CRM MCP servers: which CRMs an agent can actually write to

We build Relm, a CRM for AI agents, so we have an obvious interest here. We have tried to write the page we wanted to find and could not: Relm is one row in the table, competitors are described accurately including where they beat us, and every capability claim links to the vendor's own documentation or the actual repository. Where we could not verify something we say unverified rather than guess.

The one question that matters

An MCP server lets an AI assistant call your CRM directly as a set of tools, instead of you writing glue code. The marketing rarely tells you the thing you need to know, which is: what can the agent change? There are three real answers, and they are very far apart.

• Read-only. The agent can search and summarise. It cannot log a call or move a deal. Several vendors do this deliberately and say so plainly.
• Records only. The agent creates and updates contacts, companies and deals - inside a structure a human already built. This is the large majority.
• Records and structure. The agent can also create pipelines, stages, fields and automations. Very few servers do this.

A second question decides whether you will actually finish setting it up: can you connect with a key, or must an administrator register an OAuth application first? That difference is minutes versus an afternoon and a permissions conversation.

The comparison

First-party servers only in this first table - built and run by the CRM vendor. Community servers are covered further down, along with the ones that look alive and are not.

Three things the table shows that surprised us

1. Almost nobody lets an agent build structure

Write access is now the norm rather than the exception - but "write" nearly always means records only. Of the first-party servers we verified, only Microsoft Dataverse (creates and alters tables), monday.com (boards, groups, columns, forms), Close (pipelines, statuses, workflows), ActiveCampaign (pipelines, custom object schemas), Airtable (tables, fields, automations) and Relm can change the shape of the CRM rather than its contents.

That distinction decides whether an agent can set a workspace up for you or only fill in one somebody else built. If you are pointing an agent at an existing CRM that a team already uses, records-only is probably what you want anyway.

2. Read-only is often a decision, not a gap

Nutshell, Capsule, Gong, Zoho's Data Insights server and Salesforce's sobject-reads variant are read-only on purpose and say so in their own docs. Outreach went further still, shipping create and delete but deliberately no update. The best-designed community servers do the same thing: Odoo's and EspoCRM's default to read-only with writes behind an explicit flag, and in Odoo's case a per-call approval token.

This is a defensible product stance. An agent that can only read cannot corrupt your pipeline at 3am.

3. Auth setup is the real dividing line

It splits cleanly, and it predicts your afternoon better than any feature list.

• Paste a URL and approve: Attio, folk, Pipedrive, Nutshell, Close, Notion, Airtable, Relm.
• An administrator must build an app first: Salesforce (External Client App, specific scopes, PKCE, and servers are inactive until switched on), HubSpot (create an MCP auth app), Microsoft (Entra ID with per-environment client allow-listing).

Freshworks is an outlier in the other direction: API key only, no OAuth at all.

What published comparisons get wrong

Every item here is contradicted by a primary source. We list them because these errors are repeated in most "best CRM MCP server" articles, and because we would rather you check us than trust us.

"Zendesk has an MCP server"

It does not. Zendesk ships an MCP client - its product can consume external MCP servers. A Zendesk MCP server was announced for summer 2026 and was not in the live early-access registry on our verification date. A vendor consuming MCP is not a vendor exposing MCP, and this is the single most common error in this category.

"Salesforce's MCP server has 60+ tools"

Two entirely different products get conflated. The local DX server has a large tool count aimed at developers, and its entire CRM-data surface is one read-only run_soql_query. The server that writes your CRM is a separate hosted product, gated to Enterprise Edition and above, with servers inactive by default. Quoting the DX tool count next to "read-write CRM" describes something that does not exist.

"GoHighLevel's MCP server is that popular GitHub repo"

The most-cited community GoHighLevel server has four total commits and has been dead since July 2025. Its open issues report that the advertised tools do not load, with no maintainer reply. It still ranks top in MCP directories because it has stars and because GitHub's "updated" timestamp moves when someone stars a repo. Meanwhile HighLevel ships an official hosted server that goes largely uncited.

General lesson: check commit count and last commit date, not stars. Several widely-listed CRM servers in this space are single-commit repos or were archived by their own authors.

"This CRM supports MCP" (from an aggregator page)

Zapier, Pipedream, Composio, StackOne and similar platforms auto-generate a page per application whether or not that vendor ships anything. Several CRMs with no server at all have such pages, and that is precisely how listicles come to claim they support MCP. Per-connector action counts on those pages are the aggregator's own wrapper counts and should never be attributed to the CRM vendor.

"It is listed as official, so it is official"

Directory badges are not verification. One large directory lists an "Official Smartlead MCP Server" that belongs to an unrelated third party. Another popular server self-describes as an "official partner" and was archived in February 2026. In the official MCP Registry there is a real signal, though a narrow one: a com.* namespace requires DNS verification of that domain, while io.github.* only requires control of a GitHub account. That proves who published it - not that it is any good.

