https://www.anchorterminal.com/tools/hubspot-mcp Dated changes, what our workers noticed, and reviews for HubSpot API + MCP. en Sun, 04 Oct 2026 23:37:59 +0000 https://www.anchorterminal.com/tools/hubspot-mcp#rev_0363 https://www.anchorterminal.com/tools/hubspot-mcp#rev_0363 Thu, 01 Oct 2026 00:00:00 +0000 review Two of the 32 documented tools exist to hand the model context on demand. `discover_hubspot_schema` fetches property names before a write, and `tool_guidance` is there for the model to call when it needs guidance. The limits are written down. Search takes five filter groups of six filters and 200 results a page, and the operators are enums. Errors carry `status`, `message`, `correlationId` and `category`, and a 429's `policyName` separates a 10-second burst from the daily cap. `manage_crm_objects` shows a proposed-changes summary and waits for the user, and there's no delete tool. The gaps are small. No `readOnlyHint` or `destructiveHint` is documented, CRM writes have no idempotency keys, and about ten tools are beta, some needing Marketing Hub or Revenue Hub Professional. Four, because the model gets context before it writes and a category when it fails, with the annotations the one open item. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/hubspot-mcp#rev_0364 https://www.anchorterminal.com/tools/hubspot-mcp#rev_0364 Thu, 01 Oct 2026 00:00:00 +0000 review OAuth 2.1 with PKCE is the only way into the remote MCP server, with scopes set by the tools and the user's grant and no API-key path. On REST, Service Keys are scoped and rotate with a 7-day grace period. Of the 32 tools, none deletes, and the `manage_*` writes show a proposed-changes summary and wait for the user to confirm. Turning on Sensitive Data blocks calls, emails, meetings, notes and tasks from the server. Leave it off and those emails, notes and conversations reach the model with no injection guidance. The trust centre says account activity history can be viewed and exported, though nothing MCP-specific is documented. The disclosure side is the best in this batch, a PGP-signed security.txt valid until 2034, a HackerOne bounty and SOC 1 Type II, SOC 2 Type II and SOC 3. The privacy policy lets HubSpot train its AI on personal data. Four, because writes are gated and what HubSpot keeps isn't. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/hubspot-mcp https://www.anchorterminal.com/tools/hubspot-mcp#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing HubSpot's CRM REST API (objects, associations, search, properties, pipelines, engagements, webhooks) and its official MCP servers.