On November 2, 2026, Salesforce archived the local MCP server its own developers had been using to wire Claude and Cursor into Salesforce orgs. The npm package stays installable but is deprecated and unmaintained. If that is how someone at your company connected an AI assistant to your CRM, that connection is now running on unsupported code — and the replacement is a different product with a different permission model. That deprecation is a useful marker of how fast this layer matured: in roughly eighteen months, connecting an AI assistant to your CRM went from a weekend side project to a vendor-hosted, admin-governed, metered feature that your platform already includes. This is a comparison of the five first-party MCP servers that actually matter to mid-market CRM and ERP buyers, what each one can read and write, what it costs, and what to lock down before you switch one on.
Key Takeaways
- Salesforce, HubSpot, Zoho, NetSuite, and Microsoft Dataverse all now run their own vendor-hosted MCP servers — you probably do not need a third-party connector anymore.
- All five run under the signed-in user’s permissions, which means your existing role and sharing model is your AI security model. If roles are sloppy, the agent inherits the sloppiness.
- Write access is not uniform: HubSpot can create and update core CRM objects but keeps quotes, invoices, and subscriptions read-only; Zoho ships a separate server that can edit your data model; Dataverse can create and drop tables.
- Cost models differ sharply. Zoho bundles MCP into existing API limits at no extra charge, Salesforce consumes your org’s daily API allocation, and Microsoft began billing Dataverse MCP usage on December 15, 2025.
- SugarAI (formerly SugarCRM) and SuiteCRM have no first-party server — only third-party wrappers, which put your credentials outside the vendor’s trust boundary.
- The safest first deployment is a dedicated, non-admin, read-only service role pointed at reporting questions, not record updates.
Why Every Vendor Shipped One in the Same Year
The Model Context Protocol gives any AI client — Claude, ChatGPT, Copilot Studio, Cursor, or a custom agent — a standard way to call tools and read data from a business system. Before MCP servers existed, every “AI in our CRM” project meant writing custom API glue and storing a set of credentials somewhere your security team had never reviewed.
Then the vendors decided the chat window was worth owning. On August 26, 2026, Salesforce and Anthropic announced Claudeforce, including a “Salesforce in Claude” plugin with 37 prebuilt sales skills and a reported plan to spend roughly $300 million on Anthropic tokens in 2026. HubSpot’s fall 2026 positioning leans on a self-updating Smart CRM and an Agent Hub control plane. The strategic bet is the same across vendors: if the work happens in an assistant, the assistant should be reading from their system of record.
For buyers, the practical consequence is simpler and more immediate. You already pay for a capability that lets a rep ask “what slipped out of this quarter and why” in plain language, and you have probably not configured who is allowed to use it.
1. Salesforce Hosted MCP Servers
Salesforce Hosted MCP Servers reached general availability in April 2026 for Enterprise Edition orgs and above, with free access for Developer Edition. Because Salesforce hosts them, there is no infrastructure to run.
The standard servers span what Salesforce calls its Headless 360 portfolio: a Salesforce Platform server for SObject CRUD, SOQL queries, and search, plus servers for Data 360, Tableau, and MuleSoft. Custom MCP servers can expose your own Apex REST classes, Flows, named queries, and even Agentforce agents as callable tools — which is the part most implementation teams underestimate, because it means a well-built Flow becomes a safe, governed action an agent can take without being handed raw object access.
Admins enable servers in Setup under the API Catalog, and clients connect through an external Client App using the mcp_api and refresh_token scopes with PKCE. Every call runs as the signed-in user, so object permissions, field-level security, and sharing rules all apply. Two operational details matter for planning: tool calls consume the same daily API allocation as REST calls (Enterprise Edition defaults to 100,000 calls per day, enforced org-wide in aggregate rather than per user), and MCP traffic is identifiable in API logs, which is how you audit adoption later.
The deprecated piece is the local Salesforce DX MCP server (@salesforce/mcp), which hit end of life on November 2, 2026. Developer tooling moved to a skills-based model; business data belongs on the hosted servers.
2. HubSpot’s Remote MCP Server
HubSpot’s remote server at mcp.hubspot.com went generally available to all HubSpot accounts on April 13, 2026, which makes it the most broadly accessible option on this list — no edition gate to clear.
