HubSpot Custom MCP connector for Power Platform

February 20, 2026

HubSpot has a remote MCP server in beta. It connects AI assistants to your CRM data through OAuth 2.1 with PKCE. The problem: Power Platform custom connectors don’t support OAuth 2.1 with PKCE. The authorization code flow works, but the PKCE challenge/verifier exchange that HubSpot’s MCP server requires isn’t available in the connector security. So instead of waiting for that support, this connector calls the HubSpot APIs directly. Standard OAuth 2.0 authorization code flow, no PKCE dependency, and full CRUD across the CRM objects you actually need—not just the read-only access that HubSpot’s remote MCP server currently provides. Yeah, that’s a strike against the HubSpot-hosted MCP, too.

You can find the complete code in my SharingIsCaring repository.

The result is 36 MCP tools that a Copilot Studio agent discovers automatically. Create companies, enroll contacts in sequences, log emails, manage deals through pipeline stages, and work with custom objects—all through natural language.

Why not the HubSpot-hosted MCP server?

Two reasons:

1. OAuth 2.1 with PKCE: HubSpot’s remote MCP server at https://mcp.hubspot.com requires PKCE for authentication. Power Platform custom connectors support OAuth 2.0 authorization code flow but don’t handle the PKCE code challenge and verifier exchange.
2. Read-only access: The HubSpot MCP server currently supports read-only access to CRM objects. This connector provides full CRUD—create, read, update, and delete—for companies, deals, emails, tasks, and custom objects, plus sequence enrollment.

What’s included

Companies (6 tools)

Sales reps / owners (2 tools)

Emails (6 tools)

Sequences (3 tools)

Tasks / reminders (6 tools)

Deals / contract lifecycles (6 tools)

Custom objects (8 tools)

Search operators

All search tools support these filter operators:

• EQ — Equal to
• NEQ — Not equal to
• LT / LTE — Less than / less than or equal
• GT / GTE — Greater than / greater than or equal
• CONTAINS_TOKEN — Contains token
• NOT_CONTAINS_TOKEN — Does not contain token

Key properties by object

Companies: name, domain, industry, phone, city, state, country, numberofemployees, annualrevenue, hubspot_owner_id

Emails: hs_email_subject, hs_email_text, hs_email_direction (EMAIL_SENT / EMAIL_RECEIVED), hs_timestamp, hs_email_status

Tasks: hs_task_subject, hs_task_body, hs_task_status (NOT_STARTED / IN_PROGRESS / COMPLETED / DEFERRED), hs_task_priority (LOW / MEDIUM / HIGH), hs_timestamp, hubspot_owner_id

Deals: dealname, dealstage, pipeline, amount, closedate, hubspot_owner_id, description

Setup

1. Create a HubSpot OAuth app

Option A — HubSpot CLI:

The hubspot-app/ subfolder contains a pre-configured HubSpot project with all scopes and the redirect URL set up. Install the CLI, authenticate, and upload:

npm install -g @hubspot/cli
cd hubspot-app
hs auth
hs project upload

After uploading, go to HubSpot Settings > Integrations > Private Apps > HubSpot Custom MCP to copy the Client ID and Client Secret.

Note: HubSpot CLI v8 uses the Ink library for terminal rendering and doesn’t produce output in the VS Code integrated terminal. Run these commands in a standalone PowerShell or Windows Terminal window.

Option B — Developer portal:

1. Go to app.hubspot.com > Settings > Account Setup > Integrations > Private Apps
2. Create a new app and select the required scopes
3. Under Auth > Redirect URLs, add your connector’s redirect URL (from step 5)
4. Copy the Client ID and Client Secret

2. Update the connector files

In apiProperties.json, replace [[REPLACE_WITH_HUBSPOT_CLIENT_ID]] with your app’s Client ID.

3. Deploy the connector

pac connector create \
  --api-definition-file apiDefinition.swagger.json \
  --api-properties-file apiProperties.json \
  --script-file script.csx \
  --environment <your-environment-id>

pac connector create doesn’t support a --secret flag. Set the client secret separately (see step 4).

4. Set the OAuth client secret

Option A — Power Platform portal:

1. Go to make.powerapps.com > Custom connectors
2. Edit your connector > Security tab
3. Paste the Client Secret and click Update connector

Option B — paconn CLI:

pip install paconn
paconn login
paconn update -e <environment-id> -c <connector-api-id> \
  --api-def apiDefinition.swagger.json \
  --api-prop apiProperties.json \
  --script script.csx \
  --secret "<client-secret>"

Important: paconn uses a different connector ID format than pac. The pac connector ID (a GUID) won’t work with paconn. Find the correct ID in the Power Platform portal URL after customConnectorId=.

5. Configure the redirect URL in HubSpot

After deploying the connector, copy the per-connector redirect URL from the connector’s Security tab:

https://global.consent.azure-apim.net/redirect/<connector-api-id>

Add this URL to your HubSpot OAuth app’s Redirect URLs list.

6. Create a connection

1. In Power Platform, go to Connections > New connection
2. Select HubSpot Custom MCP
3. Enter your Client ID and Client Secret when prompted
4. Sign in with your HubSpot account to authorize

7. Add to Copilot Studio

1. Open your agent in Copilot Studio
2. Go to Actions > Add action
3. Search for “HubSpot Custom MCP” and add it

Required scopes

• crm.objects.companies.read / crm.objects.companies.write
• crm.objects.owners.read
• crm.objects.deals.read / crm.objects.deals.write
• sales-email-read
• crm.objects.contacts.read
• crm.schemas.custom.read
• crm.objects.custom.read / crm.objects.custom.write
• automation

Application Insights (optional)

Set the APP_INSIGHTS_CONNECTION_STRING constant in script.csx to enable telemetry. Events tracked:

• McpRequestReceived — every incoming MCP request
• McpRequestCompleted — successful completions with duration
• McpRequestError — unhandled errors
• ToolCallStarted / ToolCallFailed — individual tool execution

Files

Resources

• HubSpot remote MCP server (beta): developers.hubspot.com/…/integrate-with-the-remote-hubspot-mcp-server
• HubSpot CRM API: developers.hubspot.com/docs/api-reference/crm
• Power MCP Template: Power MCP Template v2