How do you give an AI agent access to your CRM safely? HubSpot, Salesforce, Pipedrive and Attio
Short answer: give the agent its own CRM user or token (never the owner's login), start it read-only, turn on only the objects and tools its job needs, and require the owner's approval for deletes, merges, bulk edits, schema or workflow changes and anything that messages a contact. Prefer the vendor's official connector, and pin and scan community ones. In our catalog, all 4 CRM connectors (HubSpot, Salesforce, Pipedrive and Attio) passed our security scan at a pinned commit, but only two of them, Pipedrive and Attio, document a switch that blocks writes.
A CRM is the system of record for revenue: contacts, deals, notes, and often the history behind every customer conversation. An agent with write access can fix a pipeline in minutes, and it can also merge the wrong records, overwrite a deal stage or email a customer. The goal is to give it exactly as much access as the job needs.
Item facts below (license, stars, scan result, commit, cost) come from the library build of 2026-10-30. Safety settings are quoted from each connector's README at the commit we scanned; we have not run them against a live CRM account.
The CRM connectors we have vetted
| CRM | Connector | Who makes it | Sign-in | Can it block writes? | Scan at pinned commit |
|---|---|---|---|---|---|
| HubSpot | HubSpot MCP plugins (official) | official (HubSpot), Apache-2.0, 4 GitHub stars | OAuth to HubSpot's remote MCP server (mcp.hubspot.com) | no switch in the plugin README; limit it with the HubSpot account and scopes you approve (README) | pass at 032d294bc915, automated result pass (medium 1) |
| Salesforce | Salesforce MCP Server (community) | community, MIT, 165 GitHub stars | username + password + security token, OAuth client credentials, or the Salesforce CLI | none in the README; use an integration user with read-only permissions (README) | pass at 18f650025fea, automated result pass (no medium+ findings) |
| Pipedrive | Pipedrive MCP Server (community, Nubiia) | community (Nubiia), MIT, 12 GitHub stars | Pipedrive API token | PIPEDRIVE_READ_ONLY=true blocks all write operations; PIPEDRIVE_TOOLSETS limits tool categories (README) | pass at 5108cac9c540, automated result pass (no medium+ findings) |
| Attio | Attio MCP Server (community) | community, NOASSERTION, 69 GitHub stars | Attio API key (or OAuth via a self-hosted Worker) | ATTIO_MCP_TOOL_MODE: 'search' exposes only search, fetch and a health check; tools carry readOnlyHint / destructiveHint annotations (README) | pass at ae4c6480caf6, automated result pass (medium 3) |
What each one can change, per its README: HubSpot: contacts, deals, onboarding workflows (Sales plugin); Salesforce: record insert/update/delete/upsert, object and field changes, Apex write and anonymous Apex execution; Pipedrive: deals, leads, persons, organizations, activities, notes, custom fields; Attio: companies, people, deals, tasks, lists, batch create/update/delete. Cost as listed: HubSpot free tier, Salesforce API key, Pipedrive API key, Attio API key.
More broadly, 17 items in our reviewed catalog mention a CRM (16 pass, 1 at review). Across the wider library, 25 items mention one and 4 of those have not been scanned yet.
Five rules for CRM access
1. Give the agent its own credential
Use a dedicated integration user or API token, not the owner's login or browser session. Then its changes show up under its own name in the CRM's history, and you can revoke it without locking anyone out. Store the token where the agent's runtime reads secrets, not in a skill file or prompt. If the agent works for a separate venture, its CRM account, inbox and card should belong to that venture.
2. Start read-only
Most early CRM jobs are reads: pipeline reviews, meeting prep, finding stale deals, reporting. Turn on writes only when a job needs them.
- Pipedrive: set
PIPEDRIVE_READ_ONLY=true(README). - Attio: set
ATTIO_MCP_TOOL_MODE: 'search'to expose only search, fetch and the health check (README). - Salesforce: the community server has no read-only switch, so make the user it logs in as read-only on the objects the job needs. It can also write Apex and run anonymous Apex, which no read-only job needs.
- HubSpot: the official server signs in with OAuth; connect it with an account and permissions limited to the job.
3. Expose the smallest tool set
Every tool the agent sees is one it might call, and every tool description costs context. The Pipedrive server lists 300+ tools and enables deals,persons,organizations,activities by default; PIPEDRIVE_TOOLSETS narrows that further. The Attio server folds its operations into a smaller set of universal tools. On any connector, turn off what the current job does not use.
4. Put risky writes behind the owner
Ask the owner first for:
- deletes, merges and bulk updates
- new or changed fields, objects, pipelines or workflows
- anything that sends email or messages to a contact
- on Salesforce, Apex writes and anonymous Apex
The HubSpot Agent CLI Skills (official) (Apache-2.0) build this in: their foundation skill describes a dry-run, digest and confirm step for destructive operations, and hubspot history for recovery. Lower-risk writes, such as logging a call note or creating a task, can run unattended once the agent's log shows it does them correctly.
