
Pipedrive CRM
io.github.ckalimaPublished by GitHub account ckalimav2.7.1Updated Nov 3, 2026
MCP server for Pipedrive CRM. 155 tools for deals, persons, organizations, activities, and more.
Overview
Local MCP server for Pipedrive CRM, giving an assistant 155 tools to read and manage deals, contacts, organizations, activities, projects and mail.
- What you can do
- List, get, search, create and update deals, persons, organizations, leads, products and notes
- Manage activities, followers, deal line items, discounts and installments
- Work with projects, tasks, boards and phases (Projects add-on)
- Read mail threads and messages, and look up custom field definitions
- Upload or replace product images via base64 data or an allowlisted directory
- When to use it
- Useful when you want an assistant to query or update a Pipedrive account from chat — for example reviewing open deals, creating records, or summarizing email threads linked to contacts — without building API calls yourself.
- Requirements
- Runs locally via npx (Node.js) or an mcpb bundle. Requires a Pipedrive API token in PIPEDRIVE_API_KEY. Optional: PIPEDRIVE_MODE to set the capability tier, PIPEDRIVE_IMAGE_BASE_DIR to allow reading product images from disk. Network access to the Pipedrive API.
Installation
In SourceWeft
- Open Pipedrive CRM in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.
Other MCP clients
Follow the launch instructions in the repository.
README
Pipedrive MCP Server
[npm version] [CI] [tests] [license: MIT]
An MCP (Model Context Protocol) server for Pipedrive CRM integration with Claude Code and Claude Desktop. Query, create, and update CRM data directly from your AI assistant.
Why this server
- API v2-first. Every entity uses Pipedrive's v2 REST API where it exists; v1 is used only for the capabilities that have no v2 equivalent (notes, mail, users, and leads CRUD). See API Versioning.
- Contract-tested against the real OpenAPI spec. Request params, request bodies, and response shapes are checked against the vendored Pipedrive OpenAPI v2 definition (
docs/api/openapi-v2.yaml) intests/contract/, so the v2 tools can't silently drift from the documented API. - Live-smoke verified. The tool surface is broadly exercised against a real Pipedrive account (
scripts/smoke-coverage.ts), with only API-unseedable surfaces (e.g. mail threads, project templates) left to manual checks. Coverage includes plan-gated endpoints such as Growth+ deal installments (scripts/smoke-installments.ts). Key write smokes (e.g. the taskis_doneflag) assert the field value actually changed on the wire, not just a 200. - Server-enforced capability modes.
PIPEDRIVE_MODEpicks a safety tier —read-only,safe-write(the default: reads + non-destructive writes), orfull— and out-of-mode tools are both hidden fromtools/listand refused if called directly. Deletes, conversions, and other irreversible writes (🔒 in the tool table) requirefull, so the server is read-and-create only out of the box. Every tool also carries MCP annotations (readOnlyHint/destructiveHint/idempotentHint) so policy-aware clients can tell reads from writes from deletes. See Capability modes. - MIT licensed, published with npm build provenance.
Honest limitations. Transport is STDIO only today (a Streamable HTTP flag is planned), and auth is via a Pipedrive API key, which matches the local/self-hosted tier this server targets. There is no hosted OAuth offering yet.
Features
- Full CRM Operations: Deals, persons, organizations, activities
- Email Analysis: Access mail threads and messages for engagement analysis
- Field Discovery: Map custom field hash codes to human-readable names
- Pipeline Management: List pipelines, stages, and users
- Pagination Support: Cursor-based pagination for large datasets
- Error Handling: Clear, actionable error messages
Quick Start
Fastest setup: npx … init
Run the one-command guided installer and follow the prompts. It opens the Pipedrive API-token page, validates your key live against your account, and generates a working MCP config for your client (Claude Desktop, Claude Code, Cursor, Windsurf, or VS Code):
It always prints a paste-ready block and can optionally write it into your client's
config file after a timestamped backup. Committed/shared config files use
${PIPEDRIVE_API_KEY} indirection, never a raw key. Prefer to configure by hand? The
manual steps below still work.
1. Get Your Pipedrive API Key
- Log into Pipedrive
- Go to Settings > Personal preferences > API
- Copy your API key (40 characters)
2. Configure Claude Code
Add to your .mcp.json file:
Package name: the supported package is the scoped
@ckalima/pipedrive-mcp-server. If you arrived from an older snippet that referenced the unscopedpipedrive-mcp-server, update your config to the scoped name above — the unscoped name is a different, unrelated package.
You can also start it directly to verify your setup:
Or set the environment variable:
Environment Variables
To enable destructive tools, set PIPEDRIVE_MODE=full (or, for back-compat, PIPEDRIVE_ENABLE_DESTRUCTIVE=true) in the env block of your .mcp.json alongside PIPEDRIVE_API_KEY. Below full, every 🔒 tool returns a DESTRUCTIVE_DISABLED error instead of acting, and tools above the active tier return a MODE_RESTRICTED error.
Capability modes
PIPEDRIVE_MODE sets a server-enforced safety tier. The tier is enforced two ways: out-of-mode tools are filtered out of tools/list (so the agent never sees them) and the dispatcher refuses any out-of-mode call by name before its handler runs, so the tier is a real guarantee rather than a UI hint.
