G Gremlin Hubspot Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited G Gremlin Hubspot Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Status: Public Beta — 14 tools shipping, core workflows stable, feedback welcome. See Known Gaps below.
The HubSpot MCP server for teams that hit the API ceiling.
HubSpot's official MCP gives you read-only search capped at 10k records. This one gives you dedup merge plans, auto-windowing past the ceiling, property drift detection, and bulk upserts — all from Claude Desktop, Cursor, or Windsurf.
Powered by g-gremlin, the CLI for Google Workspace and CRM automation.
# 1. Install
pipx install g-gremlin
pipx install g-gremlin-hubspot-mcp
# 2. Connect to HubSpot (one-time)
g-gremlin hubspot connect --access-token YOUR_PRIVATE_APP_TOKEN
# 3. Add to your MCP clientAdd to your claude_desktop_config.json:
{
"mcpServers": {
"g-gremlin-hubspot": {
"command": "g-gremlin-hubspot-mcp",
"env": {
"G_GREMLIN_HUBSPOT_ACCESS_TOKEN": "YOUR_TOKEN"
}
}
}
}Add to your MCP settings:
{
"mcpServers": {
"g-gremlin-hubspot": {
"command": "g-gremlin-hubspot-mcp"
}
}
}OpenClaw can call MCP servers through mcporter.
npm install -g mcporter{
"mcpServers": {
"g-gremlin-hubspot": {
"command": "g-gremlin-hubspot-mcp",
"env": {
"G_GREMLIN_HUBSPOT_ACCESS_TOKEN": "YOUR_TOKEN"
}
}
}
}g-gremlin-hubspot.| Capability | HubSpot Official MCP | peakmojo/mcp-hubspot | g-gremlin-hubspot-mcp |
|---|---|---|---|
| CRM search | 10k cap | cached/vector | Auto-window past 10k |
| Write operations | No | Create only | Upsert + dry-run |
| Duplicate detection | No | No | Merge plans |
| Schema introspection | No | No | Full schema/props |
| Engagement export | No | No | Async fallback |
| Snapshot diffing | No | No | Yes |
| Safety layer | N/A | None | Dry-run + plan hash |
| Impact classification | No | No | Per-tool labels |
HubSpot's Search API has a hard cap of 10,000 total results — no cursor beyond that.
g-gremlin breaks this with recursive date-range windowing:
createdate timestamps in returned recordsRequired: createdate (default) or any sortable date property. For objects without timestamps, engagements use an async export fallback with no ceiling.
7 tools work with no account (FREE). 7 require a g-gremlin HubSpot Admin license or active trial. A 30-day trial is available at first install.
| Tool | Impact | License | What it does |
|---|---|---|---|
hubspot.auth.whoami | [READ] | FREE | Check auth, show portal identity |
hubspot.auth.doctor | [READ] | Licensed | Health diagnostics (connectivity, scopes, API access) |
hubspot.schema.list | [READ] | FREE | List all CRM object types (standard + custom) |
hubspot.schema.get | [READ] | FREE | Full schema for an object type (properties, associations) |
hubspot.props.list | [READ] | Licensed | Property introspection (names, types, labels) |
hubspot.objects.query | [READ] | FREE | CRM search with filters (Search API, capped at 10k) |
hubspot.objects.pull | [READ] | FREE | Full extraction past the 10k ceiling (auto-windowing) |
hubspot.engagements.pull | [READ] | FREE | Engagement pull with async export fallback |
| Tool | Impact | License | What it does |
|---|---|---|---|
hubspot.dedupe.plan | [ANALYZE] | FREE | Scan for duplicates, generate merge plan with plan_hash |
hubspot.props.drift | [ANALYZE] | Licensed | Detect property drift between spec and live portal |
hubspot.snapshot.create | [READ] | Licensed | Capture CRM state (schema, props, counts) |
hubspot.snapshot.diff | [ANALYZE] | Licensed | Compare two snapshots, show what changed |
| Tool | Impact | License | What it does |
|---|---|---|---|
hubspot.objects.upsert | [WRITE] | Licensed | Bulk upsert from CSV (dry-run default, two-phase apply) |
hubspot.dedupe.apply | [MERGE] | Licensed | Execute a merge plan (requires plan_hash verification) |
The free tools are the strongest hooks: pull past 10k records and generate dedup merge plans — no account needed. The paywall appears when you act on what you found (upsert, apply merges, snapshots).
All mutations use two-phase confirmation:
plan_hashapply=true AND the plan_hash from step 1. If the hash doesn't match (plan changed, wrong file), the tool rejects with a clear error.Every tool response includes an impact classification: [READ], [ANALYZE], [WRITE], or [MERGE].
Every tool returns a consistent GremlinMCPResponse/v1 JSON:
{
"$schema": "GremlinMCPResponse/v1",
"ok": true,
"summary": "Pulled 47,231 contacts across 12 auto-window queries",
"data": { ... },
"artifact": { "type": "file", "path": "...", "row_count": 47231 },
"warnings": [],
"safety": { "dry_run": false, "impact": "read" },
"raw": { "agentic_result": { ... }, "exit_code": 0 }
}This MCP server never stores tokens. It delegates to g-gremlin's credential chain:
G_GREMLIN_HUBSPOT_ACCESS_TOKEN env var (highest priority)g-gremlin hubspot connect --access-token <PAT> (stored locally in ~/.g_gremlin/)g-gremlin hubspot oauth connect (browser-based OAuth)"HubSpot not configured" error in Claude Desktop?
Claude Desktop may run under a different user context than your terminal. Set the token in the MCP config's env block (see Quickstart above) or set G_GREMLIN_HUBSPOT_ACCESS_TOKEN as a system-level environment variable.
This is a public beta. Core read and analyze workflows are stable. Known gaps:
Found a bug or have a feature request? Open an issue.
git clone https://github.com/mikeheilmann1024/g-gremlin-hubspot-mcp
cd g-gremlin-hubspot-mcp
pip install -e ".[dev]"
pytestMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.