# HubSpot MCP Server

> HubSpot MCP Server is an officially published MCP server from HubSpot. Anomity scores its risk at 20 out of 100 (low).

- **Canonical URL:** https://catalog.anomity.ai/mcp/hubspot-mcp-server
- **Kind:** MCP server
- **Publisher:** HubSpot
- **Trust level:** official
- **Risk score:** 20/100 (low)
- **Website:** https://developers.hubspot.com/mcp
- **Documentation:** https://developers.hubspot.com/mcp
- **Last updated:** 2026-09-02
- **JSON:** https://catalog.anomity.ai/api/entries/mcp/hubspot-mcp-server

## Description

HubSpot's official server exposes CRM objects and records — contacts, companies, deals, and their properties — so an agent can answer questions about a pipeline or update records from a conversation.

This is personal data by definition, which makes it the highest-compliance-consequence connector in this list even though its technical capabilities are just outbound network and credential access. Any CRM record an agent reads is customer personal data entering a model context, with whatever retention and residency implications that carries for you. Decide that question before connecting, scope to the objects and properties needed, and prefer read-only for assistants used for analysis.

## Why it scored 20

The score starts at the catalog's neutral base of 50 and moves only through the signals below. The formula is published at https://catalog.anomity.ai/about — there is no model and no hidden heuristic.

| Signal | Contribution | Severity | Evidence |
| --- | --- | --- | --- |
| Published by the vendor | -40 | trust offset |  |
| 1 high-risk capability: credentials:access | +10 | high |  |

Clamped result: **20/100**, band **low**.

## Capabilities

| Capability | Name | Security implication |
| --- | --- | --- |
| `network:outbound` | Outbound network | Can make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access. |
| `credentials:access` | Credentials access | Reads provider API keys, OAuth tokens, or other secrets from the host keychain or environment. |

## Related MCP servers

- [Airtable MCP Server](https://catalog.anomity.ai/mcp/airtable-mcp-server) — risk 45 (medium)
- [Cloudflare MCP Server](https://catalog.anomity.ai/mcp/cloudflare-mcp-server) — risk 45 (medium)
- [ElevenLabs MCP Server](https://catalog.anomity.ai/mcp/elevenlabs-mcp-server) — risk 45 (medium)
- [MiniMax MCP Server](https://catalog.anomity.ai/mcp/minimax-mcp-server) — risk 45 (medium)
- [MongoDB MCP Server](https://catalog.anomity.ai/mcp/mongodb-mcp-server) — risk 45 (medium)
- [Neon MCP Server](https://catalog.anomity.ai/mcp/neon-mcp-server) — risk 45 (medium)

---

Source: Anomity Catalog (https://catalog.anomity.ai/). Scoring methodology: https://catalog.anomity.ai/about. Machine-readable index: https://catalog.anomity.ai/llms.txt · https://catalog.anomity.ai/openapi.json