record lists since 3 November (18 of 20). Errors carry a code, message, requestId and retryAfterMs, and the 4 November changelog removed stack frames from messages (17 of 20). Idempotency keys on creates, and compose and send tools return a non-sending draft by default; MCP annotations are not published (14 of 20). No official SDK; setup is one URL with OAuth (5 of 15). 13 + 18 + 17 + 14 + 5 = 67.

HubSpot API + MCP 72

32 MCP tools (5), with scopes trimmed to the tools and permissions the user grants at install, and discover_hubspot_schema and tool_guidance to fetch context on demand (3 more, 8 of 25). Search takes filter groups, sorts, a 200-record page and a properties list, and REST reads select properties (20). Errors carry a category and a correlation ID (16 of 20). manage_crm_objects shows a proposed-changes summary and needs the user's confirmation before any create or update, and there's no delete tool. We found no readOnlyHint or destructiveHint documented and no idempotency keys (13 of 20). Official SDKs for Node (14.0.1, 1 July 2026), Python, PHP and Ruby (15).