hubspot-mcp (tillheidrich/hubspot-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 57 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Emerging
74/100

hubspot-mcp

Run HubSpot from Claude, Codex or Cursor: pages, blog, forms, emails, campaigns — and CRM only if you switch it on. With ALLOW_CRM=none (the default) no customer data is reachable, so none can reach the model. 65 tools, publishing gated per area, every consequential call confirmed. Local, MIT, your key never leaves the machine.

→ tillheidrich/hubspot-mcp· listed on github_repo_search

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

tillheidrich

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes65 tools · 8 behind config

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_blogs

List the blog instances in the portal, e.g. a marketing blog and a tech blog.

list_blog_posts

List blog posts.

get_blog_post

Fetch one blog post.

create_blog_post_draft

Create a new blog post in DRAFT state.

update_blog_post_draft

Patch a blog post's DRAFT. The published version is never touched.

reset_blog_post_draft

Discard draft changes on a blog post and restore the live version.

list_campaigns

List marketing campaigns with their dates and goals.

get_campaign

Read one campaign. Pass `properties` for metrics beyond the basics.

list_campaign_assets

List the assets attached to a campaign.

create_campaign

Create a campaign.

update_campaign

Update campaign properties. Only the keys you pass change.

attach_asset_to_campaign

Attach a page, post, email or form to a campaign.

detach_asset_from_campaign

Remove an asset from a campaign. The asset itself is untouched.

search_crm_objects

Search CRM records.

get_crm_object

Read one CRM record.

list_crm_properties

List the properties defined on an object type.

list_crm_associations

List records of `to_type` linked to one record of `from_type`.

list_crm_owners

List HubSpot users who can own records. Optionally filter by email.

list_crm_pipelines

List pipelines and their stages for deals or tickets.

search_crm_lists

Find contact lists by name. Use the ID with the marketing email tools.

list_workflows

List automation workflows with their enabled state.

get_crm_import_status

Check how a CRM import is going.

create_crm_object

Create a CRM record.

update_crm_object

Update properties on one CRM record. Only the keys you pass change.

batch_update_crm_objects

Update up to 100 records in one call.

associate_crm_objects

Link two records with HubSpot's default association label.

remove_crm_association

Unlink two records. The records themselves are untouched.

create_crm_list

Create a manual list. 0-1 is contacts, 0-2 companies.

add_records_to_list

Add records to a manual list.

remove_records_from_list

Remove records from a manual list. The records are not deleted.

create_crm_property

Define a new property on an object type.

archive_crm_object

Move a CRM record to the recycle bin.

set_workflow_enabled

Turn a workflow on or off.

list_templates

List CMS templates available in the portal.

list_domains

List domains connected to the portal.

list_blog_authors

List blog authors, for setting `author_id` on a blog post draft.

list_marketing_emails

List marketing emails.

get_marketing_email

Fetch one marketing email.

create_marketing_email_draft

Create a marketing email in DRAFT state. Nothing is scheduled or sent.

update_marketing_email_draft

Patch a marketing email's DRAFT. The published version is never touched.

duplicate_marketing_email

Duplicate a marketing email — the usual way to start next month's newsletter.

list_forms

List forms in the portal.

get_form

Fetch one form.

create_form

Create a HubSpot form.

update_form

Patch a form.

duplicate_form

Duplicate a form — the usual way to make a second-language variant.

list_landing_pages

List landing pages.

list_site_pages

List site pages. Same filters as list_landing_pages.

get_page

Fetch one landing or site page.

create_landing_page_draft

Create a new landing page in DRAFT state.

create_site_page_draft

Create a new site page in DRAFT state. Same arguments as create_landing_page_draft.

update_page_draft

Patch a page's DRAFT. The published version is never touched.

reset_draft

Discard draft changes and restore the draft to match the live version.

duplicate_page

Duplicate an existing page as a new DRAFT, optionally applying overrides.

create_language_variant

Create a language variant of an existing page, e.g. EN from a DE page.

cancel_scheduled_publish

Cancel a pending scheduled publish.

generate_social_bulk_xlsx_file

Write a HubSpot-format Excel file for scheduling social posts in bulk.

publish_pagebehind config

Take a landing or site page live on the public website, now.

schedule_page_publishbehind config

Schedule a landing or site page to go live at a future time.

unpublish_pagebehind config

Take a live page down. It returns to draft; nothing is deleted.

publish_blog_postbehind config

Take a blog post live on the public blog, now.

schedule_blog_post_publishbehind config

Schedule a blog post to go live at a future time.

unpublish_blog_postbehind config

Take a live blog post down. It returns to draft; nothing is deleted.

publish_marketing_emailbehind config

Send a marketing email, or schedule it per its own settings.

unpublish_marketing_emailbehind config

Withdraw a marketing email that has not gone out yet.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configHUBSPOT_MCP_ENV_FILE, and enable the second one only for the session where
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

65/65 tools missing one or more hints — list_blogs (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_blog_posts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_blog_post (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +62 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/tillheidrich/hubspot-mcp)](https://m8ven.ai/mcp/tillheidrich/hubspot-mcp)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 36022b06fa8efe0d731498ca42e40c25d571e570
code hash: 0f150c99c61d1ffbd0b5f7d573ccd4c8aa77a9a56e776c8146d3ffe266d8080b
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client