Ranked roundup · HubSpot
Best MCP Server for HubSpot
The best MCP server for HubSpot is the one HubSpot itself runs: an official remote server at mcp.hubspot.com, generally available since April 13, 2026, authenticated with OAuth 2.1 and PKCE, with write access to contacts, companies, deals, tickets, products, line items, and engagements. That makes this an easier category than most — the vendor option is real, hosted, and documented. HubSpot also still ships a local npm package (@hubspot/mcp-server) that runs on a private app token, though it remains in beta and its source is not published. The community fills the remaining gaps with two MIT-licensed servers — one broad, one narrow but clever — both last pushed in November 2025, so check the commit log before betting on them. Managed platforms like Composio wrap HubSpot in hosted OAuth if you want zero token handling. Rankings below come from verifiable criteria — official status, maintenance recency, auth model, documented coverage — not paid placement, and we invent no benchmarks.
Facts checked September 1, 2026 · ranked on verifiable criteria · placement is never for sale
Founder, Automation Squad ·
The ranking
- Official · HubSpot
Anyone who wants supported, zero-install HubSpot access from Claude, Cursor, or any MCP client
Read access to most CRM objects (contacts, companies, deals, tickets, invoices, orders, quotes, subscriptions, products) plus conversations across live chat, email, WhatsApp, SMS, and Facebook Messenger; write access to contacts, companies, deals, tickets, line items, products, and engagements (calls, emails, meetings, notes, tasks); read-only campaigns, landing pages, website pages, and blog posts
Fully hosted by HubSpot at mcp.hubspot.com over Streamable HTTP — nothing to install or run · OAuth 2.1 with PKCE; your existing HubSpot user permissions are respected on every call
- Only generally available since April 13, 2026 — write access, engagement history, and marketing content arrived at GA, not before
- Accounts with Sensitive Data enabled lose access to activity objects and conversation data entirely
- Search is capped at 200 results and fetches at 100 object IDs per request
- Built on the CRM search API, which has no vector/semantic search
- Official · HubSpot
Teams that want official tooling but need token-scoped access or can't run an OAuth flow from their client
CRM object retrieval and creation, association management, tasks and notes, per the package README; version 0.4.0 published August 27, 2026
Local stdio server run via npx from the npm package · HubSpot private app access token (PRIVATE_APP_ACCESS_TOKEN env var) — you control scopes when creating the private app
- Still labeled beta and governed by HubSpot's Early Adopter Program terms, more than a year after its May 6, 2025 launch
- Closed source in practice: the HubSpot/mcp-server GitHub repo is an empty placeholder with no code and no license
- A private app token is a long-lived credential — HubSpot itself recommends starting with read-only scopes
- HubSpot's own docs now steer new users toward the remote server; don't confuse this with HubSpot's separate Developer MCP server for app/CMS building (GA February 19, 2026)
- Community
Agent builders whose workflows span HubSpot plus many other apps and who don't want to manage tokens
HubSpot actions exposed alongside 1,000+ other integrations through Composio's Tool Router, with tool-level access controls and an audit trail per call
Managed cloud MCP endpoint per team; no infrastructure to run · Managed OAuth with automatic token refresh and rotation; bring-your-own OAuth credentials supported; per-user and per-environment credentials
- Not a HubSpot product — a third party sits between your agent and your CRM and holds your tokens unless you bring your own credentials
- Commercial platform: expect usage-based pricing beyond the free tier
- Tool names and behavior follow Composio's abstraction, not HubSpot's own MCP tool set
- Community
Developers who want a readable, forkable, MIT-licensed alternative to HubSpot's closed-source local server
Claims complete coverage of the HubSpot CRM API: all standard objects, CRM Associations v4, batch operations, advanced search, Zod-validated parameters
Local via npx (@shinzolabs/hubspot-mcp), build-from-source, or hosted through Smithery · Static HubSpot access token (HUBSPOT_ACCESS_TOKEN); the README says OAuth support is planned, not shipped · MIT · 35★
- Unofficial — no HubSpot support if it breaks
- Last pushed November 25, 2025, roughly nine months before our verification date
