HubSpot MCP server and Dome

1. 01

   Add the HubSpot MCP server

   In HubSpot, create an MCP connector with https://api.domesystems.ai/oauth/callback as its redirect URL. Dome runs the OAuth flow with PKCE and holds each rep's tokens.

   $ dome tools add --name hubspot \
     --url https://mcp.hubspot.com \
     --auth-method oauth --credential-type per-user \
     --oauth-authorize-url https://mcp.hubspot.com/oauth/authorize/user \
     --oauth-token-url https://mcp.hubspot.com/oauth/v3/token \
     --oauth-token-endpoint-auth client_secret_post \
     --oauth-client-id "$HUBSPOT_CLIENT_ID" \
     --oauth-client-secret "$HUBSPOT_CLIENT_SECRET" \
     --gateway revenue-gateway

2. 02

   Sync the catalog

   Run it once your own HubSpot consent is attached. HubSpot's tools vary by subscription and permissions, so the sync lists what your account has.

   $ dome tools catalog sync hubspot

3. 03

   Apply the rule

   Scope it to one agent while you try it. Simulate before you deploy.

   $ dome rules apply hubspot-crm-only.cedar \
     --agent deal-updater --name hubspot-crm-only

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about HubSpot itself, see HubSpot's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "hubspot" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "hubspot" &&
  ["manage_custom_properties", "manage_custom_pipelines", "manage_landing_page",
   "manage_website_page", "manage_blog_post"].contains(resource.tool_name)
};