MCP for Salesforce, HubSpot and Your Own Customer Data Platform (CDP): What an Agent Can and Can't Do Safely

Model Context Protocol (MCP) gives an AI agent one standard way to call tools in Salesforce, HubSpot or your own customer data platform (CDP), but the protocol does not decide what the agent may safely do. Safety comes from three controls you apply yourself: least-privilege scopes on every token, a tool list that separates reading, drafting and writing, and human approval before anything is activated.

Who this is for: security, architecture and marketing-operations leads deciding which agents may touch CRM and customer data. Vendor facts were checked on 17 October 2026. This page belongs to the AI hub; for the protocol itself, see What Is MCP and Why Martech Vendors Ship MCP Servers.

What MCP guarantees, and what it leaves to you

The current MCP specification (the site's own links point to the 2026-07-28 revision) makes authorization optional. Where HTTP transports use it, servers must validate that access tokens were issued for them and must not accept or pass on other tokens 1. Clients must send a resource indicator so a token is bound to one server 1.

Three statements in the specification matter most for CRM data:

• Tools are model-controlled, but the specification says a human should always be able to deny a tool invocation 3.
• Clients must treat tool annotations as untrusted unless they come from a trusted server, so a read-only label is a hint, not enforcement 3.
• Servers must validate inputs, apply access controls, rate-limit and sanitise outputs, and clients should log tool usage for audit 3.

Scopes, exposed tools and real human approval are product design and your configuration.

What the Salesforce, HubSpot and Klaviyo documentation says

Salesforce

• Salesforce's Agentforce MCP page describes an AI agent gateway with a central registry of MCP servers, authentication, granular access controls, policy enforcement and rate limiting, and says servers come from verified AgentExchange partners. Its wording is forward-looking, so treat it as direction, not a feature list 5.
• The Salesforce DX MCP server (@salesforce/mcp, Apache-2.0) is a local developer tool. It runs through npx, uses orgs you authorised with the Salesforce CLI, and requires an --orgs setting. The documentation flags the value ALLOW_ALL_ORGS for caution. Its toolsets include data (SOQL queries) and users (assign permission sets) 6.
• A GitHub notice opened on 5 October 2026 says the DX server reaches end of life on 2 November 2026, with the repository archived and tooling moving to skills 7.

A toolset that assigns permission sets is a privilege-escalation tool if you hand it to an agent, so enable toolsets by need, not by default.

HubSpot

HubSpot's remote server lives at mcp.hubspot.com and is added through a connector created in the HubSpot account 4. As documented:

• Auth: OAuth 2.1 with PKCE (S256) required. Scopes are not set by the developer; they follow the tools available at install time and the permissions the user grants. Adding a scope means users reinstall 4.
• Read tools cover CRM search and retrieval, property discovery, a SQL-like query_crm_data, and campaign and email analytics 4.
• Write tools include manage_crm_objects, manage_segment, manage_custom_properties and manage_marketing_email (drafts). Writes to CRM records, segments, campaigns and content require explicit user confirmation 4.
• Permissions: actions respect the connecting user's HubSpot permissions. If Sensitive Data is enabled, activity and conversation data are blocked from the MCP server 4. For the separate HIPAA question, see Is Mailchimp, HubSpot, Klaviyo or GA4 HIPAA Compliant?.
• Status: HubSpot's changelog announced general availability of the remote server on 13 April 2026 (entry updated 15 April), ending the beta 17. The documentation page still labels revenue-object and quote tools beta 4.

Klaviyo, as a third reference

Klaviyo's remote server uses OAuth with dynamic client registration and is limited to Owner, Admin or Manager roles. A read-only=true parameter disables every tool that can write; a toolsets parameter restricts access to resource:access pairs such as profiles:read; and a disable-tools-with-user-generated-content parameter controls tools that read text an LLM could treat as instructions 8. It is the clearest vendor example of controls aimed at prompt injection.

Side-by-side

What a customer data platform's MCP server should expose

A CRM server mirrors the CRM's objects. A customer data platform server should mirror decisions about customers, in five groups. The same pattern applies whether you build it or buy it. PrivyCDP is MCP-ready and logs every AI-assisted action in an append-only audit ledger, which is the property the last group below depends on.

Four design rules follow. Return the minimum fields per call, and counts before rows. Make every proposal an immutable object that a person approves by its hash, so the agent cannot change it afterwards. Keep the audit group read-only for agents. For the propose-and-approve loop in practice, see Agent-Assisted Segmentation: A Before/After Walkthrough; for reason codes on the decisions group, see Explainable AI for Customer Decisions.

