Contents7
“Which open deals haven’t moved in three weeks?” Not long ago, that question meant a filter, a saved view or an export to a spreadsheet. Today you can ask it as is to an AI assistant connected to the CRM, which returns the list and can prepare a follow-up task for each deal.
That connection runs on an open standard, MCP, which HubSpot and Twenty both now publish. For a sales team, it means less switching between screens and a CRM finally used by the people who used to avoid it. For the company, it is a new way into its customer data, and it has to be managed like human access: with permissions, approval and an audit trail.
In short
An MCP server lists the actions an AI assistant can take in a piece of software, with the permissions of the account that connected it.
It is not tied to any model: ChatGPT, Claude, Gemini, Mistral or Copilot Studio can all connect to it.
Start with the right uses: search, summarise, prepare. Writing comes next, with approval.
An agent never deletes, exports, sends or changes permissions on its own: those actions stay human.
What is MCP?
Definition
MCP (Model Context Protocol)
An open standard that connects an AI application to other software. The software publishes an MCP server, meaning the list of actions an assistant can call (find a record, update it, create a task), with the permissions of the account that connected it.
Launched by Anthropic in November 2024, the protocol was handed over in December 2025 to the Agentic AI Foundation, a Linux Foundation fund co-founded by Anthropic, Block and OpenAI. It is not tied to any model. ChatGPT accepts custom MCP servers, which OpenAI’s documentation now files under “plugins”. Claude, Gemini Enterprise, Microsoft’s Copilot Studio and Vibe, the new name of Mistral’s assistant, can connect too.
Our page MCP servers: connecting AI to your business software presents the software that publishes one and what we connect to it.
What can you ask your CRM?
Three families of uses, from the safest to the most committing.
Search and summarise. “Which accounts have had no contact in two months?”, “Summarise this customer’s history before my 2 pm meeting.” The assistant reads, sorts and rephrases; nothing changes in the CRM.
Prepare. “Draft the follow-up for the three quotes that got no reply.” The assistant produces a draft, which the sales rep reviews and sends personally.
Update. “Add the notes from this call to the deal”, “Create a callback task for Friday.” The assistant writes to the CRM, with the person’s consent.
On the vendor side, the two CRMs we come across most allow this. Twenty publishes its own MCP server at your workspace address followed by /mcp, in the cloud as well as self-hosted. Its tools mirror the API (find_many_companies, update_one_opportunity), and a catalogue gives access to hundreds of other operations. HubSpot opened its remote MCP server to all customers on 13 April 2026, including write access to contacts, companies, deals and tickets; its connectors for Claude, Copilot, Gemini and ChatGPT are built on that server.
What happens when you talk to your CRM
- The question
Asked in everyday language, in the assistant of your choice.
- The tool
The assistant picks the MCP server action that answers it, such as searching deals.
- The permissions
The CRM only runs what the connected account is allowed to do.
- The approval
A write waits for your consent before it goes through.
- The trail
Depending on the CRM and the plan, a log keeps track of who changed what, and through which assistant.
What permissions should the assistant get?
The assistant has no permissions of its own: it borrows those of the account that connected it. In Twenty, an MCP connection inherits the permissions of the user signed in through OAuth, or of the role assigned to the API key. In HubSpot, the connection must go through OAuth 2.1, and every action respects the user’s existing permissions. An administrator who connects their assistant therefore gives it administrator rights.
The MCP specification sets out the principle: a progressive, least-privilege permission model. In practice, we apply it in four stages:
- Read-only first.
A few weeks of questions without changing anything: the team sees what the assistant understands well, and what it gets wrong.
- Writes with approval.
Write tools ask for consent every time. HubSpot recommends this for its ChatGPT connector: “set Write tools to Needs Approval”.
- One role per use.
A dedicated key or account, limited to the objects that matter: a sales assistant has no business in invoicing. In Twenty, a workflow agent gets its own role, which keeps it within its scope.
- Regular review.
What the assistant wrote, reviewed every week at first, then by spot checks.
An API key handed to an assistant is a password. It belongs in a vault and gets rotated, as we explain in Secrets vault: your AI uses them without seeing them.
What an agent must never do on its own
Some actions stay human, whatever level of trust has been reached:
- deleting or merging records;
- exporting the database, or a contact list;
- sending a message to a customer on behalf of the company;
- changing an amount, a discount or a deal that has already closed;
- changing permissions, roles or keys.
The reason comes down to two risks that OWASP, the reference body for application security, lists in its Top 10 for AI applications (2025 edition). The first is prompt injection: a CRM contains text written by others, an email received, a message left in a form, and a sentence crafted to give the assistant orders can slip in. The second is excessive agency, which OWASP breaks down into excessive functionality, excessive permissions and excessive autonomy. The less the assistant can do, the less harm a booby-trapped instruction can cause.
For trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations.
Assistant vendors point the same way. Gemini Enterprise asks for confirmation for every action by default, Mistral advises keeping write functions on manual approval, and Anthropic recommends choosing “Allow always” only for a trusted server.
