F
licenseNot graded
qualityD
maintenanceA Type 4 OAuth MCP server that enables AI assistants to interact with HubSpot CRM objects like contacts, companies, deals, and tickets.
-
hubspot-mcp-wrap
Provides an OAuth-protected MCP proxy to HubSpot's remote MCP server, allowing each user to sign in with their own HubSpot account and pass MCP traffic through to HubSpot with their permissions, while keeping HubSpot tokens inside the Worker and restricting access to allowed HubSpot portals.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@hubspot-mcp-wrapcan you list my recent HubSpot contacts?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
hubspot-mcp-wrap
A client's own front door to HubSpot's remote MCP server (mcp.hubspot.com).
HubSpot's MCP server takes OAuth only from a HubSpot MCP auth app holding its client secret, and it has no dynamic client registration. Claude can store a client secret in a custom connector; Codex and most other MCP clients can't. This Worker is an ordinary OAuth-protected MCP server that any client can register with on its own (DCR + PKCE). Behind it, it signs each person in to HubSpot with the app's secret and passes MCP traffic through.
Each person is themselves. They sign in to HubSpot in their own browser; HubSpot attributes every record to them, with their permissions.
Their HubSpot tokens never leave this Worker. They sit encrypted in the props of that person's grant (KV), and are refreshed when the client refreshes. Our access token lives exactly as long as the HubSpot token in it.
Pinned to one portal.
ALLOWED_HUB_IDSrefuses a sign-in to any other HubSpot account.One deployment per client, in that client's Cloudflare account: one wrangler environment each, like the per-client Twenty instances.
Connect
Client | How |
Claude (desktop, web, mobile) | Settings → Connectors → Add custom connector → URL |
Codex |
|
Anything else | Streamable HTTP at |
A browser opens: a consent page here (it warns when access goes to an app on your computer), then HubSpot's sign-in.
Related MCP server: mcp-hubspot
Add a client
In the client's HubSpot: Development → MCP Connectors → create one (or use the existing one). Add the redirect URL
<PUBLIC_URL>/callback.In the client's Cloudflare account:
npx wrangler kv namespace create hubspot-mcp-oauth.Copy the
env.exampleblock inwrangler.jsonctoenv.<client>, with its KV id,PUBLIC_URL,LABEL,HUBSPOT_CLIENT_ID,ALLOWED_HUB_IDS.npx wrangler deploy --env <client>, then the two secrets:HUBSPOT_CLIENT_SECRET(from the client-stack.env) andCONSENT_SECRET(48 random characters; it only signs the "don't ask again" cookie, so rotating it just brings the consent page back).
License
Apache-2.0. See LICENSE. Keep NOTICE in any copy or fork: it credits The Lossless Group.
This server cannot be deployed
Maintenance
ActivityMaintained
ResponsivenessNo issues
Related MCP Connectors
The HubSpot MCP Server acts as a bridge that enables AI assistants and Large Language Models to securely interact with HubSpot CRM data through natural conversation, without requiring users to understand complex API structures. It provides read-only access to standard CRM objects (contacts, companies, deals, tickets, products, invoices, and more) and their associations, secured via OAuth 2.0, allowing AI agents to perform tasks like summarizing deals, fetching company updates, and looking up record changes.
Self-hosted federated MCP gateway: one OAuth 2.1 MCP server in front of N apps, user-level scopes.
One OAuth connector for your team's remote MCP servers, with Tool Packs, guardrails and logs.
- StytchOAuthdev.stytch.mcp
The Stytch MCP server is a reference implementation that demonstrates remote MCP server authentication and authorization using Stytch Connected Apps. It provides OAuth 2.1-compliant authorization (including PKCE), Dynamic Client Registration, and validates Stytch-issued access tokens to enable AI agents to securely interact with external services through permissioned access, supporting scopes like openid, email, profile, and manage:project_data.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceAn MCP server that uses a browser extension to interact with HubSpot through the logged-in browser, enabling reading, searching, creating, and updating HubSpot records without API tokens.8 npm-
- AlicenseNot gradedqualityBmaintenanceEnables clients to access multiple backend MCP servers through a single endpoint, with OAuth 2.1 authorization, namespaced tools, and secure credential management.2MIT
- AlicenseNot gradedqualityBmaintenanceProvides a single MCP server endpoint that lets AI agents connect to many real third-party services through OAuth, with user approvals, activity logs, scoped read/write grants, and one-tap access removal.17 npmAGPL 3.0