Recommended for first-time setup and agent evaluation: read-only. Let the agent look before it can touch anything, then widen the tier as you build trust.
Backward compatibility. PIPEDRIVE_MODE is authoritative when set. When it is unset, the mode is derived from the legacy PIPEDRIVE_ENABLE_DESTRUCTIVE flag (true → full, otherwise safe-write), so existing installs keep their execution behavior on upgrade: every tool that ran before still runs, and every tool gated before is still gated. The one observable change at the unset default (safe-write) is that the 32 destructive tools — already refused at execution unless enabled — are now also hidden from tools/list rather than listed-then-refused (so the listed surface is 123, not 155). An unrecognized PIPEDRIVE_MODE value falls back to read-only.
3. Start Using
Once configured, Claude can access your Pipedrive data:
- "Show me open deals worth more than $10,000"
- "Create a deal called 'Acme Contract' with value $50,000"
- "Find all contacts at TechCorp"
- "List recent email threads in my inbox"
- "What custom fields are defined for deals?"
Connected account
The API token decides which Pipedrive company you are talking to, and until now nothing in a tool result said which one that was. Two registrations of this server in the same client (say, a project-scoped entry and a local-scoped one that reads a stale .env) resolve to different companies, and the one that loses precedence is invisible. The server now names the account it actually resolved, in two places.
On startup, one line on stderr:
If the check fails, that line says so (Could not verify connected account: ...) instead of the server starting silently. If the API key is missing or malformed it reports that the account was not checked, because no request was made.
On the first tool response after the boot check settles, a one-shot connection block naming the same company, so the agent knows which account the data came from without being asked and without spending a tool call. It is emitted once per process. The check runs in the background, so any tool call that finishes while it is still in flight is returned unchanged and the block lands on a later response instead. Treat it as a fact the server volunteers once it knows, not as a guarantee that every early response carries it. Delivery is also not consumption: a host that passes the block through unchanged still leaves it to the model whether to act on it, and smaller models skip it on some runs.
Inside that block, company_id and verified are asserted by the server and sit at the top level. The display strings the server cannot vouch for - company_name and user_email, or reason when the check did not succeed - are nested under untrusted_display, because a company name is CRM content that anyone with write access to the account can set. If you parse the block, bind everything under that key to the same trust level you give data. See SECURITY.md.
The check is a single GET /v1/users/me at boot, capped at one attempt with a 10-second timeout. It never blocks startup and never fails a tool call. Nothing is checked against an expected value: verified: true means the token resolved to an account, not to the right one.
To read the same information on demand, call pipedrive_get_current_user, which returns the connected company's name, id, and domain alongside the token owner's user details.
For contributors: the banner line and the notice both carry a real Pipedrive company id. If you paste either into a document in this repo, that document belongs in gitignored docs/private/ (see CLAUDE.md), not in the public tree.
Available Tools
155 tools. 🔒 destructive (require PIPEDRIVE_MODE=full, off by default) · ⭑ requires a Growth+ plan. The active capability mode governs which tools are listed.
This section is generated by npm run gen:docs from the live tool registry. Do not edit by hand - CI fails on drift.
Deals
Persons
Organizations
Activities
Notes
Leads
Projects
Products
Tasks
Boards & Phases
Fields
Pipelines & Stages
Users
Example Workflows
Analyze Deal Pipeline
Customer Research
Activity Management
Field Discovery
Development
Local Setup
Build & Run
Development Mode
Test with MCP Inspector
API Versioning
This server uses both Pipedrive API versions, routing each call to the correct one automatically:
- v2 (
/api/v2): Deals, Persons, Organizations, Activities, Products, Projects, Tasks, Boards & Phases, Fields, Pipelines & Stages, and Leads search - v1 (
/v1): Mail, Notes, Users, and Leads CRUD
Pipedrive is sunsetting v1. Selected v1 endpoints that have v2 equivalents reach end-of-life on 2025-12-31, with full v1 sunset expected around 2026-07-31; the v1 surfaces above (Mail, Notes, Users, Leads CRUD) have no v2 replacement yet. See docs/v1-only-capabilities.md for details.
Error Handling
Errors are returned with actionable suggestions:
Common error codes:
MISSING_API_KEY- Set PIPEDRIVE_API_KEY environment variableINVALID_API_KEY- Check your API key in Pipedrive settingsNOT_FOUND- The requested resource doesn't existRATE_LIMITED- Wait 60 seconds before retryingVALIDATION_ERROR- Check your request parameters
Security
See SECURITY.md for the threat model (data flows, credential handling, prompt-injection honesty, the AI/agent attack-surface catalog, operator best practices, and known limitations) and how to report a vulnerability privately. In short: STDIO-only with no network listener, the API token is read from the environment and never logged, destructive operations are gated off by default, and CRM tool output is structurally labeled as untrusted (an advisory mitigation, not a guarantee, see the residual-risk note).
For least-privilege deployment, mint the token from a dedicated, restricted Pipedrive user, keep destructive ops disabled unless needed, and isolate the agent's context so a prompt injection in CRM data has no exfiltration channel. See Operator best practices.
Contributing
See CONTRIBUTING.md for guidelines.
License
MIT - see LICENSE
Links
Source: README.md at commit d13476d
Tools
0Version history
2- v2.7.1LatestSep 26, 2026
- v2.7.0Sep 16, 2026
Score
50% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
- Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
- Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts