{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:27:53.457Z", "record_id": "VXI-EXT-TOOL-TRUST-HUBSPOT-01-v1", "record_kind": "external_reference", "title": "HubSpot MCP: CRM visibility and content publication", "system": "HubSpot remote MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "What should an agent check before treating a CRM connector's search results as complete or allowing publication?", "near_questions": [ "Can a CRM connector miss records because sensitive-data access is blocked?", "Does HubSpot MCP support publishing website content?", "What does HubSpot Sensitive Data disable for MCP?", "Does a missing CRM search result prove there are no records?", "Who selects the scopes for a HubSpot MCP connector?", "Do updated HubSpot scopes need a new installation grant?", "Does HubSpot MCP authentication require PKCE?", "Are HubSpot developer MCP and remote CRM MCP the same?", "Can subscription level change the available CRM tools?", "What should an agent check before exporting customer details?", "What does a saved HubSpot review preserve?", "Does this profile inspect my HubSpot account settings?" ], "supported_claims": [ { "claim": "HubSpot's hosted MCP can read CRM content and perform permitted updates, including some publishing actions. Access depends on the user, subscription, granted tools and account configuration. With Sensitive Data enabled, the documented MCP restrictions block activity and conversation data. Missing results therefore do not establish that no records exist. New scopes require a renewed installation grant.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "HubSpot's hosted MCP can read CRM content and perform permitted updates, including some publishing actions. Access depends on the user, subscription, granted tools and account configuration. With Sensitive Data enabled, the documented MCP restrictions block activity and conversation data. Missing results therefore do not establish that no records exist. New scopes require a renewed installation grant.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-SLACK-01-v1", "VXI-EXT-TOOL-TRUST-ASANA-01-v1", "VXI-EXT-TOOL-TRUST-FIGMA-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "HubSpot remote MCP data and permissions", "source_url": "https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-HUBSPOT-01-v1", "candidate_record_sha256": "e2ad14704be7d1d803180a3b7b21ea2ffea90d6732709b4d97983196543aefd4", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "HubSpot's hosted MCP can read CRM content and perform permitted updates, including some publishing actions. Access depends on the user, subscription, granted tools and account configuration. With Sensitive Data enabled, the documented MCP restrictions block activity and conversation data. Missing results therefore do not establish that no records exist. New scopes require a renewed installation grant.", "required_buyer_context": "HubSpot's remote account-data MCP; not the separate local developer MCP for building HubSpot apps. Sensitive Data setting, installed grants, subscription, inbox restrictions and client retention.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "HubSpot remote MCP", "variant": "HubSpot's remote account-data MCP; not the separate local developer MCP for building HubSpot apps." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "HubSpot operates the remote MCP service.", "source_ids": [ "hubspot-main" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Query CRM information and perform supported business-content changes.", "source_ids": [ "hubspot-main" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "CRM and marketing data are available subject to account restrictions; Sensitive Data blocks activities and conversations.", "source_ids": [ "hubspot-main" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Supported tools update CRM objects and can create, edit or publish web content.", "source_ids": [ "hubspot-main" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "The connector uses OAuth with PKCE.", "source_ids": [ "hubspot-main" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "User rights and installation grants apply; changed scopes require reinstalling to grant them.", "source_ids": [ "hubspot-main" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Customer information reaches the external client; minimize fields and check its recipients.", "source_ids": [ "hubspot-main" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Mistaking blocked data for no data, publishing during analysis, or confusing local developer and remote CRM tools.", "source_ids": [ "hubspot-main", "hubspot-release" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Sensitive Data setting, installed grants, subscription, inbox restrictions and client retention.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Withhold publication or CRM changes during analysis; label results incomplete when access is unresolved.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "hubspot-main", "url": "https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server", "final_url": "https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server", "title": "HubSpot remote MCP data and permissions", "checked_on": "2026-10-11", "sha256": "1e59f386b4a60c37e193d43624765435c48ced7ecd2f0f531697736b0d11f6b2", "bytes": 1568930 }, { "source_id": "hubspot-release", "url": "https://developers.hubspot.com/changelog/spring-2026-spotlight", "final_url": "https://developers.hubspot.com/changelog/spring-2026-spotlight", "title": "HubSpot remote and developer MCP release distinctions", "checked_on": "2026-10-11", "sha256": "b765683c6fe5fbb14704e75cb565321226d30c66714426f4f3580c3048cef343", "bytes": 258589 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Save the documented visibility and publication limits behind a CRM integration review.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Recheck installation grants, Sensitive Data configuration and tool availability after account or subscription changes." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#hubspot-mcp-crm-disclosure-trust", "machine_readable_record": "/varexis-index/records/hubspot-mcp-crm-disclosure-trust.json" }