HubSpot, Salesforce, Zoho CRM, Pipedrive, Attio and Standards all run an official CRM MCP server as of October 2026. Each one lets an AI agent such as Claude read and update your CRM records. They differ on what the agent may write and how you narrow its access after you connect it.
CRM MCP servers: which CRMs have one in 2026
Which CRMs run an official MCP server in 2026: HubSpot, Salesforce, Zoho, Pipedrive, Attio and Standards, compared on OAuth, write access and permissions.
The Standards team
In short
What does a CRM MCP server do?
A CRM MCP server is an endpoint that speaks the Model Context Protocol, the open standard Claude, Codex and Cursor use to call outside tools. You add its URL to your AI client and sign in. The server then hands the agent a short list of tools, such as search records or update a deal, and runs each call against your CRM under your identity. Instead of a CSV export or a pasted screenshot, your agent reads the live account and the last meeting note, then writes the follow-up task back on the record. HubSpot, Salesforce, Zoho CRM, Pipedrive and Attio host their own server, so you install nothing. Integration platforms such as Zapier and Activepieces also expose CRM actions over MCP, but they sit between your agent and the CRM, with their own account and their own credentials. If your team keeps real client files, settle what the agent may change, and who answers for it, before anyone connects.
Which CRMs have an official MCP server in October 2026?
HubSpot, Salesforce, Zoho CRM, Pipedrive, Attio and Standards each publish an MCP server they host themselves. The table gives what each vendor's own page stated on 26 October 2026. Salesforce reserves its hosted servers for “every Enterprise Edition org and above”, while Pipedrive opens its server on every plan. Zoho counts each MCP call against your API credits like any other API call. Affinity, folk, Close and Microsoft Dynamics 365, through Dataverse, host one as well, as their own pages state, and sit outside this comparison.
CRM | Sign-in | What the agent may write | Permissions applied | Source, read October 2026 |
|---|---|---|---|---|
HubSpot | OAuth, through a user-level app on the new Developer Platform | Contacts, companies, deals, tickets, quotes, engagements; users, owners and campaigns stay read-only | The scopes of the user-level app; the account admin connects first; no access to custom Sensitive Data Properties | |
Salesforce | OAuth with PKCE, through an External Client App with the | Read-only on | “Every transaction runs as the authenticated user” | |
Zoho CRM | OAuth on first use | Records, modules, fields and workflow rules, across four servers | “All actions are scoped to your Zoho CRM user permissions” | |
Pipedrive | OAuth, on every plan | “Create and update deals, contacts and activities” | The user's own, with each action in the change log | |
Attio | OAuth, “no API keys required” | Records, lists, notes, tasks; writes ask for confirmation | The same as your Attio user | |
Standards | OAuth or an API key | Records, rich text and record drives; delete sits in a separate scope | Your workspace roles intersected with the access level you chose |
What should you check before you connect an agent to your CRM?
Check four things before you connect an agent to your CRM: whose identity it acts under, how it signs in, what it may write, and whether its changes can be undone. Run the checks on a test account before anyone on your team connects a production workspace, and keep the answers next to your data-processing records.
Identity. The agent should act as the person who signed in, never as a shared service account, so your audit trail names a human. Salesforce, Zoho, Pipedrive and Attio each tie the agent to the signed-in user's permissions on their own pages.
Sign-in. Prefer OAuth over a pasted API key: you approve the client on a consent screen, and you can revoke it without rotating a key that other scripts use.
Write scope. Find out which objects the agent may create, update or delete, and whether you can grant reading alone. Salesforce suggests starting on a read-only server in a sandbox for that reason.
Reversibility. Ask what a delete does, whether you can restore it, and whether you can lower a connection's rights without breaking it.
