Claude with HubSpot or Salesforce via MCP and how to set it up safely

Running Claude with HubSpot or Salesforce via MCP means letting Claude read, and sometimes change, records in your CRM from inside a chat. MCP, the Model Context Protocol, is an open source standard for connecting AI tools to other software. Anthropic's documentation describes it as the way Claude reaches hundreds of external tools and data sources.

Once the connection is in place, Claude can read and update contact records, log meeting notes and create deals within the chat, according to CData's 2026 guide. That is useful. It also means an AI tool now has a route into the system that holds your customer relationships and your forecast.

This guide is for teams whose CRM is not Zoho. If you run Zoho CRM, our step-by-step guide to connecting Claude to Zoho CRM with MCP covers that path. Here we cover the decisions that matter whichever CRM you use: which connector to pick, who has to approve it, what Claude may read, what it may write, and which work stays with people.

The product facts come from HubSpot, Salesforce, Anthropic and the other sources listed at the end. Check them against your own account before you act, because both vendors change these products often.

An MCP server is a small piece of software that exposes a system, such as your CRM, in a form an AI tool can use. The client is the application you talk to, such as Claude on the web, Claude Desktop or Claude Code. Anthropic notes that MCP servers are not tied to one client, so setup instructions may be written for Claude Desktop, Cursor or another MCP client.

According to Coffee's integration guide, a server offers three kinds of building block that Claude discovers at runtime:

• Resources: read-only data, such as a list of open deals.
• Tools: actions, such as updating a deal stage.
• Prompts: reusable templates for common requests.

The transport is how client and server talk. Anthropic recommends HTTP servers for remote connections, calling it the most widely supported transport for cloud services. The older SSE transport is deprecated. A stdio server runs as a local process on your own machine, which suits custom scripts but not a shared CRM.

For HubSpot and Salesforce, both cloud systems, you will normally use a remote HTTP connector. Coffee also makes a point worth planning around: once an MCP server exists for a tool, every AI application in your organisation can reuse it instead of rebuilding the integration. Choose that server carefully, because it will outlast your first use case.

HubSpot

HubSpot offers its own connector for Claude, set out in the HubSpot connector help article. It supports view, create and update actions but not delete. diginomica reports that the data is limited to core CRM objects: contacts, companies, deals, tickets and their associations. It also notes that Claude can create visualisations of that data.

Separately, HubSpot has its own MCP Server, still in beta when diginomica reported on it. It requires a private app in HubSpot, which issues an access token for the connection. That route gives you finer control over what users can do, including actions in HubSpot, but you now own a credential that must be protected.

Salesforce

Salesforce documents hosted MCP servers in its help centre, and admins connect Claude to them. Salesforce also announced Salesforce in Claude, a plugin that gives sellers 37 pre-built skills. Salesforce says it reaches data through Headless 360, which exposes data, workflows, business logic and permissions through a secure MCP connection, governed with MuleSoft. At the time of the announcement it was open to select pilot customers, with an open beta planned from September.

Third-party routes

Integration vendors such as CData offer their own MCP connectors that sit between Claude and the CRM. For tools with no MCP server, Coffee describes sending Claude's structured output to a Zapier webhook instead.

Settle the prerequisites before anyone promises a demo. Most delays come from these, not from the AI.

On the Claude side

HubSpot requires a paid Anthropic subscription: Pro, Max, Team or Enterprise. On business plans, organisation settings also decide what users see. Anthropic's page on Google Workspace connectors shows the pattern: on Team and Enterprise plans, an Owner or Primary Owner enables those connectors at organisation level before anyone can authenticate. Check your own settings first.

On the HubSpot side

Super Admins and users with App Marketplace Access can connect without prior approval. Everyone else needs a Super Admin to approve the connector first. HubSpot also warns that external agencies or consultants holding those permissions can connect it in your account, so review that list. Only one HubSpot account can be connected to a single Claude account at a time.

On the Salesforce side

CData advises confirming you are on Enterprise edition or higher, because Professional does not expose the API access third-party integrations need. Setup needs System Administrator access. Both CRMs cap API requests: CData cites about 1,000,000 calls per day for a 50-user Enterprise org, and says workflows stall or fail when you exceed the limit.

Allow time for authentication problems. On r/salesforce, an admin reported an oath_approval_error_generic error after following Salesforce's documentation, despite holding the approve uninstalled apps permission.

Both vendors say the connection respects existing permissions. HubSpot states that users only see in Claude the CRM data they are allowed to access in HubSpot. Salesforce says every answer and action in Salesforce in Claude runs through your existing permissions and business rules, and that you control how much write autonomy Claude has. That makes your CRM permission model the real security boundary. If it is loose today, Claude inherits the looseness.

HubSpot recommends setting the connector's write tools to Needs Approval. Under Always allow, edits may happen without anyone confirming them. Create and update actions are recorded in the HubSpot Audit Log and attributed to both the user and the Claude connector, so you can trace every change afterwards.

At Svennis we run every new CRM connection read-only first, and switch on write tools for one named process only after the team has checked a sample of Claude's answers against the records themselves. The check almost always turns up a field the team reads differently from how the data is actually stored, and it is far cheaper to find that before Claude starts writing.

One HubSpot detail affects what reading even means. If your account has Sensitive Data turned on, Claude cannot access any engagement data. Decide whether that trade-off suits the process you have in mind before you plan around call or email history.

Take a sales manager at a firm on a Claude Team plan and HubSpot. The goal is a weekly pipeline review that currently takes an afternoon of exports. Here is how the setup runs, using the settings from the sources.

