Installing Gatekeeper

INSTALLATION GUIDE

Prerequisites

• A Gatekeeper account at https://app.gatekeeper.station70.com/
• A HubSpot user with permission to install apps (App Marketplace Access or Super Admin)
• An MCP-compatible LLM client (Claude, Cursor, or any agent framework supporting the Model Context Protocol)

Step 1: Connect HubSpot in Gatekeeper

Sign in to the Gatekeeper dashboard and open the Services catalog. Select HubSpot and click Connect. Users arriving from the HubSpot App Marketplace listing are directed to Gatekeeper sign-in and land in this same flow.

Step 2: Authorize with HubSpot

Gatekeeper redirects you to HubSpot's authorization screen via OAuth 2.1 with PKCE, connecting through HubSpot's official remote MCP server at mcp.hubspot.com. Select the HubSpot account you want to connect, review the requested permissions, and grant access. The permission surface is determined by the tools available in HubSpot's MCP server and the access you choose to grant at installation.

The OAuth grant is issued directly to Gatekeeper and is immediately encrypted inside Gatekeeper's secure infrastructure. It is never displayed to the user, never written to logs, and never transmitted to any AI agent.

Step 3: Confirm the connection

After authorization, you are returned to the Gatekeeper dashboard. HubSpot appears as Connected in your Services list. The connection is now live under your organization's default policy.

Step 4: Configure policy

Open the HubSpot policy page in the Gatekeeper dashboard. Administrators can enable or disable specific HubSpot tools, and define rules that allow, deny, or require human approval for actions. Actions outside defined policy are denied by default. A typical configuration allows read operations, requires approval on writes, and denies bulk or destructive operations.

Step 5: Connect your LLM client

Configure your LLM client to connect to your Gatekeeper gateway as an MCP server, in place of a direct connection to HubSpot's MCP server. Your gateway URL is shown in the Gatekeeper dashboard. Once connected, the client discovers the available HubSpot tools through Gatekeeper's MCP interface exactly as it would through the native integration.

Step 6: Verify

Ask your AI agent to perform a simple HubSpot action, such as searching for a contact. The request, the policy decision, and the result appear in the Gatekeeper audit log, confirming the integration is working end to end.

Reauthorization

If the HubSpot grant becomes invalid (for example, the authorizing user's access is revoked), the connection shows as requiring reauthorization in the Services list. Click Reconnect and repeat Step 2. Policies and audit history are preserved.

Uninstalling

To disconnect from Gatekeeper, open Services, select HubSpot, and click Disconnect. Gatekeeper revokes the grant and deletes the stored encrypted credential. To uninstall from HubSpot, go to Settings → Integrations → Connected Apps, locate Gatekeeper, and select Uninstall. Either action fully revokes the integration's access. Gatekeeper retains no HubSpot record data; request and response bodies are not persisted, and the audit log stores only action metadata.