Field-by-field comparison

Compare the evidence before choosing an MCP.

Each signal stays separate, missing facts remain visible, and the column order follows your selection.

MCPs in this comparison

Uncheck an MCP to remove it. Comparing two or three keeps each signal in its own row.

Open canonical comparison link

Comparable alternatives

Shown only when capability or industry context overlaps.

Side-by-side MCP evidence comparison
Evidence fieldKlaviyoWatchlist candidateHubSpot MCPMCP100 Selected
Task fit
Best for
  • Klaviyo teams that need analytics/marketing workflows in an AI client and can use read-only/user-content restrictions where appropriate.
  • Querying CRM records, activities, marketing content, and organizational context
  • Creating or updating supported CRM records and activities with confirmation
  • Building managed AI workflows around HubSpot account data
Not ideal for
  • Teams handling sensitive marketing/customer data without clear API scopes or prompt-injection controls.
  • Clients that do not support OAuth 2.1 with PKCE
  • Vector or semantic CRM search, which the documented backend does not provide
Avoid when
  • For exploratory use, prefer `read-only=true` and disable tools that expose user-generated content unless those features are specifically needed.
  • Existing HubSpot user permissions are broader than the intended agent workflow
  • CRM or communication records cannot be shared with the chosen AI client
  • Record creation, email logging, or meeting actions cannot require human approval
Provenance
Provenance details

First-party MCP

endpoint:https: · Publisher source ↗

First-party MCP

HubSpot · Publisher source ↗

Maintenance
Maintenance details

Stale

Repo: Not documented

Package: Not documented

Repo: Not documented

Package: Not documented

Popularity evidence
Client coverage
Client coverage detailsNot documented
Claude Code✓ Streamable HTTP
Claude Desktop✓ Streamable HTTP
Codex✓ Streamable HTTP
VS Code✓ Streamable HTTP
Cursor✓ Streamable HTTP
OpenCode✓ Streamable HTTP
Client coverage noteLocal stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server.
Access and data
AuthenticationHosted service uses OAuth/dynamic client registration; local server can use a scoped Klaviyo private API key.OAuth 2.1 with PKCE is required. A HubSpot MCP auth app supplies client ID, client secret, and registered redirect URL; the user selects an account and grants available permissions.
CostKlaviyo plan/API and model/provider costs apply.HubSpot documents the remote MCP server as generally available to all HubSpot accounts without a separate MCP fee. HubSpot subscription features, API limits, integration hosting, and AI-client costs still apply.
PermissionsPermissions follow OAuth/API scopes. Hosted read-only mode disables write tools; UGC-related tools can also be disabled.Read access includes CRM records, activities, marketing content, campaigns, and organizational context. Write access includes supported contacts, companies, deals, tickets, line items, products, calls, emails, meetings, notes, and tasks. Every action respects the authenticated HubSpot user's permissions.
Data handlingMarketing/customer/account data and potentially user-generated content can be exposed to the AI client/provider. Klaviyo explicitly provides a control to disable UGC tools.HubSpot's hosted MCP service relays authorized CRM and activity data to the MCP client. Sensitive Data accounts block activity objects through MCP. Client credentials, OAuth tokens, retrieved records, and tool results must be protected by the integrating application.
Limitations
Tradeoffs
  • Promoted after strict re-audit: canonical identity and MCP-native/publisher-backed implementation are sufficiently evidenced, with real workflow value, usable documentation, understandable permissions, plausible maintenance, and no unresolved security veto. Still not strong enough for Selected.
  • The GA hosted service removes local server maintenance but requires creation and management of an MCP auth app.
  • Available scopes follow current server tools and user-granted permissions; newly added scopes can require reauthorization.
  • HubSpot blocks activity objects through MCP when Sensitive Data is enabled, reducing exposure but also capability.
Risk contextSensitive customer/marketing data, mutating campaign operations and prompt-injection risk from user-generated content require explicit controls.CRM and activity tools can expose personal and commercially sensitive data or create consequential customer records and communications. Use a dedicated auth app, narrow user permissions, secure PKCE and token storage, re-review scope changes, and confirm mutations. No MCP100 execution testing is claimed.
Evidence date
Editorial review2026-09-13T00:00:00Z2026-07-24
Candidate evidence2026-09-13T00:00:00Z2026-07-29T20:58:26.000Z

Popularity, maintenance, fit, permissions, and client support are independent evidence fields.

Read the evidence method →