The read surface is wide: contacts, companies, deals, tickets, line items, quotes, invoices, orders, carts, products, subscriptions, segments, campaigns, landing pages, site pages, blog posts, marketing events, and activity records including calls, meetings, notes, tasks, and emails. The write surface is deliberately narrower — create and update are limited to contacts, companies, deals, tickets, line items, products, and activities. Quotes, invoices, orders, carts, subscriptions, segments, and all content objects stay read-only.
That split is good design, and it is worth copying as a policy elsewhere: let the agent maintain pipeline and activity hygiene, and keep anything that touches a commercial document under human control.
Connections require OAuth 2.1 with PKCE, and all actions respect existing HubSpot user permissions. Two caveats bite in practice. First, activity objects become inaccessible when sensitive data is enabled in the portal, and custom sensitive data properties are excluded outright — so regulated teams should expect gaps rather than denials. Second, MCP calls run against the same underlying APIs as the rest of your integrations, sharing the same rate limits, so a chatty agent competes with your production syncs.
3. Zoho MCP
Zoho took the most structured approach. Rather than one broad server, Zoho MCP runs a platform at mcp.zoho.com spanning CRM, Mail, Calendar, Desk, Cliq, Projects, WorkDrive, Books, Expense, Billing, Creator, Survey, People, and Bigin, plus 500+ third-party apps reachable through Zoho Flow.
Inside Zoho CRM specifically, there are four prebuilt MCP servers, each scoped to a different blast radius:
- Data Insights — read-only query and analysis
- Data Operations — create, update, and manage records
- Module Customization — configure the data model itself
- Workflow & Process Automation — set up and manage automation
Zoho describes execution as permission-aware: all actions are bound by the authenticated user’s CRM roles and permissions, and it works with Claude Desktop, Cursor, VS Code, and Windsurf. On cost, Zoho’s own pricing page is blunt — MCP introduces no new billing logic and operates within the API limits of your existing Zoho service editions.
Our advice for Zoho shops: turn on Data Insights, leave the other three off, and treat Module Customization as a change-management tool rather than an everyday one. An assistant that can add fields to your Deals module on request is a configuration-drift generator, and you will be the one reconciling it against your reporting six months later.
4. NetSuite AI Connector Service
On the ERP side, Oracle’s NetSuite AI Connector Service is the hosted MCP server — one per account, generally available since release 2025.2, with Companion SuiteApp enhancements in 2026.1. The endpoint takes the form https://{accountID}.suitetalk.api.netsuite.com/services/mcp/v1/all.
The free MCP Standard Tools SuiteApp registers a working toolset covering record operations, reports, saved searches, and SuiteQL queries. Tool visibility depends on the connected role’s permissions, which is where NetSuite’s implementation is the most opinionated — and the most instructive.
Per Oracle’s required features and permissions documentation, the role used for the connection cannot be Administrator and cannot be a role with full permissions across NetSuite. It needs the MCP Server Connection permission and Log in using OAuth 2.0 Access Tokens. If you want agents to create, retrieve, and update records through the Standard Tools SuiteApp, you also enable the REST Web Services feature and grant that permission to the role.
Oracle is forcing the discipline that every other platform leaves optional. Adopt that constraint on all five platforms whether or not the vendor makes you.
5. Microsoft Dataverse MCP Server
If any part of your stack runs on Dynamics 365 or Power Platform, the remote Dataverse MCP server entered public preview on May 20, 2025 and reached general availability on December 15, 2025. A related Dynamics 365 Customer Service MCP server reached GA in July 2026.
Its documented toolset is the most powerful — and the most alarming — on this list: search_data, search, create_record, update_record, delete_record, create_table, update_table, delete_table, read_query, describe, upsert_skill, delete_skill, and file upload/download helpers. Microsoft requires explicit user approval for the delete operations, which tells you how it views the risk.