- Modest adoption at 35 stars
- No OAuth — a long-lived token in a config file is the only auth path
- Community
Narrow contact/company workflows where cached, semantically searchable CRM data matters more than breadth
Seven tools: create contacts and companies with duplicate prevention, retrieve recently active contacts/companies and company activity, pull recent conversation threads, and semantic search over previously retrieved data via FAISS vector storage
Local Python server; also published for Docker · HubSpot access token (private app) · MIT · 127★
- Unofficial and far narrower than the official server — seven tools, no deals or tickets write support
- Last pushed November 11, 2025; the most-starred community option, but effectively idle since
- Semantic search only covers data the server has already fetched and cached, not your whole portal
HubSpot MCP servers compared
| Server | Maintained by | Runs | Auth | License |
|---|---|---|---|---|
| HubSpot remote MCP server (official) | HubSpot | Fully hosted by HubSpot at mcp.hubspot.com over Streamable HTTP — nothing to install or run | OAuth 2.1 with PKCE; your existing HubSpot user permissions are respected on every call | — |
| @hubspot/mcp-server (official local) | HubSpot | Local stdio server run via npx from the npm package | HubSpot private app access token (PRIVATE_APP_ACCESS_TOKEN env var) — you control scopes when creating the private app | — |
| Composio HubSpot toolkit (managed) | Community | Managed cloud MCP endpoint per team; no infrastructure to run | Managed OAuth with automatic token refresh and rotation; bring-your-own OAuth credentials supported; per-user and per-environment credentials | — |
| shinzo-labs/hubspot-mcp | Community | Local via npx (@shinzolabs/hubspot-mcp), build-from-source, or hosted through Smithery | Static HubSpot access token (HUBSPOT_ACCESS_TOKEN); the README says OAuth support is planned, not shipped | MIT |
| baryhuang/mcp-hubspot | Community | Local Python server; also published for Docker | HubSpot access token (private app) | MIT |
How to choose
Pick the remote official server if you want supported, zero-install CRM access with OAuth — that covers most people. Pick the local @hubspot/mcp-server if you need scope-limited access via a private app token, or your client can't complete an OAuth flow. Pick Composio if HubSpot is one of many tools your agent touches and you want auth managed for you. Pick shinzo-labs if you need open source you can read, fork, and self-host. Pick baryhuang/mcp-hubspot only for its niche: cached, semantically searchable contact and company data.
How this ranking works
Every server here is real and was checked against its repository or vendor documentation on the date above — stars and licenses come from the GitHub API, not from memory. Order reflects verifiable criteria only: official support, maintenance recency, adoption, auth model, and documented capability coverage. We do not run paid placements, and we list every caveat we find, including the unflattering ones.
Common questions
- Is there an official HubSpot MCP server?
- Yes, two for CRM work: a hosted remote server at mcp.hubspot.com (generally available since April 13, 2026) and a local npm package, @hubspot/mcp-server, still in beta. A third official server — the Developer MCP server, GA since February 19, 2026 — is a separate tool for building HubSpot apps and CMS assets, not for CRM data.
- What does setup and auth actually look like?
- The remote server uses OAuth 2.1 with PKCE — your MCP client opens a HubSpot sign-in and your normal user permissions apply. The local and community servers all want a private app access token instead: create one under Settings > Integrations > Private Apps, pick scopes (start read-only — HubSpot's own advice), and paste the token into your client config.
- What can't the official remote server do?
- If your account has Sensitive Data enabled, activity objects and conversation data are blocked entirely. Searches cap at 200 results, fetches at 100 object IDs, and there's no vector search — it rides on the standard CRM search API.
- Are the community HubSpot servers still maintained?
- Loosely. Both MIT-licensed options — shinzo-labs/hubspot-mcp (35 stars) and baryhuang/mcp-hubspot (127 stars) — were last pushed in November 2025, about nine months before our verification date. They aren't archived, but check recent commits before building on either.
MCP servers we build
Automation Squad publishes its own open-source MCP servers and agent skills, documented with the same rules this ranking uses.