Pipedrive CRM

Pipedrive MCP Server

[npm version] [CI] [tests] [license: MIT]

An MCP (Model Context Protocol) server for Pipedrive CRM integration with Claude Code and Claude Desktop. Query, create, and update CRM data directly from your AI assistant.

Why this server

• API v2-first. Every entity uses Pipedrive's v2 REST API where it exists; v1 is used only for the capabilities that have no v2 equivalent (notes, mail, users, and leads CRUD). See API Versioning.
• Contract-tested against the real OpenAPI spec. Request params, request bodies, and response shapes are checked against the vendored Pipedrive OpenAPI v2 definition (docs/api/openapi-v2.yaml) in tests/contract/, so the v2 tools can't silently drift from the documented API.
• Live-smoke verified. The tool surface is broadly exercised against a real Pipedrive account (scripts/smoke-coverage.ts), with only API-unseedable surfaces (e.g. mail threads, project templates) left to manual checks. Coverage includes plan-gated endpoints such as Growth+ deal installments (scripts/smoke-installments.ts). Key write smokes (e.g. the task is_done flag) assert the field value actually changed on the wire, not just a 200.
• Server-enforced capability modes. PIPEDRIVE_MODE picks a safety tier — read-only, safe-write (the default: reads + non-destructive writes), or full — and out-of-mode tools are both hidden from tools/list and refused if called directly. Deletes, conversions, and other irreversible writes (🔒 in the tool table) require full, so the server is read-and-create only out of the box. Every tool also carries MCP annotations (readOnlyHint/destructiveHint/idempotentHint) so policy-aware clients can tell reads from writes from deletes. See Capability modes.
• MIT licensed, published with npm build provenance.

Honest limitations. Transport is STDIO only today (a Streamable HTTP flag is planned), and auth is via a Pipedrive API key, which matches the local/self-hosted tier this server targets. There is no hosted OAuth offering yet.

Features

• Full CRM Operations: Deals, persons, organizations, activities
• Email Analysis: Access mail threads and messages for engagement analysis
• Field Discovery: Map custom field hash codes to human-readable names
• Pipeline Management: List pipelines, stages, and users
• Pagination Support: Cursor-based pagination for large datasets
• Error Handling: Clear, actionable error messages

Quick Start

Fastest setup: npx … init

Run the one-command guided installer and follow the prompts. It opens the Pipedrive API-token page, validates your key live against your account, and generates a working MCP config for your client (Claude Desktop, Claude Code, Cursor, Windsurf, or VS Code):

npx -y @ckalima/pipedrive-mcp-server init

It always prints a paste-ready block and can optionally write it into your client's config file after a timestamped backup. Committed/shared config files use ${PIPEDRIVE_API_KEY} indirection, never a raw key. Prefer to configure by hand? The manual steps below still work.

1. Get Your Pipedrive API Key

1. Log into Pipedrive
2. Go to Settings > Personal preferences > API
3. Copy your API key (40 characters)

2. Configure Claude Code

Add to your .mcp.json file:

{  "mcpServers": {    "pipedrive": {      "command": "npx",      "args": ["-y", "@ckalima/pipedrive-mcp-server"],      "env": {        "PIPEDRIVE_API_KEY": "your-40-character-api-key"      }    }  }}

Package name: the supported package is the scoped @ckalima/pipedrive-mcp-server. If you arrived from an older snippet that referenced the unscoped pipedrive-mcp-server, update your config to the scoped name above — the unscoped name is a different, unrelated package.

You can also start it directly to verify your setup:

npx -y @ckalima/pipedrive-mcp-server

Or set the environment variable:

export PIPEDRIVE_API_KEY="your-40-character-api-key"

Environment Variables

To enable destructive tools, set PIPEDRIVE_MODE=full (or, for back-compat, PIPEDRIVE_ENABLE_DESTRUCTIVE=true) in the env block of your .mcp.json alongside PIPEDRIVE_API_KEY. Below full, every 🔒 tool returns a DESTRUCTIVE_DISABLED error instead of acting, and tools above the active tier return a MODE_RESTRICTED error.

Capability modes

PIPEDRIVE_MODE sets a server-enforced safety tier. The tier is enforced two ways: out-of-mode tools are filtered out of tools/list (so the agent never sees them) and the dispatcher refuses any out-of-mode call by name before its handler runs, so the tier is a real guarantee rather than a UI hint.

Recommended for first-time setup and agent evaluation: read-only. Let the agent look before it can touch anything, then widen the tier as you build trust.

Backward compatibility. PIPEDRIVE_MODE is authoritative when set. When it is unset, the mode is derived from the legacy PIPEDRIVE_ENABLE_DESTRUCTIVE flag (true → full, otherwise safe-write), so existing installs keep their execution behavior on upgrade: every tool that ran before still runs, and every tool gated before is still gated. The one observable change at the unset default (safe-write) is that the 32 destructive tools — already refused at execution unless enabled — are now also hidden from tools/list rather than listed-then-refused (so the listed surface is 123, not 155). An unrecognized PIPEDRIVE_MODE value falls back to read-only.

3. Start Using

Once configured, Claude can access your Pipedrive data:

• "Show me open deals worth more than $10,000"
• "Create a deal called 'Acme Contract' with value $50,000"
• "Find all contacts at TechCorp"
• "List recent email threads in my inbox"
• "What custom fields are defined for deals?"