What an agent can and can't do safely

Least-privilege scoping in practice

The specification's guidance is progressive: start with a minimal scope set of low-risk read operations, elevate through targeted scope challenges, avoid wildcard scopes, and log elevation events with correlation IDs 2. OWASP names three root causes of excessive agency: excessive functionality, permissions and autonomy 14. In practice:

1. Create one identity per agent role, never a shared admin account or a person's credentials.
2. Split servers by capability: a read server, a propose server and a write server that only accepts a token minted after approval.
3. Issue short-lived tokens and revoke on schedule; rehearse revocation.
4. Restrict by network: IP allow-lists on connected apps, and an egress proxy on the agent runtime.
5. Execute in the user's context where possible, so downstream permission checks still apply 14.
6. Refuse token passthrough. A server that forwards tokens issued for something else breaks audit trails and bypasses controls 2.

Threat model

Prompt injection through records

CRM and CDP records contain text written by outsiders: lead descriptions, form fields, support tickets, email bodies. Noma Labs showed this in Salesforce Agentforce (the ForcedLeak research, disclosed 25 September 2025 and rated CVSS 9.4): hidden instructions in a Web-to-Lead description were read when an employee asked about the lead, and the agent was steered to send CRM data to an attacker through an image URL on an expired but still whitelisted domain. Salesforce enforced Trusted URLs from 8 September 2025 9. Invariant Labs showed the same class against the GitHub MCP server in May 2025: a malicious issue led an agent to copy private repository data into a public pull request 11. A research paper documents a zero-click exploit against Microsoft 365 Copilot (CVE-2025-32711) delivered by a crafted email 15.

Controls: treat all record text as data, not instructions; do not let one session both read untrusted content and call outbound tools; block rendering of remote images and links in agent output; and apply Meta's Agents Rule of Two, under which an agent in one session should have no more than two of untrusted input, sensitive data access, and the ability to change state or communicate externally 13. Simon Willison's lethal trifecta states the same constraint 12.

Data exfiltration

Exfiltration needs an outbound path: a rendered URL, a write tool that posts somewhere readable, a send-email tool, a webhook. Remove or gate those paths, add an egress proxy and alert on unusual read volumes. Do not rely on the model to keep secrets: one benchmark of CRM-style tasks found agents showed "near-zero inherent confidentiality awareness", and prompting for it often reduced task performance 16. The ranked list of what agents must never do is in 7 Things AI Agents Should Never Do With Customer Data.

Over-permissioned tokens

Between 8 and 18 August 2025 an actor tracked as UNC6395 used stolen OAuth tokens from the Salesloft Drift integration to query Salesforce instances, export large volumes of data and search it for secrets such as AWS keys and passwords. Salesloft and Salesforce revoked the tokens on 20 August. Google states the access came from compromised integration tokens, not a flaw in the core Salesforce platform. Its hardening advice matches the list above: restrict connected-app scopes, enforce IP restrictions, and limit the API Enabled permission through permission sets 10. An MCP token held by an agent is the same kind of asset.

Checklist before an agent touches CRM or customer data

• Each agent has its own identity, owner and documented purpose.
• Scopes are per tool, with no wildcard or admin scopes; read, propose and write are separate servers or token classes.
• Row-level reads return only purpose-bound fields.
• Writes need an approval bound to the exact payload hash.
• Consent, suppression, deletion, permission and bulk-export actions are absent from the tool list.
• Record text from outsiders is tagged untrusted and stripped of active content.
• No session combines untrusted input, sensitive data and outbound tools without a human gate.
• Egress is allow-listed; remote images and links are blocked in output.
• Tokens are short-lived, audience-bound and revocable, and revocation is rehearsed.
• Every tool call is logged with agent, user, parameters, result hash and approval ID, in a store the agent cannot edit.
• Vendor MCP documentation is re-read on each release; the owner is named.

To see how a customer-owned, MCP-ready deployment keeps agent access, approvals and the audit ledger under your control, start with the security documentation.

Related reading: the AI hub and Running AI Agents on Customer Data Without Leaving Your Boundary.

Test the consent boundary with synthetic data

Download the iAge consent-aware MCP reference source and example event schema. It runs against two synthetic fixtures, requires process-owned permission and purpose consent, and exposes no production customer-data endpoint. The included SDK stub requires a reviewed release-specific adapter; it does not invent a PrivyCDP API contract.