1. Approve. A Super Admin approves the HubSpot connector for Claude, so the manager can connect without App Marketplace Access.
2. Connect. In Claude.ai, the manager opens Settings, then Connectors, uses Browse Connectors to find HubSpot and connects the account. Only one HubSpot account can be linked.
3. Restrict. The write tools are set to Needs Approval before the first prompt.
4. Read. For the first weeks, prompts are read-only, for example: "List open deals in the Proposal stage with no logged activity this month, with owner, amount and close date."
5. Verify. The manager picks a handful of deals from Claude's answer and checks them in HubSpot directly.
6. Write once. Following CData's advice, the first write is a single record: changing one deal stage. The manager approves it and confirms the Audit Log shows both user and connector.
7. Scale carefully. Bulk creates or updates run at most 10 records at a time. Deletes are not supported and stay manual.

The result is a review the manager can ask for in plain language, with a chart if needed, while every change still passes through a human click. Nothing in this flow needs code.

Claude sees field names and values. It does not know your conventions: that "Close date" is only trusted after a certain stage, or that a custom property holds the real renewal date. Field mapping here means writing down which field answers which business question, so Claude reads the right one.

CData lists the common problems when linking Salesforce to Claude: data discrepancies between systems, API limits tied to your edition, and identity resolution when joining records across platforms. The last one matters if you ask Claude to combine CRM data with another source, because the same customer may appear under different names or IDs.

A short glossary solves most of this:

• What each deal stage means and what must be true to enter it.
• Which owner, date and value fields are authoritative.
• Which custom properties are retired and should be ignored.

Keep the glossary where Claude reads it every time, such as project instructions. Our guide to Claude Projects and Skills for a small team shows how.

Two technical limits are worth knowing. Coffee notes that structured outputs guarantee the shape of data, not its accuracy, so values can still be wrong when source data is ambiguous. And Claude Code warns when an MCP tool returns over 10,000 tokens and caps output at 25,000 by default, so ask for filtered lists rather than whole tables.

Connecting Claude to a CRM is not a project in itself. Pick one process with a clear owner, a clear output and a low cost of error. Grow from there once the team trusts the answers. The table sorts common candidates by risk.

If your team already works in Claude Cowork, the same rule applies there. Our guide on how to use Claude Cowork for your business covers how to fit connected tasks into daily work.

Some decisions should not move to Claude, however good the first results look. Keep these with named people:

• Deletes and merges. HubSpot's connector does not support deletes. Treat that as a sensible default for any CRM.
• Bulk changes. Approve each batch and spot-check the result in the CRM.
• Anything sent to a customer. Anthropic's Gmail connector asks for approval before sending, replying or forwarding by default. Apply the same rule to CRM-driven emails.
• Commercial judgement. Discounts, forecast calls and account priorities.

There is also a security reason to keep a person in the loop. Anthropic warns that MCP servers fetching external content can expose you to prompt injection, where text inside the data carries instructions. CRM records often hold text written by outsiders: form entries, email bodies, ticket descriptions. Approval on write tools stops a planted instruction from quietly changing records.

If you use HubSpot's MCP Server with a private app token, protect that token. Coffee advises pulling secrets from a manager such as AWS Secrets Manager or HashiCorp Vault, and avoiding API keys in environment variables in production.

For a UK company, before you connect a production CRM, answer four questions in writing: where the data goes, who can see it, whether it trains a model, and whether your Claude plan comes with data processing terms your business can sign.

Location. HubSpot says data centre location is respected, and requests from EU-hosted accounts are routed through its EU data centre. But once Claude reads a record, a copy sits with Anthropic, so check where Anthropic processes it and which transfer mechanism covers that transfer from the UK. For Salesforce, confirm the equivalent with your admin, because the Salesforce page cited here gives no comparable statement.

Retention. Anthropic's help page on its Google Workspace connectors says retrieved data is stored on Anthropic servers with the chat; confirm with Anthropic whether the same applies to CRM connectors and how long deleted chats are kept. HubSpot adds that, when its MCP server is used, it may collect summaries of tool calls, including the request's intent and whether it succeeded. Both belong in your records of processing.

Training. diginomica reports that Claude does not use data shared through HubSpot to train its models unless a user permits it, for example by opting into training or giving feedback. Anthropic's Google page adds that, in consumer products, pasted content may be used if training is allowed. That is a reason to run CRM work on a business plan.

Coffee notes that regulated industries also check data protection law and ISO 27001; for a UK business that means the UK GDPR and the Data Protection Act 2018. Our GDPR checklist for Claude walks through what to confirm before deployment.

You can do most of this preparation in a week of short sessions, before anyone connects anything.

1. Confirm the basics. Check your Claude plan, your organisation's connector settings and, for Salesforce, your edition and API allowance.
2. Audit admin rights. List every HubSpot Super Admin and App Marketplace Access holder, or every Salesforce System Administrator, including outside agencies.
3. Pick one process. Choose a read-only task from the table, with a named owner.
4. Write the field glossary. Record what each stage and key field means, and load it into the project Claude uses.
5. Lock writes. Set write tools to approval, then test a single record change and confirm it appears in the audit log.
6. Review before widening. After a few weeks, compare Claude's answers with the CRM and decide whether to add a write step.

If you want to see how this approach fits alongside the other tools your team uses, read our guide to putting Claude to work inside the tools you already use. It covers where a CRM connection sits among email, documents and service desk work, and which step to take first.