Sign in

HubSpot

10 reviewed Dtwo policies for HubSpot MCP servers — egress + ingress controls for governing what AI agents can do with HubSpot.

On this page
  1. Available policies
  2. Tool naming on the DTwo gateway
  3. Identity claims
  4. Contributing
  5. Ingress policies (9)
  6. Egress policies (1)

Reusable DTwo policies for HubSpot MCP servers — the HubSpot-hosted remote MCP server that the Claude connector uses, plus the older @hubspot/mcp-server local beta and the broader community servers (@shinzolabs/hubspot-mcp, baryhuang/mcp-hubspot). These families use three incompatible tool vocabularies for the same CRM (hubspot-* kebab-case, bare snake_case verbs like search_crm_objects / manage_crm_objects, and shinzo's {domain}_{operation} names), so the policies below match by tool-name suffix to stay portable. Its risk profile is dominated by PII/PHI at scale and irreversible business writes: contact, company, and deal records concentrate names, emails, phones, and addresses, and search/list pagination is a bulk-export channel; deal-stage and lifecycle edits fire live workflow automation; and while the official servers expose no delete, the shinzo community server adds destructive *_archive and consent-destroying unsubscribe tools.

Available policies

Policy Direction Purpose Framework bundles
block-deal-closure ingress Deny CRM-object calls that move a deal into a closed stage (closedwon / closedlost); all other deal changes and tools pass through. soc2, sox
protect-associations ingress Deny CRM-object calls that create or change object associations (deal↔company, contact↔company, etc.); all other calls pass through. soc2, gdpr-ccpa, sox
protect-deal-owner ingress Deny deal-update calls that set or change hubspot_owner_id; deal creates and other fields pass through. soc2, sox
protect-lifecycle-stage ingress Deny contact create/update calls that set or change lifecyclestage; all other calls pass through. soc2, gdpr-ccpa
read-only ingress Block all HubSpot writes (the *-manage-crm-objects tool); read/search/list tools pass through. soc2, hipaa, pci-dss, gdpr-ccpa, sox
role-gate-writes ingress Gate every HubSpot write tool behind an IdP crm-writers group; read-only by default, fail-closed on missing claims. soc2, hipaa, pci-dss, gdpr-ccpa, sox
role-gate-schema-consent ingress Reserve the two highest-blast-radius write classes — portal-schema (property-definition) edits and marketing-consent mutations — for a hubspot-admins group. soc2, gdpr-ccpa
freeze-destructive-ops ingress Deny every archive/delete/void/purge-class tool plus the consent-destroying contact unsubscribe; no identity exemption. soc2, hipaa, gdpr-ccpa, sox
cap-bulk-export ingress Clamp bulk-read page size to 50 and truncate ids-style batch reads (transform-only) to cut off the mass-PII export channel. soc2, hipaa, gdpr-ccpa
redact-pii egress Redact contact PII (phone, email, fax, SSN) from HubSpot tool responses to [REDACTED]. Transform-only — never denies. soc2, hipaa, gdpr-ccpa

All policies also belong to the thematic bundles/crm bundle.

Tool naming on the DTwo gateway

DTwo prefixes tool names with the MCP server name configured on the gateway. A HubSpot MCP server registered as hubspot surfaces tools like hubspot-manage-crm-objects, while one registered under another name (e.g. hubspot-mcp) would surface hubspot-mcp-manage-crm-objects. The policies in this directory match on the suffix (-manage-crm-objects, _create_property, _archive, etc.) so they stay portable across the remote, local-beta, and community naming conventions — but the remote server collapses all writes into one tool (manage_crm_objects), so create-vs-update and which-object distinctions can only be made by inspecting arguments. Always confirm the exact tool name your gateway sends using the dump-input debug technique before deploying.

Identity claims

Most of these policies are single-purpose and require no IdP claims. The identity-gated ones (role-gate-writes and role-gate-schema-consent) read input.subject.claims.groups with placeholder group names (crm-writers, hubspot-admins). Replace these with your own IdP group names at import time. The group check is fail-closed: a missing subject.claims, missing groups, or a non-list-of-strings groups claim denies the gated write — a missing claim never grants access.

Contributing

To add a HubSpot policy:

  1. Create apps/hubspot/<policy-slug>/ with policy.md and a tests.yaml test file.
  2. Add a row to the table above.
  3. Declare apps: ["hubspot"] in the policy frontmatter, plus any industry / bundle slugs that apply.
  4. If the policy fits an industry or bundle (e.g. bundles/crm), link to it from the matching landing page.
  5. Run pnpm manifest from the repo root.

See CONTRIBUTING.md for the full process.

Ingress policies (9)

HubSpot Block Deal Closureingress · HubSpotBlocks HubSpot CRM-object calls that move a deal into a closed stage (closedwon or closedlost). Both create and update requests are inspected.HubSpot Cap Bulk Exportingress · HubSpotClamps the page size of HubSpot bulk-read tool calls before they reach the HubSpot MCP server, so a single agent request to a covered bulk-read tool can…HubSpot Freeze Destructive Opsingress · HubSpotBlocks every archive/deletion-class HubSpot tool call, plus the consent-destroying contact unsubscribe, before it reaches the MCP server.HubSpot Protect Associationsingress · HubSpotBlocks HubSpot CRM-object calls that create or change associations between objects (deal↔company, contact↔company, etc.).HubSpot Protect Deal Owneringress · HubSpotBlocks HubSpot CRM-object update calls that set or change a deal's owner.HubSpot Protect Lifecycle Stageingress · HubSpotBlocks HubSpot CRM-object calls that set or change a contact's lifecycle stage.HubSpot Read-Onlyingress · HubSpotMakes the HubSpot connection read-only by blocking the write tool.HubSpot Role-Gate Schema and Consentingress · HubSpotSits one privilege tier above hubspot/role-gate-writes: ordinary crm-writers can create and edit CRM records, but two higher-blast-radius write classes are…HubSpot Role-Gate Writesingress · HubSpotGates every HubSpot write tool behind an IdP group: callers whose JWT groups claim contains crm-writers may create and update CRM records; everyone else gets…

Egress policies (1)

HubSpot Redact PIIegress · HubSpotRedacts sensitive contact information from HubSpot tool responses before they reach the caller.
Updated

↑↓ to navigate ↵ to open