v1.5.3

Security

• Updated zod from 3.25 to 4.6.7 (GHSA-mrhx-c7xc-m3w5, memory exhaustion on large arrays) and @modelcontextprotocol/sdk to 1.32.2. The lockfile now resolves body-parser 2.4.0 (GHSA-27r3-jxmh-p828), fast-uri 3.1.9 (GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr, GHSA-333x-w4r6-6crp) and qs 6.17.1 (GHSA-6pq8-jhm2-2vcw). npm audit reports 0 vulnerabilities.
• The publish workflow pins npm to 12.2.2 and mcp-publisher to v1.8.8 with a SHA-256 check, instead of installing the latest release of each.

v1.5.2

This release adds a token-scope guard and a closed-won attribution check, and makes several checks stricter about evidence.

• At start-up the auditor reads the token's scopes and warns when a write scope is present. Every HubSpot request is checked against a read-only allowlist (#37, #46).
• A new check reports how many sampled closed-won deals have an original source, across all pipelines. Campaign data is evidence only and needs the optional marketing.campaigns.read scope. Ad spend stays needs_operator_confirmation (#41, #47).
• If HubSpot fails partway through loading records, the affected checks report missing evidence instead of passing (#42).
• A required field that was never sampled no longer counts as a pass (#43).
• The stage-probability check skips closed stages, using HubSpot's own closed flag when it is present, so the default pipeline is no longer flagged (#44, #45).

Thanks to @harrisonoconnorhover for #42, #43, #44 and #45.

v1.5.1

The unused custom properties check is stricter about evidence.

• When no custom property has sampled values, the check reports missing evidence. It no longer passes, and it no longer suggests archiving from an empty sample.
• The server description is 100 characters or fewer, as the MCP Registry requires.

Thanks to @harrisonoconnorhover for the fix in #39.

v1.5.0

Findings ranked by the business process they affect, with an owner and a retest on every fix.

• Each finding names the process it affects. One territory or billing fault outranks a longer list of unused fields.
• Each item in the 30/60/90 plan names a suggested owner role and a retest.
• A pass that depends on a business rule a read-only token cannot prove is needs operator confirmation, not a green check.
• Forms with no captcha and no honeypot field are listed, with a 30-day submission count when the API returns one. A public form with submissions ranks above a form that is not embedded.

v1.4.4

Security hardening release.

• Site checks now block a few more non-public address forms.
• The PDF report writer now refuses to follow symbolic links in the reports folder, so reports stay where they belong.
• CI actions are pinned to commit SHAs (#22).

Upgrading is recommended. Details are in a security advisory that will be published later.

v1.4.3

Security patch: hardened outbound address checks. Please update to v1.4.3.

v1.4.2

Registry metadata for the official MCP Registry and Smithery.

• mcpName is io.github.M-Pineapple/hubspot-auditor.
• Adds server.json and an MCPB manifest.
• The attached bundle is hubspot-auditor.mcpb.

v1.3.2

Closes the reopened site-fetch ticket.

Fixed

• Site fetches also reject IPv6-mapped forms of private and loopback addresses, including [::ffff:127.0.0.1], which Node rewrites to ::ffff:7f00:1.

v1.3.1

Closes the review tickets on site fetches, PDF paths, scopes, retries, echoed names, DNS fallback, and the install command.

Fixed

• Site fetches require https, reject non-public addresses, and re-check each redirect.
• run_audit accepts a PDF file name and writes it under reports/. It does not overwrite unless HUBSPOT_AUDITOR_PDF_OVERWRITE=1.
• HTTP 429 and 5xx are retried, then reported as throttling or an outage.
• Portal names in evidence are shortened and stripped of control characters.
• Sender TXT lookups use the system resolver first. Set HUBSPOT_AUDITOR_DOH=0 to disable DNS over HTTPS.
• The hubspot-auditor command runs through a Node shim, so a fresh install does not need a TypeScript build.
• The README lists each read and the scope it needs. No write scope is required.

v1.3.0

Brand, sender authentication, subscription coverage, owners, and a lifecycle funnel from the contact sample.

Added

• Landing page checks for a logo, a favicon, a level-one heading, and the colour palette. Extra phrases remain optional.
• SPF, DKIM, and DMARC are read from DNS for the portal email domains.
• Published emails are checked for a subscription type. Record owners are checked.
• The lifecycle funnel uses contact stages when HubSpot does not return a report object.
• Lists, subscription types, email campaign ids, and form follow-up actions are read from the fields the API returns.
• If no public site URL is passed, tracking uses the portal primary site domain.

The fictional sample report is examples/example-report.pdf.