Connected account

The API token decides which Pipedrive company you are talking to, and until now nothing in a tool result said which one that was. Two registrations of this server in the same client (say, a project-scoped entry and a local-scoped one that reads a stale .env) resolve to different companies, and the one that loses precedence is invisible. The server now names the account it actually resolved, in two places.

On startup, one line on stderr:

[pipedrive-mcp-server] Connected as [email protected] -> company "Example Corp" (id 12345)

If the check fails, that line says so (Could not verify connected account: ...) instead of the server starting silently. If the API key is missing or malformed it reports that the account was not checked, because no request was made.

On the first tool response after the boot check settles, a one-shot connection block naming the same company, so the agent knows which account the data came from without being asked and without spending a tool call. It is emitted once per process. The check runs in the background, so any tool call that finishes while it is still in flight is returned unchanged and the block lands on a later response instead. Treat it as a fact the server volunteers once it knows, not as a guarantee that every early response carries it. Delivery is also not consumption: a host that passes the block through unchanged still leaves it to the model whether to act on it, and smaller models skip it on some runs.

Inside that block, company_id and verified are asserted by the server and sit at the top level. The display strings the server cannot vouch for - company_name and user_email, or reason when the check did not succeed - are nested under untrusted_display, because a company name is CRM content that anyone with write access to the account can set. If you parse the block, bind everything under that key to the same trust level you give data. See SECURITY.md.

The check is a single GET /v1/users/me at boot, capped at one attempt with a 10-second timeout. It never blocks startup and never fails a tool call. Nothing is checked against an expected value: verified: true means the token resolved to an account, not to the right one.

To read the same information on demand, call pipedrive_get_current_user, which returns the connected company's name, id, and domain alongside the token owner's user details.

For contributors: the banner line and the notice both carry a real Pipedrive company id. If you paste either into a document in this repo, that document belongs in gitignored docs/private/ (see CLAUDE.md), not in the public tree.

Available Tools

155 tools. 🔒 destructive (require PIPEDRIVE_MODE=full, off by default) · ⭑ requires a Growth+ plan. The active capability mode governs which tools are listed.

_{This section is generated by npm run gen:docs from the live tool registry. Do not edit by hand - CI fails on drift.}

Deals

Persons

Organizations

Activities

Notes

Leads

Projects

Products

Tasks

Boards & Phases

Mail

Fields

Pipelines & Stages

Users

Example Workflows

Analyze Deal Pipeline

"Show me all open deals in the Sales pipeline, sorted by value""Get details for deal 12345 including custom fields""Move deal 12345 to the Proposal stage"

Customer Research

"Find contacts at Acme Corp""Get emails for person 456 to analyze their engagement""What custom fields do we have for persons?"

Activity Management

"List my overdue activities""Create a follow-up call with John Smith for tomorrow at 2pm""Mark activity 789 as done"

Field Discovery

"List all custom fields for deals""What does field '8a4d7f...' mean?" (40-char hash)

Development

Local Setup

git clone https://github.com/ckalima/pipedrive-mcp-server.gitcd pipedrive-mcp-servernpm installcp .env.example .env# Edit .env with your API key

Build & Run

npm run buildnpm run start

Development Mode

npm run dev

Test with MCP Inspector

npx @modelcontextprotocol/inspector node dist/index.js

API Versioning

This server uses both Pipedrive API versions, routing each call to the correct one automatically:

• v2 (/api/v2): Deals, Persons, Organizations, Activities, Products, Projects, Tasks, Boards & Phases, Fields, Pipelines & Stages, and Leads search
• v1 (/v1): Mail, Notes, Users, and Leads CRUD

Pipedrive is sunsetting v1. Selected v1 endpoints that have v2 equivalents reach end-of-life on 2025-12-31, with full v1 sunset expected around 2026-07-31; the v1 surfaces above (Mail, Notes, Users, Leads CRUD) have no v2 replacement yet. See docs/v1-only-capabilities.md for details.

Error Handling

Errors are returned with actionable suggestions:

{  "error": {    "code": "INVALID_API_KEY",    "message": "API key is invalid or expired",    "suggestion": "Verify your API key at Pipedrive Settings > Personal preferences > API"  }}

Common error codes:

• MISSING_API_KEY - Set PIPEDRIVE_API_KEY environment variable
• INVALID_API_KEY - Check your API key in Pipedrive settings
• NOT_FOUND - The requested resource doesn't exist
• RATE_LIMITED - Wait 60 seconds before retrying
• VALIDATION_ERROR - Check your request parameters

Security

See SECURITY.md for the threat model (data flows, credential handling, prompt-injection honesty, the AI/agent attack-surface catalog, operator best practices, and known limitations) and how to report a vulnerability privately. In short: STDIO-only with no network listener, the API token is read from the environment and never logged, destructive operations are gated off by default, and CRM tool output is structurally labeled as untrusted (an advisory mitigation, not a guarantee, see the residual-risk note).

For least-privilege deployment, mint the token from a dedicated, restricted Pipedrive user, keep destructive ops disabled unless needed, and isolate the agent's context so a prompt injection in CRM data has no exfiltration channel. See Operator best practices.

Contributing

See CONTRIBUTING.md for guidelines.

License

MIT - see LICENSE

Links

• Pipedrive API Documentation
• MCP Protocol
• Security Policy
• Report Issues