HubSpot API + MCP vs Relaticle

HubSpot API + MCP 82

The remote MCP server takes only OAuth 2.1 with PKCE, with scopes set by the tools and the user's grant. REST uses OAuth apps or Service Keys, which are scoped and rotate with a 7-day grace period (30). Writes need explicit user confirmation after a proposed-changes summary, MCP has no delete tools, and turning on Sensitive Data blocks calls, emails, meetings, notes and tasks from the MCP server. No documented read-only mode (17 of 20). The server reads emails, conversations and notes written by outsiders, and we found no injection guidance beyond the Sensitive Data switch (5 of 15). Account activity history can be viewed and exported per the trust centre. Nothing MCP-specific is documented (10 of 15). PGP-signed security.txt valid until 2034, a HackerOne bug bounty, SOC 1 Type II, SOC 2 Type II and SOC 3 (20).

Relaticle 57

Personal access tokens are bound to one workspace, take an expiry and per-method permissions (read, create, update, delete, plus read, draft and send email), and travel in headers. OAuth 2.1 through Passport is also offered, but the source says its single mcp:use scope authorises the whole toolset (25 of 30). A read-only token is possible; the docs say MCP writes apply immediately and leave confirmation to the client (10 of 20). Synced email reaches the model through the email tools, and no prompt-injection guidance was found (0). Each record has an activity log of field changes and who made them, and admins see it across the workspace (12 of 15). security.txt valid to May 2027, a disclosure address with a 48-hour acknowledgement target and security-audit workflows in CI; the security page says there is no SOC 2 or ISO 27001 (10 of 20). 25 + 10 + 0 + 12 + 10 = 57.

HubSpot API + MCP 60

Status page at status.hubspot.com with component history (20). Twelve entries since 3 July 2026, several over an hour on core platform services, among them EU customer platform tools impaired for 3 h 9 min on 22 July, event ingestion delayed 5 hours on 28 July, workflow actions delayed 5 h 45 min on 21 August and the Salesforce integration down about 8 hours on 24 September. None names the public API or the MCP server, which is why this isn't 0 (5). Limits published per app type and tier, 100 to 190 requests per 10 seconds and 250,000 to 1,000,000 a day for private apps, 110 per 10 seconds for public apps (15). 429s carry errorType RATE_LIMIT and policyName, and responses carry X-HubSpot-RateLimit-* headers, but the usage page gives no Retry-After or backoff guidance and we found no idempotency keys for CRM writes (10 of 15). No SLA found in what we read (0). Remote MCP server GA since 13 April 2026, though about ten tools for revenue objects and quotes are beta (10).

Relaticle 40

Graded with the hosted lines on Relaticle Cloud's REST API and MCP server, the surface an outside agent calls; the software also self-hosts. No status page is linked and status.relaticle.com did not connect (0). With no readable history the incident line scores 5. Limits have numbers: 600 a minute per workspace and 300 reads or 60 writes a minute per token in the source, and 120 MCP calls a minute per user in the docs (15). 429 is in the OpenAPI responses and upserts by unique field give a safe retry for creates, but the backoff guidance sits on a docs section we read only as a heading (10 of 15). No SLA (0). Version 3.8, not labelled beta (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

HubSpot API + MCP 72

32 MCP tools (5), with scopes trimmed to the tools and permissions the user grants at install, and discover_hubspot_schema and tool_guidance to fetch context on demand (3 more, 8 of 25). Search takes filter groups, sorts, a 200-record page and a properties list, and REST reads select properties (20). Errors carry a category and a correlation ID (16 of 20). manage_crm_objects shows a proposed-changes summary and needs the user's confirmation before any create or update, and there's no delete tool. We found no readOnlyHint or destructiveHint documented and no idempotency keys (13 of 20). Official SDKs for Node (14.0.1, 1 July 2026), Python, PHP and Ruby (15).

Relaticle 59

50 MCP tools, six schema resources and a prompt, with no toolsets or read-only subset (5). Filters combine native fields, custom fields and linked records with $and, $or and $not, plus sort, include, per_page (MCP maximum 25) and cursors (20). Errors come back as HTTP codes and inline MCP error responses such as Invalid ability provided.; no error catalogue was read (12 of 20). Base tool classes set readOnlyHint, destructiveHint, idempotentHint and openWorldHint, and upserts by unique field make creates safe to retry (17 of 20). One URL with OAuth or a token; no official SDK (5 of 15). 5 + 20 + 12 + 17 + 5 = 59.

HubSpot API + MCP 85

Closed service with terms naming HubSpot, Inc. (15). Privacy policy updated 16 September 2026 with a DPA whose Annex 3 lists subprocessors. Retention reads 'a reasonable period', and the policy says HubSpot may process personal data to train its AI models (18 of 30). Dated sunsets, Pipelines v1 on 4 December 2026 (announced 14 August) and v1 to v3 APIs and legacy apps in September 2027 (announced 15 September 2026), plus date-based API versions (20). Subprocessor page and regional data centres disclosed (18 of 20).

Relaticle 73

AGPL-3.0 source with an integration exception, and terms for the Cloud service (30). The privacy policy (4 November 2026) gives retention for server logs (90 days), contact forms (12 months) and paused trial workspaces (deleted after 60 days with notice), and names provider categories; no DPA was found (20 of 30). No deprecation policy or dated notices found (5 of 20). The security page lists each Cloud provider and what it receives, with hosting at Hetzner in Germany, and website analytics through Fathom without CRM content (17 of 20). 30 + 20 + 5 + 17 = 72.

HubSpot API + MCP 92

OpenAPI specs in the public HubSpot-public-api-spec-collection repository (25). llms.txt on developers.hubspot.com (10). MCP tool docs explain each tool, give search limits (five filter groups of six filters, 200 results a page), and the server has a tool_guidance tool the model can call (16 of 20). Typed inputs with operator enums in search (13 of 15). Examples and a standard error body with status, message, correlationId and category (13 of 15). Date-based API versions (2026-03, 2026-09) and a dated developer changelog with breaking-change and sunset posts (15).

Relaticle 86

OpenAPI 3.1 at /openapi.json and /openapi.yaml with 34 operations (25). llms.txt with a when-to-use and when-not section, and developer pages (10). The llms.txt and MCP docs say what the API is for and what it doesn't do (no email over REST, no meetings), while only 5 of 34 operations carry a description (14 of 20). 114 required lists and typed MCP inputs, but few enums (11 of 15). 661 examples and responses for 401, 402, 403, 404, 409, 422 and 429 (14 of 15). /v1 and frequent tagged releases, with no changelog page (relaticle.com/changelog is 404) (12 of 15). 25 + 10 + 14 + 11 + 14 + 12 = 86.

HubSpot API + MCP 84

Developer Platform 2026.09 and a changelog post on 15 September 2026 (30). Changelog posts on 11 August, 14 August, 27 August, 8 September and 15 September 2026 (20). Public changelog and developer community. We didn't check forum response times (12 of 15). Not in the official MCP registry under a HubSpot namespace, only third-party servers, but official SDKs are current (15). The Node SDK has test and lint CI and moved to Node 22 in 14.0.0, but still wraps the v3 APIs that lose support in September 2027 (7 of 10).

Relaticle 90

v3.8.2 tagged on 5 November 2026 and commits on 6 November (30). Thirteen tags between 9 October and 5 November alone (20). More than 2,500 commits since 1 August and merged pull requests numbered past 1,100; the GitHub API did not answer, so open issues and reply times were not counted (15 of 25). Verified com.relaticle/crm namespace in the official MCP registry with the hosted remote (15). CI, tests, security-audit and Dependabot workflows, PHP 8.5 and Laravel 13 (10). 30 + 20 + 15 + 15 + 10 = 90.