HubSpot Auditor MCP server

HubSpot Auditor

Read-only audit of a HubSpot portal. You get a scored report of what works, what is broken, and what is missing, plus a 30/60/90-day fix plan.

The server speaks MCP over stdio. A CLI runs the same audit. It never sends POST, PUT, PATCH, or DELETE to HubSpot.

What's new in v1.4.3: site checks block more non-public addresses. Please update. See CHANGELOG.md.

What's new in v1.4.2: registry metadata for the official MCP Registry and Smithery. See CHANGELOG.md.

What's new in v1.4.1: the npm package record uses the current account email. See CHANGELOG.md.

What's new in v1.4.0: the CLI and MCP server ship as compiled JavaScript. Install with npx. See CHANGELOG.md.

Quick start

You need Node.js 22 or newer.

npx -y hubspot-auditor --demo --out reports

Open reports/example-report.md.

Who is this for?

RevOps lead cleaning a portal before a process change. You need one pass over duplicates, pipelines, and forms.

• "Audit this portal in demo mode and show the broken checks."
• "Which required contact properties are thin?"
• "Which deal stages have a weak probability?"

You get findings with severity, evidence, and a recommended fix.

Administrator checking consent and sending. You need GDPR fields, spam controls, and sender authentication called out first.

• "Run the demo audit and list the critical findings."
• "What does the email auditor check?"
• "Show the 30-day plan."

You get critical and high items at the top of the plan.

Consultant handing a client a checklist. You need a report you can regenerate after they change a YAML threshold.

• "List every check and its severity."
• "Run the fictional Harbour Glass audit."
• "Write the Markdown and JSON reports."

You get examples/example-report.md and examples/example-report.json from the sample portal. No customer data is in that example.

Agent user who already has HubSpot connected. You want a second server that only scores the portal.

• "Run a read-only audit. Do not change the portal."
• "Use demo true if no token is set."

You get the same report. The token stays in the environment. It is not a tool argument.

What it checks

Rules live in versioned YAML under rules/. Each file has version: 1 and a list of checks. Turn a check off with enabled: false. Thresholds sit under params.

Shortened. The full README is on GitHub.