Name collisions that catch people out

• Apollo.io (sales) and Apollo GraphQL both ship something called an "Apollo MCP Server". Different companies, unrelated products.
• Clay: a widely-cited "clay-mcp" belongs to Mesh (me.sh), a personal-contacts CRM formerly named Clay - not clay.com.
• Nimble CRM and Nimbleway are different companies.

Community servers, and the ones that only look alive

Community servers are a legitimate route - Odoo's ecosystem in particular is genuinely good, and Twenty's server is first-party and in-core. But this corner of the space has a decay problem. On our verification date, servers still being cited as current included several archived by their authors, several with a single commit, and one created the previous day with no description.

Before you depend on a community CRM server, check three things: total commit count, date of the last commit (not the "updated" timestamp), and whether open issues report the tools failing to load.

Aggregators: the other honest path

If your CRM has no server, or has a read-only one, aggregators are a real answer rather than a consolation prize. Zapier MCP covers 9,000+ apps and lets you whitelist exactly which actions the AI may call. Composio and Pipedream expose thousands of tools across thousands of apps with managed OAuth.

The trade-off is honest and worth stating: you get breadth and someone else handles authentication, but you get generic per-endpoint actions rather than a CRM-shaped tool surface, and you put a third party in the data path. Zapier also bills tool calls against your existing task quota.

Tool count is a vanity metric

It is tempting to rank these by tool count. Do not. The vendors who thought hardest about the problem went the opposite way: GoHighLevel's official server exposes five meta-tools fronting hundreds of operations, Twenty discovers its tools at runtime, and Composio routes just-in-time. Meanwhile the largest flat tool lists in this space belong to repos whose users report that the tools do not load at all.

There is a mechanical reason. Every tool definition is sent to the model on every request, so a huge flat list eats the context window before any work happens - and some clients cap how many tools they will accept. What matters is whether the tools are shaped like the jobs you actually do.

Where Relm fits, honestly

Relm is in the small group that can build structure, not just fill it: an agent can create pipelines and stages, register custom fields, and set up automations, sequences and webhooks. Connecting is OAuth with dynamic client registration - the client registers itself, the user approves in a browser and never handles a secret - or an API key if you prefer; either way there is no app to register first, and it works on the free tier. Every tool carries MCP annotations, so a client knows which calls are read-only and which are destructive before it runs them.

The honest counterweight: Relm is new and small. If your team already lives in HubSpot or Salesforce, the answer is almost certainly to use their server, not to migrate. Attio has a broader record surface than we do and semantic search we do not have. Close exposes far more tools. We are not listed across the MCP directory ecosystem the way established vendors are. Relm makes sense when the agent is the primary user of the CRM rather than an assistant to a sales team - which is a real but narrow case, and we would rather say so than pretend otherwise.

If that is your case: the docs, the MCP endpoint is https://api.relmcrm.com/mcp, and the free tier needs no card.

FAQ

Which CRMs have an MCP server?

As of 25 July 2026, roughly 20 CRMs ship a first-party MCP server, including HubSpot, Salesforce, Zoho, Pipedrive, Attio, monday.com, Microsoft Dataverse, Close, ActiveCampaign, folk, Nutshell, Capsule, NetHunt, GoHighLevel, Twenty, Affinity, OnePageCRM, Streak and Relm. About 15 can write, not just read.

Can an AI agent actually write to a CRM over MCP?

Usually yes, but only records. Only a handful of servers can change CRM structure rather than contents: Microsoft Dataverse, monday.com, Close, ActiveCampaign, Airtable and Relm.

Does Zendesk have an MCP server?

No. Zendesk ships an MCP client, meaning its own product can consume external servers. A server was announced for summer 2026 and is not yet in the live early-access registry.

Which CRM MCP servers are read-only?

Nutshell, Capsule, Gong, Zoho's Data Insights server, Salesforce's sobject-reads variant and Dynamics ERP Analytics are read-only by design and say so in their own documentation.

Is a high tool count a good sign?

No. It is a vanity metric, and it correlates inversely with careful design. Large flat tool lists overflow client limits and consume the model's context window before it does anything useful.

Method

Every row was checked against official vendor documentation or the actual source repository on 25 July 2026, in that order of preference. Marketing language mentioning "AI" was never treated as evidence of an MCP server. Where read-versus-write capability could not be established from primary sources, the value is marked unverified rather than inferred. Tool counts are as documented on that date and vendors add tools frequently.

If we have got something wrong - especially about a competitor - tell us at [email protected] and we will correct it and date the correction.