Governance is handled centrally in the Power Platform admin center. For existing Dataverse MCP users, only Microsoft Copilot Studio is enabled by default; connecting other clients such as Claude or VS Code GitHub Copilot requires configuration in the admin center, and the whole feature can be switched off per environment. Note the commercial change too: effective December 15, 2025, Dataverse MCP server usage became subject to billing. Of the five, this is the one where an unmonitored agent loop shows up on an invoice.
What If You Run SugarAI or SuiteCRM?
SugarCRM rebranded as SugarAI on April 13, 2026, but the new name did not come with a first-party MCP server, and SuiteCRM has none either. What exists are third-party wrappers over the same REST APIs — CData’s (read-only in its free form), Zapier, Pipedream, and community projects on GitHub.
Those can work, but understand the tradeoff you are accepting: your CRM credentials and your record data now traverse a vendor that is not your CRM vendor, under a contract that probably was not reviewed for this use. For regulated data, that is usually a hard stop until a first-party option ships.
Side-by-Side Comparison
| Platform | Server | Status | Write access | Cost model |
|---|---|---|---|---|
| Salesforce | Hosted MCP Servers (Platform, Data 360, Tableau, MuleSoft) | GA April 2026, Enterprise Edition and above; free on Developer Edition | SObject CRUD, plus custom Apex/Flow/Agentforce tools | Consumes org daily API allocation |
| HubSpot | Remote server at mcp.hubspot.com | GA April 13, 2026, all accounts | Core CRM objects and activities; commercial documents read-only | Shares existing API rate limits |
| Zoho | Zoho MCP platform + four prebuilt CRM servers | Available; 15+ Zoho apps plus 500+ via Flow | Records, data model, and automation — split across separate servers | No new billing; uses existing edition API limits |
| NetSuite | AI Connector Service + MCP Standard Tools SuiteApp | GA since release 2025.2 | Records, reports, saved searches, SuiteQL (role-gated) | SuiteApp is free; REST Web Services feature required |
| Microsoft Dataverse | Remote Dataverse MCP server | GA December 15, 2025 | Records and tables, including schema creation and deletion | Billed usage as of December 15, 2025 |
Seven Things to Lock Down Before You Turn One On
- Create a dedicated, non-admin service role. NetSuite refuses Administrator roles outright. Apply the same rule in Salesforce, HubSpot, Zoho, and Dataverse even though they let you get away with more.
- Start read-only. Zoho’s Data Insights server and read-only OAuth scopes elsewhere give you 80% of the value with none of the data-integrity risk. Earn write access with a clean 30 days.
- Decide which clients are allowed. Microsoft defaults to Copilot Studio only; Salesforce makes you toggle servers on in the API Catalog. Make that an explicit decision, documented, not an accident of whoever clicked first.
- Keep schema tools switched off. Zoho’s Module Customization server and Dataverse’s create_table/delete_table tools do not belong in a sales rep’s assistant.
- Budget the call volume. Agents are far chattier than humans. Model the API consumption against your Salesforce daily limit or your HubSpot rate limit before an agent starves a production sync, and watch the meter on Dataverse.
- Know where the activity logs appear. Salesforce surfaces hosted MCP traffic in API logs under its own identifier. If you cannot answer “which user’s agent changed this record,” you are not ready for write access.
- Do not build on developer or local servers. The DX MCP end-of-life is the cautionary tale. Business data belongs on the vendor-hosted, supported path.
CRM Experts Online’s Perspective
We implement and clean up these systems for a living, and here is the uncomfortable thing about MCP: it is not primarily an AI project. It is a permissions audit with a chat interface attached.
Every one of these five servers runs under the authenticated user’s existing permissions. That sounds reassuring in a vendor datasheet and lands very differently in a real org. We routinely open CRMs where half the sales team has View All on Opportunities because someone needed a report in 2022, where field-level security was never applied to compensation or margin fields, and where three people share a “integration user” login with god-mode access. Point a natural-language agent at that org and you have not created a new security hole — you have built a search engine for the ones you already had. Permission sprawl that nobody could exploit through the standard UI becomes trivially discoverable the moment someone can ask a question in English.
