HubSpot API + MCP vs Nutshell

HubSpot API + MCP

Remote MCP server GA since 13 April 2026, OAuth 2.1 with PKCE only. Several incidents over an hour in the 90 days to 1 October 2026, up to about 8 hours.

Nutshell

The REST reference is served as Markdown with an OpenAPI fragment per operation, and the hosted MCP server uses OAuth with PKCE and can only read. No rate limit numbers, error format or API changelog were found in the reviewed documentation, and API keys carry no scopes.

HubSpot API + MCP

1. Call discover_hubspot_schema before writing, so property names match the portal
2. Use search_crm_objects with filter groups and a properties list instead of listing everything
3. Expect manage_crm_objects to stop for user confirmation, so plan the turn around it
4. Read policyName on a 429 to tell a 10-second burst from the daily cap
5. Ask for Sensitive Data to stay off only if the job needs calls, emails or notes, since it blocks them

Nutshell

1. Authenticate REST calls with HTTP Basic, a Nutshell user's email as username and the API key as password, against https://app.nutshell.com/rest
2. Use IDs in the <number>-<type> form, such as 3-accounts, and send updates as JSON Patch with content-type: application/json-patch+json
3. Page lists with page[limit] and page[page], which is 0-based, and call /accounts/list/fields or the lead and contact equivalents for valid filter keys
4. Use the REST API for writes. The MCP server only reads, and OAuth tokens need the read scope
5. Filter webhook events yourself, because every webhook receives all events and subscriptions are created in Setup, not through the API