# hubspot probes, 2026-09-17T16:15Z, from a cloud container (one IP), no credentials, no payment
# Bodies are cut at 1500 bytes. Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.hubspot.com/
$ curl -sS -i -m 25 -X POST https://mcp.hubspot.com/ -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 16:15:19 GMT
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]
set-cookie: _cfuvid=[redacted by the prober: a session cookie, never published]
cf-ray: a3c968b06caf8c7f-BOS
cf-cache-status: DYNAMIC
cache-control: must-revalidate,no-cache,no-store
server: cloudflare
x-request-id: 75777b12-fa95-470a-afe2-6564185e7ebc
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: origin
www-authenticate: Bearer resource_metadata="https://mcp.hubspot.com/.well-known/oauth-protected-resource"
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=MJ4jHNASWrw8NR4V%2BVGQPuKRMLGwgztZl4dqoQ6g2zQDcFKUIJyh5Xc%2BULE9hcvWHee%2BfUe1PCtLd8fAouRiGJR7vd3JTq2a%2FW6gEHbao7DEbAZ2TP6n0xtLupVLg0PUew%3D%3D"}]}
access-control-allow-credentials: false
server-timing: hcid;desc="75777b12-fa95-470a-afe2-6564185e7ebc", cfr;desc="a3c968b07fb929a9-BOS", hcid;desc="75777b12-fa95-470a-afe2-6564185e7ebc", cfr;

## 2. Protected-resource metadata, GET https://mcp.hubspot.com/.well-known/oauth-protected-resource
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 16:15:19 GMT
content-type: application/json;charset=utf-8
content-length: 174
cf-ray: a3c968b4bcb6a8bf-BOS
cf-cache-status: DYNAMIC
access-control-allow-origin: *
cache-control: no-transform, max-age=300
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: origin
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=lYDSA3%2Bc9w%2B3MG%2FDLGPsLFLms%2FeZdOhctFOdPze8JURMkaHuJ25pfd294Fb22gT2wLRAAW%2BOST2SOwTWutblI3zA1S0lkfiV1FIPr91IFpqpyzI0RNA%2BLroU28S9ikGF%2BQ%3D%3D"}]}
access-control-allow-credentials: false
server-timing: hcid;desc="01a0b026-ad3a-7af7-86a2-39d6d6794079", cfr;desc="a3c968b4ccfea16e-BOS"
x-content-type-options: nosniff
x-hubspot-correlation-id: [redacted by the prober: a per-request correlation id, which the secret sweep reads as a key]
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]

{"resource":"https://mcp.hubspot.com","authorization_servers":["https://mcp.hubspot.com"],"scopes_supported":[],"resource_documentation":"https://developers.hubspot.com/mcp"}

## 3. Authorization-server metadata, GET https://mcp.hubspot.com/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 16:15:20 GMT
content-type: application/json;charset=utf-8
cf-ray: a3c968b8eb325ea9-BOS
cf-cache-status: DYNAMIC
access-control-allow-origin: *
cache-control: no-transform, max-age=300
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: origin, accept-encoding
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OGYDoTuj0KCSkpV0cm3hGa7jvm5g0lYhm6%2BrCAVbG%2FrmG%2BSDIJH5HvCjqKTAZ%2BFizYeZY0ekaB4DWJ%2BRs0v7G93kRCTbw2fCcec1ayosWzMtPIxH3a3UwCS7RgZGcKBUCw%3D%3D"}]}
access-control-allow-credentials: false
server-timing: hcid;desc="01a0b026-afae-7b4b-84e8-cb28931ed380", cfr;desc="a3c968b8fd5e29a9-BOS"
x-content-type-options: nosniff
x-hubspot-correlation-id: [redacted by the prober: a per-request correlation id, which the secret sweep reads as a key]
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]

{"issuer":"https://mcp.hubspot.com","authorization_endpoint":"https://mcp.hubspot.com/oauth/authorize/user","token_endpoint":"https://mcp.hubspot.com/oauth/v3/token","scopes_supported":[],"response_types_supported":["code"],"response_modes_supported":["query"],"grant_types_supported":["authorization_code","refresh_token","client_credentials"],"token_endpoint_auth_methods_supported":["client_secret_post"],"service_documentation":"https://developers.hubspot.com/docs/guides/apps/authentication/oauth-quickstart-guide","introspection_endpoint":"https://mcp.hubspot.com/oauth/v3/token/introspect","introspection_endpoint_auth_methods_supported":["client_secret_post"],"introspection_endpoint_token_types_supported":["access_token","refresh_token","client_credentials"],"code_challenge_methods_supported":["S256"]}

## 4. REST, GET https://api.hubapi.com/crm/v3/objects/contacts, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 16:15:21 GMT
content-type: application/json;charset=utf-8
content-length: 299
cf-ray: a3c968bcdb237e99-BOS
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: origin
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8ZrBYE8QF%2BXOXuVdD9V7GL4U0g%2FI63r86LegwuutGn0dSJb5Okq9n7%2BJA6NpL1qY5Vd5Y8s8M2Eb9qoohWBwKxIaAe50Mc1pWZaIN3khKQ7jHquYJ%2FRPd7FMRwsO137Q"}]}
access-control-allow-credentials: false
server-timing: hcid;desc="01a0b026-b217-791d-8891-d81351efe9c0", cfr;desc="a3c968bcdeda4e45-BOS"
x-hubspot-auth-failure: 401 Unauthorized
x-hubspot-correlation-id: [redacted by the prober: a per-request correlation id, which the secret sweep reads as a key]
set-cookie: __cf_bm=[redacted by the prober: a session cookie, never published]