So our sequence with clients is always the same. Audit roles, profiles, and field-level security first. Create a purpose-built MCP role with the minimum object set. Turn on read-only. Pick two or three genuinely useful questions — pipeline inspection, AR aging, ticket backlog by segment — and prove value there. Only then discuss writes, and when we do, we strongly prefer exposing a governed action (a Salesforce Flow, a Zoho workflow) as the tool rather than handing the agent raw CRUD on an object. A Flow enforces your validation rules, your required fields, and your approval steps. Raw object access enforces nothing.
The other thing worth saying plainly: MCP is not an integration strategy. It is excellent at letting a human ask a question or make a handful of updates in context. It is a poor substitute for the scheduled, idempotent, error-handled data flows that keep your CRM and ERP in agreement. If someone proposes replacing your nightly sync with an agent, that is the moment to push back.
FAQ
Do we need to buy an AI platform to use any of this? No. These are standard MCP servers, so any MCP-compatible client works — Claude, ChatGPT, Copilot Studio, Cursor, VS Code, or a custom agent. You configure the server on the CRM side and connect over OAuth.
Which edition do we need? It varies. Salesforce Hosted MCP Servers require Enterprise Edition or above (free on Developer Edition). HubSpot’s remote server is available to all accounts. NetSuite requires release 2025.2 or later with specific features enabled. Zoho operates within your existing edition’s API limits.
Does this cost extra? Zoho says explicitly that MCP adds no new billing and runs inside your existing API quotas. Salesforce and HubSpot consume the API capacity you already have, which can become a real constraint. Microsoft began billing Dataverse MCP usage on December 15, 2025 — model that one before rollout.
Can an AI agent delete our records? It depends on what you enable. Dataverse exposes delete_record and delete_table and requires explicit user approval for both. Salesforce SObject servers support full CRUD subject to the user’s permissions. HubSpot’s GA documentation describes create and update rather than delete for core objects. The dependable control is the role, not the tool list.
Does field-level security still apply? Yes on every platform here — calls run as the signed-in user with object permissions, field-level security, and sharing rules enforced. That is precisely why the permission audit comes first.
What about sensitive or regulated data? HubSpot excludes custom sensitive data properties from MCP and makes activity objects inaccessible when sensitive data is enabled. Expect similar carve-outs elsewhere, and do not assume a vendor’s MCP path inherits your HIPAA or FINRA posture without checking the specific contract terms.
Should we use a third-party MCP server instead? Only if your platform has no first-party option — which today means SugarAI and SuiteCRM. First-party servers keep credentials and data inside the vendor’s trust boundary and inherit its permission model. Third-party wrappers add a vendor, a contract, and a credential store to your risk register.
Where should we start? One read-only server, one dedicated role, three specific recurring questions, and a 30-day log review. That is a two-week project, not a quarter-long program.
Conclusion
Your CRM vendor has already built the connector you were about to pay someone to build. The work that remains is not technical integration — it is deciding which roles, which objects, which clients, and which actions you are willing to expose, and then proving it in a small pilot before anyone gets write access.
That is exactly the kind of work we do. If you run Salesforce, HubSpot, Zoho, or NetSuite and want an MCP rollout that starts with a permissions audit instead of a demo, schedule a consultation with CRM Experts Online. We will tell you what your current role model would actually hand an agent, and build the scoped path to turning one on safely.
Further Reading
- HubSpot Changelog: Remote HubSpot MCP server is now generally available
- HubSpot Developers: MCP documentation
- Salesforce Developers: Salesforce Hosted MCP Servers Are Now Generally Available
- forcedotcom/mcp: End of Life — November 2nd, 2026
- Zoho MCP
- Zoho CRM with Built-In MCP Support
- Oracle NetSuite: AI Connector Service FAQ
- Oracle NetSuite: Required Features and Permissions
- Microsoft Learn: Dataverse MCP Server release plan
- Salesforce and Anthropic Announce Claudeforce
- SugarCRM Unveils New Brand Identity as SugarAI
CRM & ERP Enterprise Technology Expert and Entrepreneurial Executive with 20+ years of leading CRM, ERP, Customer Experience, and Block-chain initiatives and projects across internal and customer facing technologies. Proven success in closing large deals in Pre Sales customer facing engagements and deploying enterprise wide CRM & Customer Experience solutions internationally and domestically.