# CRM servers: HubSpot and Salesforce HubSpot facts checked on 2026-11-01, its tool list again on 2026-11-06. Salesforce hosted server facts were read in a browser on 2026-11-06: developer.salesforce.com and help.openai.com refuse automated fetches, and help.salesforce.com answers, but some pages return an error shell with no article, so read those in a browser. Write-tool lists are partial and dated; the live tool list wins. ## HubSpot Server and status - Remote server `https://mcp.hubspot.com`, OAuth with PKCE (S256), generally available. - Official connectors for Claude, ChatGPT, Microsoft Copilot and Gemini. Third-party hosts offering a "HubSpot MCP" are community servers (scanner S01). - HubSpot's own local packages are not CRM routes for this skill. `@hubspot/mcp-server` is the older beta local server on a private app access token, with no release since 2025-06-18 (npm, checked 2026-11-01): scanner S02 reports it as legacy; move to the remote server. `npx -y @hubspot/cli mcp start` is HubSpot's developer MCP server for app and CMS work, not CRM data: keep it out of marketing profiles. Clients - Claude Desktop and claude.ai: the HubSpot directory connector under Customize > Connectors (HubSpot's article still shows Settings > Connectors > Browse; follow the live UI); plan rules are in clients.md. Super Admins and users with App Marketplace Access connect without prior approval; others need a Super Admin approval that sets data permissions and installers. Claude Enterprise admins can restrict connections to verified-domain accounts. - ChatGPT: the HubSpot connector; newly approved data permissions need a reconnect. - Claude Code: inherit the claude.ai connector (signed in with the claude.ai subscription), or add a custom connection with `--client-id`, `--client-secret` and `--callback-port` registered in a HubSpot MCP connector (the user runs it; see clients.md). An article gives a provider-specific path for Claude Code that HubSpot's own pages do not mention on 2026-11-01: use one of the two routes above. Codex, Cursor and VS Code use the custom connection route. - Custom clients: Development > MCP Connectors > Create MCP connector (client ID, client secret, redirect URL). MCP Inspector's redirect `http://localhost:6274/oauth/callback/debug` is for testing. Auth and who can connect - Per-user OAuth; calls run with the user's HubSpot permissions. - Scopes follow the tools at install and change as tools change. When HubSpot adds scopes, users reinstall to get them, and the tool list changes: rerun T2. Read-only layer - A View-only user with Create off, plus a client allowlist of the read tools the job needs, so a write tool HubSpot ships under another name stays off: Codex `enabled_tools`, Claude Code `permissions.allow` with `dontAsk`, or a chat app's Blocked write category with new tools off. - Where a client has no allowlist, block every `manage_*` tool and `submit_feedback`. A glob deny on `manage_*` covers later tools under that verb only. - View users can still create notes and tasks (HubSpot's permissions guide, as recorded in agent-write-safety on 2026-10-20), so the client block is required, not optional. HubSpot itself recommends write tools at Needs approval; for a read-only pass, block them. Write surface to block (2026-11-01) - `manage_crm_objects`, `manage_segment`, `manage_custom_properties`, `manage_custom_pipelines`, `manage_campaign_objects`, `manage_marketing_email`, `manage_landing_page`, `manage_website_page`, `manage_blog_post`, `manage_aeo_prompts`, `manage_aeo_recommendations`, `manage_onboarding` (HubSpot's page does not say whether it writes; treat it as a write). - `submit_feedback` sends feedback to HubSpot. - `manage_website_page`, `manage_blog_post` and `render_asset` are available only in Claude, ChatGPT and Gemini. - Drift evidence: the write list re-checked on 2026-10-20 did not include `manage_aeo_prompts` or `manage_aeo_recommendations`; HubSpot's page listed them on 2026-11-01. This is why controls that deny new tools by default, or a glob on the verb, beat per-tool deny lists. Read tools (2026-11-01) - `get_user_details`, `get_organization_details`, `discover_hubspot_schema`, `search_crm_objects`, `get_crm_objects`, `query_crm_data`, `search_properties`, `get_properties`, `search_owners`, `search_conversations`, `get_conversation_channel_metadata`, `search_intent_signals`, `get_campaign_attribution_reports`, `read_campaign_data`, `get_marketing_email_analytics`, `get_content_analytics_report`, `get_aeo_metrics`, `tool_guidance`. - `search_conversations` and CRM notes return text written by outsiders (U). T1 and T3 - T1: `get_user_details`, then `get_organization_details`; the portal ID equals `stack.md`. - T3: one known deal's owner, pipeline, stage, amount, currency, close date and record link. Limits and meters - `search_crm_objects`: 5 filter groups, 6 filters per group, 200 results per page. - `get_crm_objects`: 100 IDs per request. `search_owners`: 100 results. `search_properties`: 5 keywords. - Sensitive Data on: calls, emails, meetings, notes, tasks and conversations are blocked through MCP (not through the standard CRM APIs). Traps - Validation differs by client. The Claude connector applies conditional property and pipeline stage validation but not association label validation; the ChatGPT connector applies no custom validation rules, pipeline stage and association label rules included. Both cap bulk create or update at 10 records. Test each client separately (failure F12). - A feature that works in an Enterprise trial or test account may not exist on the production tier. Revocation - The user disconnects the connector; a Super Admin uninstalls the connected app in the portal (verify the path at run time). Vendor tooling - Writes: agent-write-safety. For bulk work, HubSpot's Agent CLI and `hubspot/agent-cli-skills` support `--dry-run`. ## Salesforce Server and status - Hosted standard servers are off