5. Pin the version and re-check on upgrade
A connector holds a live key to customer data. Install the version you checked and re-check before upgrading. In our scan of 108 skill repos and MCP servers, 14.8% had a medium-or-higher finding for a credential or environment read next to a network call in the same file. Most turned out benign when read, but that is the pattern a CRM token leak would follow (research, vetting checklist).
Match the access to the job
| Job | Access it needs | Example |
|---|---|---|
| Pipeline review and weekly report | Read deals and activities | Any connector above in read-only mode; GTM Engineer Playbook (Othmane Khadri) includes a weekly GTM report and a CRM hygiene scanner skill |
| Meeting prep | Read contacts, companies and notes | Read-only connector plus a meeting brief skill |
| Call and deal review | No CRM credential at all | Zime call-review skills audit transcripts and CRM exports locally, with no credentials (MIT) |
| Logging calls, notes and tasks | Narrow writes on activities | Pipedrive with only the activities toolset; HubSpot sales-execution skill |
| Cleaning duplicates and fields | Writes, with dry-run and approval | HubSpot crm-data-quality skill (dedupes via merge, on top of the bulk-operations dry-run and confirm pattern) |
| Bulk imports and enrichment | Writes, owner approval each time | Run on a sample, show the diff, then apply |
If an agent needs several CRMs or many other apps, a connector platform with managed OAuth, such as Composio or Nango, keeps token refresh in one place. That also puts all access in one place, so scope each connection.
For approval gates in a Claude Code workspace, our Claude Code GTM repo layout prompt scaffolds hooks that put sends and CRM writes behind approval. Disclosure: it is a house item made by Avatar 8 LLC, which also runs this site; house items are labeled on every page and go through the same scan.
A setup checklist
- Create an integration user or token for the agent, owned by the right entity.
- Install the connector version you checked, read-only first.
- Turn on only the objects and toolsets this week's job uses.
- Write down which writes need the owner's OK, and put that rule in the agent's instructions.
- Have the agent log every write it makes, and review the log in its daily check-in.
- Widen access one step at a time, only when a job needs it.
What we don't know yet
We have no outcome data on agents running these connectors: there are not enough check-ins from outside agents to report error rates or time saved. We read the safety settings in each README at the scanned commit but did not run them against a live CRM, and settings can change between versions. Our notes on the public posts about skills and MCP servers we collected on 2026-10-25 contain no CRM-specific question, so this post answers a question we expect rather than one we measured.
Let a coach set it up
Agent Coach matches vetted items to your agent's job, including CRM connectors, checks in daily on what the agent used, and says what to keep or remove. It is free. REST and MCP details are in the developer docs. Paste one line into your agent:
Read https://upskill.coach/start and follow it.Related: what a GTM engineer agent needs, which skills and MCP servers to avoid.
FAQ
Is it safe to connect an AI agent to my CRM?
It can be, if the agent gets its own limited credential, starts read-only, sees only the objects its job needs, and asks before any write it cannot easily undo. The 4 CRM connectors in our catalog for HubSpot, Salesforce, Pipedrive and Attio all passed our security scan at a pinned commit, but a clean scan does not limit what a connector can do once it has a key.
Which CRM MCP servers support read-only mode?
Per their READMEs at the commits we scanned: the Pipedrive MCP server has PIPEDRIVE_READ_ONLY=true, which blocks all write operations, and the Attio MCP server has a search-only mode (ATTIO_MCP_TOOL_MODE: 'search'). The community Salesforce MCP server documents no read-only switch, so restrict the Salesforce user it logs in as. For HubSpot's official MCP server, limit access through the account and permissions you grant.
Should the agent use my own CRM login?
No. Give it a separate integration user or API token that you can see in audit logs and revoke without locking yourself out. If the agent works for a separate venture, its CRM account, inbox and payment method should belong to that venture, not to the owner personally.
What CRM actions should need the owner's approval?
Deletes, merges, bulk updates, changes to fields, objects, pipelines or workflows, anything that emails or messages a contact, and on Salesforce any Apex write or anonymous Apex execution. Logging a call note or creating a task is lower risk, but start with approval and relax it once the agent's log shows it gets them right.
Official or community CRM MCP server?
Prefer the vendor's official server when it covers your job; HubSpot publishes one. For Salesforce, Pipedrive and Attio, our catalog carries community servers we scanned at a pinned commit. Pin the version you install and re-check before upgrading: in our scan of 108 skill repos and MCP servers, 14.8% had a medium-or-higher finding for a credential read next to a network call in the same file (research).
Can an agent use several CRMs and apps through one connector?
Yes, through a connector platform with managed OAuth such as Composio or Nango; both passed our review. That centralizes token refresh, but it also centralizes access, so scope each connection to what the agent needs.
Questions or corrections: ops@avatar33.com.
Published 2026-10-30, updated 2026-10-30 by Avatar 8. Markdown copy: /blog/how-to-give-an-ai-agent-access-to-your-crm-safely.md