HubSpot

HubSpot ships its own remote MCP at mcp.hubspot.com(GA April 2026), and ShopMCP can route to it as a fallback. But HubSpot’s MCP exposes three generic CRM verbs (search / get / manage) plus a small campaign-analytics surface — roughly 10–15% of HubSpot’s API. Workflows, marketing email send, HubDB, files, custom-object detail, conversations, and webhooks are not covered. Our native integration closes those gaps with typed per-object tools and full Marketing + CMS Hub coverage, and adds the cross-integration playbooks no vendor MCP can match.

In HubSpot, go to Settings → Integrations → Private apps → Create private app. If your account hasn’t enabled private apps yet, you’ll see a one-time consent prompt — accept it to continue. Name the app ShopMCP. Pick the scope recipe that matches how you intend to use the integration:

• CRM operator (read-only) — grant the crm.objects.*.read set across contacts, companies, deals, tickets, products, line_items, quotes, invoices, custom; plus crm.schemas.*.read, crm.lists.read, and tickets. Registers all 79 read tools.
• + Marketing operator — add content, marketing-email, forms, files, hubdb, automation, and marketing.campaigns.read. Unlocks Marketing Hub + CMS Hub reads (Marketing Hub Pro/Enterprise required for some endpoints).
• + Operator with writes — add the matching *.write scopes per object family you want to mutate. Required for the 58 write tools (CRM CRUD, send transactional email, enroll contacts in workflows, publish CMS pages, write HubDB rows, etc.).

Click Create app and copy the access token — it starts with pat- followed by your region code (na1, eu1, etc.) and a UUID. HubSpot shows the full token once on creation; store it somewhere safe before navigating away.

Open Settings → Integrations → HubSpot and paste the token. We validate it with two round-trips:

• GET /account-info/v3/details — fetches your portal id, account type, Hub tier, time zone, and currencies.
• GET /oauth/v2/private-apps/get/access-token-info— fetches the scope set you granted, plus your portal’s hub domain (used as the connection display label).

The token is stashed in encrypted storage — it never leaves your workspace and never gets logged. If a write tool later fails because a scope is missing, the error message names the exact scope you need to add, and you can rotate the token in HubSpot without re-entering it here (private app tokens are stable across rotations of any one scope).

Flip Allow writes on the same settings page when you want the 58 write tools active. Defaults to off — even an operator-recipe token cannot modify HubSpot data until this toggle is on. Each write tool also asks the assistant to confirm with you before firing.

Private app tokens are scoped to a single HubSpot portal — there’s no equivalent of an MCA across portals. If you manage multiple portals (typical for agencies on our Team / Agency tiers), mint one private app token per portal and connect each as its own ShopMCP connection. When two or more are active, every hubspot_* tool gets a store parameter that targets a specific portal — primary is the default.

When a HubSpot portal has Sensitive Data turned on (Settings → Privacy & Consent → Sensitive Data), HubSpot’s API blocks engagement objects (calls, emails, meetings, notes, tasks) entirely — every read returns 403. Our activity tools register universally; they fail cleanly with a “Sensitive Data restriction” error message at call time rather than going silently missing. CRM object tools, marketing tools, and CMS tools are unaffected.