hscli gives you one TypeScript binary that covers every endpoint of HubSpot's public API surface — verified against a scrape of HubSpot's own dev docs (1,178 source files, 1,180 endpoints). Whether an endpoint actually returns data on your portal depends on the HubSpot tier you're on (see docs/TIERS.md). hscli exposes them all.

• Full CRM — contacts, companies, deals, tickets, leads, quotes, products, line items, orders, carts, discounts, fees, taxes, invoices, subscriptions, payments, goals, communications, users, feedback-submissions, custom objects, properties (+ legacy v1/v2), pipelines, associations v4 (+ labels CRUD + dated 2025-09), owners, imports, exports, engagements (notes/tasks/calls/meetings), sync, describe/validate, timeline, CRM Cards (UI Extensions), filter + count primitives on every object
• Marketing — emails (v3 + legacy v1, per-email stats), campaigns, ads, social, SEO, landing pages, transactional, subscriptions, events (+ attendance + participations), behavioral events, forms, form integrations, legacy email events stream (per-recipient)
• Sales — sequences (+ enroll/unenroll), meetings, calling, goals, scheduler (meeting links, book/reschedule/cancel), sales extensions (videoconferencing, accounting)
• Service — conversations (threads, messages, inboxes, channels, channel-accounts, actors, custom-channels), feedback, chatflows, knowledge-base, ticket pipelines, visitor-identification
• CMS — site pages, landing pages (+ folders), blog posts (+ authors + tags + blog-settings), HubDB (tables, rows, drafts, publishing), URL redirects, source-code, domains, SEO audit, site search, topics, audit-logs, comments, legacy content/api/v2 (Pages, Layouts, Templates, Modules, UrlMappings)
• Settings — users, teams, business units, currencies, GDPR, audit-logs, communication preferences (v3 + v4 batch)
• Account — info, audit-logs, private-apps, API usage
• Operations — lists (+ folders + memberships), reporting, exports, workflows (v4 + legacy v2/v3), automation custom actions, webhooks (subscriptions), timeline (templates + events + integrators)
• Commerce Hub — quotes, products, line-items, invoices, subscriptions, payments, orders, carts, discounts, fees, taxes, payments-subscriptions, tax rates
• Developer Platform — feature flags, CRM cards, integrators timeline, media bridge (properties + schemas + settings + events), extensions (calling + videoconferencing + accounting + sales)
• Legacy v1/v2 — contacts-v1, companies-v2, deals-v1, owners-v2, engagements-v1, properties-legacy, reports-v2, calling-v1, channels, broadcast, appinstalls, marketing-emails-v1
• Niche — email events, email events per-recipient stream, submissions, visitor-identification, scheduler, tax, appinstalls, marketing-extras, owners-extras
• Raw API command with path-scope controls + OAuth flow support
• Built-in MCP server over stdio (140+ tools) for Claude Desktop, Cursor, Claude Code, any MCP client

Enterprise-grade from day one: --dry-run, --force, policy files, change tickets, capability probing, rate-limit intelligence, token redaction, path scope allowlisting, idempotency keys.

Policy files let ops define what an agent is allowed to do — not just whether it can write. Rule matching is first-match-wins: method + path glob (* within a segment, ** across segments), optional time window (window.hours, window.days, window.tz), optional change-ticket requirement, optional approval gate.

# List built-in templates (read-only, no-deletes, business-hours, compliance-strict, change-ticket-required)
hscli policy templates list

# Copy a template to edit locally
hscli policy templates extract no-deletes --to ./policy.json

# Validate before shipping
hscli policy validate ./policy.json

# Dry-run which rule would fire for a hypothetical request
hscli --policy-file ./policy.json \
  policy show-matching DELETE /crm/v3/objects/contacts/123

Enforcement is automatic once --policy-file is set (or HSCLI_POLICY_FILE env var). Error codes (POLICY_RULE_DENY, POLICY_DEFAULT_DENY, POLICY_CHANGE_TICKET_REQUIRED, POLICY_APPROVAL_REQUIRED, POLICY_OUT_OF_WINDOW) are machine-readable.

Tutorial: docs/TUTORIALS/secure-agent-writes.md.

hscli trace records every request to a JSONL file — method, path, status, latency, profile, toolName (when invoked from an MCP tool), optional request/response bodies. Useful for reproducibility, regression detection between portals, debugging agent behavior.

# Start recording to ~/.revfleet/trace-<ts>.jsonl (or pass --out)
hscli trace start --include-bodies --scope all

# Run anything. Every request appends.
hscli crm contacts list
hscli mcp   # MCP requests tagged with toolName

# Stop; the file stays, session state clears.
hscli trace stop

# Inspect
hscli trace show ./trace-<ts>.jsonl --filter status=>=400
hscli trace stats ./trace-<ts>.jsonl          # p50/p95/p99 latency, method breakdown
hscli trace errors ./trace-<ts>.jsonl         # only errors
hscli trace diff  ./run-a.jsonl ./run-b.jsonl # detect reproducibility divergence

# Replay GETs (safe-by-default: dry-run unless --force)
hscli trace replay ./trace-<ts>.jsonl

Writes (POST/PUT/PATCH/DELETE) are intentionally not replayable to prevent accidental re-mutation.

Tutorial: docs/TUTORIALS/trace-replay-repro.md.

hscli audit reads trace JSONL files (single file or an entire directory of trace-*.jsonl) and answers operational audit questions. Pairs with trace for full provenance.

hscli audit timeline --since 24h                     # chronological event list, last 24h
hscli audit who alice --since 7d                     # what has profile 'alice' done?
hscli audit what /crm/v3/objects/contacts --since 7d # who touched this path?
hscli audit writes --since 24h                       # all writes in the last 24h (+ failures)
hscli audit by-tool                                  # per-MCP-tool call count, error rate, avg latency

Tutorial: docs/TUTORIALS/audit-portal-writes.md.