How Standards narrows the tools to the credential
Standards hides every tool a connection cannot use, so an agent signed in for reading never sees a write or delete tool in its list. As the Standards MCP tools reference describes, the server builds that list on each request from two sources, the OAuth scopes of the connection and the roles you hold in the workspace, and keeps only the tools both allow. A connection gets one of three access levels, Read, Write (the default) or Full:
Access level | Tools the agent sees | Scopes |
|---|---|---|
Read |
|
|
Write (default) | Read tools, plus |
|
Full | Write tools, plus |
|
Delete is a scope of its own. Write access alone never shows
delete, and each delete call takes one reference and makes a soft delete you can restore.Each call is checked again. When a visible tool meets an object your role does not allow for that action, Standards answers “Access denied” and names the action and the object; a record you cannot see answers as if it did not exist.
The level can drop without reconnecting. You lower a connection from Write to Read in Connected apps, and its next request carries the new level.
Each tool also carries the standard MCP hints, read-only or destructive, so Claude or Cursor can ask you before a call that changes data.
How do you connect Claude Code to Standards?
Standards serves its MCP endpoint at https://api.standards.new/v1/mcp, and an OAuth sign-in binds the client to one workspace: the agent reaches that workspace's records and no other workspace's. The Standards MCP guide gives the commands for Claude Code, Codex and Cursor; Cursor connects with an API key only.
You add the server in a terminal:
claude mcp add --transport http standards https://api.standards.new/v1/mcp.Claude Code opens the Standards sign-in in your browser on first use, and you pick the workspace.
You choose Read, Write or Full on the consent screen; Standards offers only the levels your role allows and the client asked for.
Claude Code receives the tools of that level and a list of the objects you can read, then works on your records.
You change the level or revoke the connection later from Connected apps in your Standards settings.
The Standards developer page covers the SDK and the CLI that work alongside the MCP server, and the Standards comparison hub sets Standards side by side with other CRMs.
Questions
Before you switch tools.
HubSpot, Salesforce, Zoho CRM, Pipedrive and Attio each host an official MCP server, as their own pages showed in October 2026. Standards runs one too, at https://api.standards.new/v1/mcp. Salesforce limits its hosted servers to Enterprise Edition and above, while Pipedrive opens its server on every plan. Affinity, folk, Close and Microsoft Dynamics 365, through Dataverse, host one as well. Integration platforms such as Zapier also expose CRM actions over MCP through their own accounts.
Yes, when your sign-in grants write access. HubSpot, Zoho CRM, Pipedrive, Attio and Standards let an agent create and update records through their servers. Salesforce's sobject-reads server stays read-only, and Standards offers a Read level that hides every write tool. In Standards, deleting needs its own scope, and you can restore a deleted record.
Yes, in most cases. OAuth puts you on a consent screen and ties the connection to your own account, so you can revoke that one connection without touching anything else. A pasted API key often serves other scripts, so revoking it breaks them too. Standards accepts both; its OAuth requires PKCE, issues access tokens that expire after an hour, and rotates the refresh token on every use.
Not on Salesforce, Zoho CRM, Pipedrive, Attio or Standards. The first four apply the permissions of the user who signed in, as their own pages state, while HubSpot's page describes access through the scopes of a user-level app. Standards keeps only the tools both your OAuth scopes and your workspace roles allow, and checks each call against the record it touches, so a record you cannot open stays out of the agent's reach.
Yes for Claude, and for ChatGPT on Pipedrive's server with a Pro, Business, Enterprise or Edu ChatGPT plan, as Pipedrive's ChatGPT guide states. Claude, Codex and Cursor connect to remote MCP servers. Standards documents Claude Code and Codex with an OAuth sign-in or an API key, and Cursor with an API key only.
Use the CRM's own server when one exists: you sign in to the CRM itself, and Salesforce, Zoho CRM, Pipedrive and Attio apply your own user permissions, as their own pages state. Zapier and Activepieces sit between your agent and the CRM, with their own account and their own credentials, which suits an agent that must reach many apps at once.
Read next
On the same subject.
See Standards on your own records
Book a 30-minute call and see Claude work on a Standards workspace through its MCP server.