Watch out
A connector can bypass your rules. HubSpot says so for its ChatGPT connector: custom validation rules, including pipeline stage rules, do not apply to records created or edited through that connector. Data your form would have rejected can come in through the assistant.
Bulk corrections, finally, do not go through an assistant. They require a script, a controlled request rate and record-by-record verification, as our guide Cleaning up your CRM data details.
From the field
A client learned this the hard way: a bulk correction run on their CRM with no rate limit saw 754 calls rejected by the API. Run again at the right pace, with a check after each write, it went through 837 times out of 837. An assistant chaining updates runs into the same limits, without always saying so.
How do you set it up safely?
The connection itself takes little time: an address, an OAuth sign-in, a setting for the write tools. What takes time is deciding who is allowed to do what, and configuring that in the CRM before opening access.
With Twenty, the open source CRM we deploy, the connection is preferably made through OAuth, or with an API key created in the settings, and each key carries a role. Twenty also has its own built-in assistant, which answers in plain language without leaving the CRM. Two points to plan for depending on the plan: the audit log and row-level permissions start with the Organization edition, and the API is limited to 50 calls per minute on Pro and 100 on Organization, according to Twenty’s pricing page.
For choosing the CRM itself, our guide Twenty, Dolibarr or Odoo: which one for your team? compares the three solutions in our range, and our field report Twenty CRM in production covers what takes work.
Where should you start?
List five questions your sales reps ask every week that currently require an export or a colleague. Those are your first read-only uses. Next to them, note the permissions of the account that will be connected: if they go beyond those five questions, that is where to start.
Our custom CRM and ERP offer, from €4,500, installs Twenty, Dolibarr or Odoo with roles designed for the team as well as for assistants. And our AI secrets vault, from €2,900 to €4,900, stores the keys your assistants and automations use, without any AI ever seeing them.
Frequently asked questions
Which AI assistants can connect to a CRM through MCP?
All the major assistants can today: ChatGPT, Claude, Gemini Enterprise, Mistral’s Vibe and Microsoft Copilot Studio accept an MCP server, with conditions that vary by subscription. On the CRM side, HubSpot publishes ready-made connectors for Claude, Copilot, Gemini and ChatGPT, and Twenty documents how to connect ChatGPT, Claude and developer tools such as Cursor.
Does the assistant see all the data in the CRM?
It sees what the connected account can see, and no more. But what it reads goes to the provider of the model that answers. For sensitive data, choose your provider and hosting accordingly, or a model hosted on your own infrastructure. Our article on private AI in four levels helps you set the dial for your data.
Our CRM has no MCP server: is it still possible?
Yes, if the CRM has an API. A small MCP server written for the purpose, or an n8n workflow, bridges the assistant and the API, with the same rules: a limited role, writes subject to approval and a log. It is often a chance to check what the API really allows, and what it lets through unchecked.
Can you let an agent update the CRM on its own?
Within a narrow scope, yes: adding a note, creating a task, filling in an empty field. Only after a read-only phase and then an approval phase, and with weekly spot checks. Deletions, exports, customer messages and permission changes stay human, whatever trust has been built.
Sources
- Linux Foundation, announcement of the Agentic AI Foundation, 9 December 2025 (new tab)linuxfoundation.org
- OpenAI, connect an MCP server to ChatGPT (new tab)developers.openai.com
- Twenty, MCP server documentation (new tab)docs.twenty.com
- HubSpot, remote MCP server general availability announcement (new tab)developers.hubspot.com
- MCP specification, security best practices (new tab)modelcontextprotocol.io
- HubSpot, connect your HubSpot account to ChatGPT (new tab)knowledge.hubspot.com
- OWASP, LLM06:2025 Excessive Agency (new tab)genai.owasp.org
- Google, connect an MCP server to Gemini Enterprise (new tab)docs.cloud.google.com
- Mistral AI, Vibe MCP connectors (new tab)docs.mistral.ai
- Anthropic, custom connectors using remote MCP (new tab)support.claude.com
- Twenty, built-in assistant documentation (new tab)docs.twenty.com
- Twenty, pricing page (new tab)twenty.com
Linux Foundation, announcement of the Agentic AI Foundation, 9 December 2025
Read on linuxfoundation.org(new tab)HubSpot, remote MCP server general availability announcement
Read on developers.hubspot.com(new tab)Jim · founder of Brain Plus AI
Also in crm and customer data
Understand8 min
Twenty CRM in production: our view, limits included
We have been running Twenty, an open-source CRM, on our own server since early 2025. What works, what takes effort, what the AGPL licence means for a company, and who we do not recommend it to.
Understand12 min
Secrets vault: your AI uses your keys without seeing them
Passwords sent by email, API keys forgotten in code, AI agents that could copy everything: these are the leaks we come across most often. And how a vault in your name lets your AI use your keys without ever reading them.
Practical guide12 min
Enterprise AI governance: who can access what
An AI assistant reads whatever your access rights let it read, sharing mistakes included. Here is how to split your knowledge bases by department, keep a common core and decide who writes to the shared memory.