until an admin activates them in Setup under API Catalog > MCP Servers, which can take up to 2 minutes. API Catalog lists Developer, Enterprise, Performance and Unlimited editions. - Production reads: `https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads`. Sandbox and scratch orgs: `https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-reads`. - Orgs that block logins from login.salesforce.com or test.salesforce.com use `https://api.salesforce.com/platform/mcp/v1/d//`, with their own sandbox and scratch forms; server names keep the `platform/` prefix. - Other servers: sobject-mutations creates and updates without delete; sobject-deletes deletes; sobject-all is the full set. Mutations and deletes also carry read tools. Clients - Claude Desktop and claude.ai: Customize > Connectors > Add > Add custom connector, with "Use your own OAuth client", the consumer key as the client ID, and the secret blank unless the app requires one. - Claude Code: inherits the claude.ai connection. Article research says a local configuration needs its own localhost callback in the External Client App, but Salesforce's pages list none for Claude Code: verify at run time. - Salesforce publishes ChatGPT, Cursor, Postman and Agentforce Vibes guides. Postman shows raw tool responses, which helps when an answer looks wrong. ChatGPT needs the consumer secret (clients.md). Auth and who can connect - An External Client App (not a Connected App) with the `mcp_api` and `refresh_token` scopes and JWT-based access tokens for named users. - claude.ai callback `https://claude.ai/api/mcp/auth_callback`. A new app can take up to 30 minutes to work (failure F13). - Calls run as the user under object permissions, field-level security and sharing. Read-only layer - Connect only the sobject-reads endpoint, signed in as the pilot user. Never connect sobject-mutations, sobject-deletes or sobject-all for a read-only pass (scanner S06 checks the path). T1 and T3 - T1: ask for the authenticated user and org and compare with Setup. - T3: one known opportunity, then a bounded cohort against a Salesforce report with the same filters and the same user. Limits and meters - The servers are intended only for customers with Flex Credits. The rate is still listed as TBA and agent use is not metered yet, with 30 days' notice promised; sandbox, scratch and Developer Edition orgs are not metered. Count tool calls during the pilot. - Any Salesforce MCP server will need agent registration within three months of notice from Salesforce, for all customers. Salesforce targets November 2026 for the new controls: check the live article before a rollout. Traps - Hosted beta URLs (`v1-beta.2`) must be replaced and reauthorised: beta tokens fail on GA (scanner S02). - The local DX server (`@salesforce/mcp`) reached its end of life on 2026-11-02 and its repository is archived (scanner S02 reports FAIL from that day); developer work moves to `forcedotcom/sf-skills`. - Salesforce in Claude (beta, under the Claudeforce partnership) is a separately packaged experience with its own eligibility. Salesforce's product help says most beta skills are read-only or limited to drafts, and several can create and update records. The Dispatch API setting in Claude decides this: Deny keeps it read only. Its Claudeforce page also describes record updates and email outside the company. Treat it as write-capable until its tool list and T4 prove otherwise. It does not replace a scoped sobject-reads connection. - Marketing Cloud Engagement MCP is a separate product: an installed package with a Public App integration, tenant-specific US or EU endpoints and asynchronous tools. Revocation - Revoke the app's OAuth tokens and deactivate the External Client App when no longer needed (verify the path at run time). Vendor tooling - Approved writes go through agent-write-safety on sobject-mutations (no delete). ## A reproducible pipeline review A connection that passes T1 to T4 can still return a different pipeline answer each week. Fix the request before anyone relies on the review: - Population: one pipeline by ID, closed stages excluded, and the owner or team scope. - Date boundary: an explicit date and time zone (close date before 2026-11-01 in America/New_York), never a bare "overdue". - Fields: record ID, owner, stage, amount, currency, close date, last activity date and next step, with a link to each record. - Order and cap: a stable order (close date, then record ID) and a cap such as 50 records, with a statement of how many were read and whether more remain (T5). - Missing values: deals without a close date are listed separately, never counted as overdue; a missing amount stays unknown. - Action: the agent proposes follow-ups and creates or updates nothing; any change goes through agent-write-safety. Check the selection rule on five known records before the first live run, in a test account or with existing records that match each case: - An open deal with a close date yesterday: included as overdue. - An open deal with a close date tomorrow: excluded. - A closed-lost deal with a close date yesterday: excluded because the stage is closed. - An open deal with no close date: reported as missing. - An open, overdue deal with no amount: included, amount unknown. Five correct results prove the rule for those cases only. Repeat across pages, a restricted record and a second owner before widening access. In Salesforce, compare the cohort with a report that uses the same filters and runs as the same user. ## Other CRMs, briefly From article research on 2026-10-18; verify every endpoint before use, then add it to the registry with the date. - Attio: `https://mcp.attio.com/mcp`, user OAuth. - Pipedrive: `https://mcp.pipedrive.ai/mcp`, OAuth, with plan token allowances. - Zoho CRM: four prebuilt servers; Data Insights is the read-only one. - Dynamics 365: Sales MCP plus Dataverse for records; Microsoft lists Claude Desktop as unsupported.