THRONE
See report Verify server

registry / record

@hubspot/mcp-server

npm / sealed 2026-06-16 / No. 745c3f26

Does @hubspot/mcp-server MCP work in Claude Code and Cursor? Throne executed @hubspot/mcp-server mcp in a single-use Firecracker microVM and replayed both recorded client behaviours. Compatibility verdict: needs your API key. Is @hubspot/mcp-server mcp safe? Static security scan: 2 finding(s) to review under security ruleset v1. The full per-step results, security findings, scan date, and evidence hash are below.

> throne registry @hubspot/mcp-server sealed
This server runs. It just needs your API keythe server installs and starts, then exits asking for an API key, file:///home/worker/.npm/_npx/e954c1e63b44fb9b/node_modules/@hubspot/mcp-server/dist/utils/client.js:12 throw new Error('HubSpot access token is required. Set PRIVATE_APP_ACCESS_TOKEN in your environment variables and retry.'); ^ Error: HubSpot access token is required. Set PRIVATE_APP_ACCESS_TOKEN in your environment variables and retry. at new HubSpotClient (fi [...] mcp-server/dist/tools/toolsRegistry.js:26:14 at ModuleJob.run (node:internal/modules/esm/module_job:343:25) at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:681:26) at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:117:5) Node.js v22.22.3
receiptsealed evidence
scan id
745c3f26af2e47f59d03fdea22f446fd
target
@hubspot/mcp-server
sealed at
2026-06-16 17:38:51Z
evidence hash
sha256:61cb74593b56fcfae29efb7f3c6c89e0e351371aac680ed5c72e6bf2ddc52521
01connectFAIL0ms

server never launched: server process exited with code 1 before the MCP handshake, stderr: file:///home/worker/.npm/_npx/e954c1e63b44fb9b/node_modules/@hubspot/mcp-server/dist/utils/client.js:12 throw new Error('HubSpot access token is required. Set PRIVATE_APP_ACCESS_TOKEN in your environment variables and retry.'); ^ Error: HubSpot access token is required. Set PRIVATE_APP_ACCESS_TOKEN in your environment variables and retry. at new HubSpotClient (fi [...] mcp-server/dist/tools/toolsRegistry.js:26:14 at ModuleJob.run (node:internal/modules/esm/module_job:343:25) at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:681:26) at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:117:5) Node.js v22.22.3

02discoverSKIPPED0ms

not run, server never launched

03validate_schemasSKIPPED0ms

not run, server never launched

04smoke_test_toolsSKIPPED0ms

not run, server never launched

05error_handlingSKIPPED0ms

not run, server never launched

06streamingSKIPPED0ms

not run, server never launched

07resource_lifecycleSKIPPED0ms

not run, server never launched

08concurrent_callsSKIPPED0ms

not run, server never launched

09reconnectSKIPPED0ms

not run, server never launched

01connectFAIL0ms

server never launched: server process exited with code 1 before the MCP handshake, stderr: file:///home/worker/.npm/_npx/e954c1e63b44fb9b/node_modules/@hubspot/mcp-server/dist/utils/client.js:12 throw new Error('HubSpot access token is required. Set PRIVATE_APP_ACCESS_TOKEN in your environment variables and retry.'); ^ Error: HubSpot access token is required. Set PRIVATE_APP_ACCESS_TOKEN in your environment variables and retry. at new HubSpotClient (fi [...] mcp-server/dist/tools/toolsRegistry.js:26:14 at ModuleJob.run (node:internal/modules/esm/module_job:343:25) at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:681:26) at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:117:5) Node.js v22.22.3

02discoverSKIPPED0ms

not run, server never launched

03validate_schemasSKIPPED0ms

not run, server never launched

04smoke_test_toolsSKIPPED0ms

not run, server never launched

05error_handlingSKIPPED0ms

not run, server never launched

06streamingSKIPPED0ms

not run, server never launched

07resource_lifecycleSKIPPED0ms

not run, server never launched

08concurrent_callsSKIPPED0ms

not run, server never launched

09reconnectSKIPPED0ms

not run, server never launched

chatgpt desktop calibratingemulation profile pending real-traffic captureCOMING SOON
SECURITY: REVIEW / 2 finding(s) / review recommended
LOWTHR-INSTALL-03 / Install-time script execution (npm lifecycle)

"prepare" runs on git-dependency installs and local dev (not registry installs): 'npm run build && chmod +x dist/index.js'

package/package.json
LOWTHR-NET-05 / Hardcoded outbound endpoints

2 non-local endpoint host(s) referenced in code, verify each is expected for this server's purpose: api.hubspot.com (package/dist/utils/client.js:7), developers.hubspot.com (package/dist/tools/links/feedbackLinkTool.js:29)

package/dist/tools/links/feedbackLinkTool.js:29
VERDICT: NEEDS YOUR API KEYSANDBOXED RUN, submitted server executed in a disposable microVM, compatibility not assessable: needs credentials: the server installs and starts, then exits asking for an API key, file:///home/worker/.npm/_npx/e954c1e63b44fb9b/node_modules/@hubspot/mcp-server/dist/utils/client.js:12 throw new Error('HubSpot access token is required. Set PRIVATE_APP_ACCESS_TOKEN in your environment variables and retry.'); ^ Error: HubSpot access token is required. Set PRIVATE_APP_ACCESS_TOKEN in your environment variables and retry. at new HubSpotClient (fi [...] mcp-server/dist/tools/toolsRegistry.js:26:14 at ModuleJob.run (node:internal/modules/esm/module_job:343:25) at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:681:26) at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:117:5) Node.js v22.22.3 / security: review, 2 finding(s), 0 highsealed by THRONE / No. 745c3f26 / 2026-06-16
scopeattestation tuple
target
@hubspot/mcp-server npm
engine
sandboxed
claude code
calibration: partial recorded=9,spec=0,assumed=9
cursor
calibration: partial recorded=11,spec=0,assumed=7
chatgpt desktop
calibration: unavailable recorded=0,spec=2,assumed=16
steps exercised
18 of 18
test suite
v1.0.0
security ruleset
v1.0.0
sealed at
2026-06-16 17:38:51Z
evidence hash
sha256:61cb74593b56fcfae29efb7f3c6c89e0e351371aac680ed5c72e6bf2ddc52521
valid until
2026-09-14
executed in a disposable microVM, created for this scan and destroyed after it. nothing outlives a run.

maintainer of this server? challenge this record: hello@usethrone.dev. tell us what we got wrong and we re-run it in the open.

this page renders the stored record of a real run. nothing on it is asserted without the execution that proved it.