@elitedcs/ghl-mcp 3.4.0 → 3.4.1

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 3.4.1 — fixes from real-world testing of v3.4.0 tools
+
+**175 tools across 38 modules. Bundle: 275.2 KB.**
+
+Two bugs caught when exercising v3.4.0's `health_check` and `validate_workflow` end-to-end against a real sandbox workflow:
+
+1. **`health_check` API-key probe used the wrong endpoint.** `/locations/search` is agency-level — sub-account Private Integration keys (the kind buyers have) get 403, not 200, even when the key is fine. Fixed to use `/locations/{locationId}` which sub-account keys can call. Also added explicit handling for 403 with a clearer message ("doesn't have access to this location" vs. just "limited").
+
+2. **`validate_workflow` errored when checking workflow references.** Called `builderClient.listWorkflowsFull()`, which doesn't exist — the actual method is `listWorkflows()`. Any workflow containing a `remove_from_workflow` action or a trigger with an `add_to_workflow` reference would crash the validator. Fixed.
+
+Also: `src/index.ts` startup `validateApiKey()` had the same wrong-endpoint bug as `health_check`; fixed for consistency. Buyers will now see "API key validated" or a clear 403 message on startup instead of silent ambiguity.
+
+### Verified end-to-end
+Re-ran the spawn-handshake test against QA Test Clinic v3:
+- `health_check` returns 5/5 PASS ("All systems go.")
+- `validate_workflow` on the CLL Onboarding Form Submitted workflow correctly scans 2 references (form.id + self-referencing workflow.id), reports 0 issues, surfaces the self-reference as an informational note.
+
+### Files changed
+- `src/tools/diagnostics.ts` — endpoint fix + 403 handling
+- `src/tools/validators.ts` — method name fix
+- `src/index.ts` — same endpoint fix in startup probe
+
 ## 3.4.0 — health_check tool + validate_workflow expansion + smoke-test CI
 
 **175 tools across 38 modules. Bundle: 274.6 KB.**

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.4.0",
+      version: "3.4.1",
       description: "GoHighLevel MCP Server for Claude. 175 tools \u2014 full CRM, automation, marketing control, and the only programmatic GHL workflow builder.",
       main: "dist/index.js",
       bin: {
@@ -6135,7 +6135,7 @@ function registerValidatorTools(server2, client, builderClient) {
           fetches.users = client.get("/users/", { params: { locationId: locationId2 } });
         }
         if (refCategories.has("workflow")) {
-          fetches.workflows = builderClient.listWorkflowsFull();
+          fetches.workflows = builderClient.listWorkflows(200);
         }
         if (refCategories.has("form")) {
           fetches.forms = client.get("/forms/", { params: { locationId: locationId2 } });
@@ -6304,8 +6304,12 @@ function registerDiagnosticTools(server2, installedVersion, client, builderClien
       const checks = [];
       const versionPromise = getVersionStatus(installedVersion);
       const apiKeyPromise = (async () => {
+        const locId = client.defaultLocationId;
+        if (!locId) {
+          return { name: "GHL API key", status: "warn", detail: `Can't validate without a default location ID. Set GHL_LOCATION_ID or run setup_ghl_mcp.` };
+        }
         try {
-          const response = await fetch("https://services.leadconnectorhq.com/locations/search", {
+          const response = await fetch(`https://services.leadconnectorhq.com/locations/${locId}`, {
             method: "GET",
             headers: {
               Authorization: `Bearer ${client.getApiKey()}`,
@@ -6318,8 +6322,11 @@ function registerDiagnosticTools(server2, installedVersion, client, builderClien
           if (response.status === 401) {
             return { name: "GHL API key", status: "fail", detail: `401 Unauthorized \u2014 key ${client.getApiKeyPrefix()} is invalid or revoked. Run setup_ghl_mcp with a fresh key.` };
           }
+          if (response.status === 403) {
+            return { name: "GHL API key", status: "fail", detail: `403 Forbidden \u2014 key ${client.getApiKeyPrefix()} doesn't have access to location ${locId}. The key may belong to a different sub-account.` };
+          }
           if (!response.ok) {
-            return { name: "GHL API key", status: "warn", detail: `HTTP ${response.status} from /locations/search \u2014 key may be limited or GHL is having issues.` };
+            return { name: "GHL API key", status: "warn", detail: `HTTP ${response.status} reading /locations/${locId} \u2014 key may be limited or GHL is having issues.` };
           }
           return { name: "GHL API key", status: "pass", detail: `Valid (key ${client.getApiKeyPrefix()}).` };
         } catch (error) {
@@ -6767,9 +6774,9 @@ if (inBootstrapMode) {
   }
 }
 async function validateApiKey() {
-  if (!apiKey) return;
+  if (!apiKey || !locationId) return;
   try {
-    const response = await fetch("https://services.leadconnectorhq.com/locations/search", {
+    const response = await fetch(`https://services.leadconnectorhq.com/locations/${locationId}`, {
       method: "GET",
       headers: {
         Authorization: `Bearer ${apiKey}`,
@@ -6781,6 +6788,9 @@ async function validateApiKey() {
     });
     if (response.status === 401) {
       process.stderr.write("[ghl-mcp] WARNING: API key is invalid (401 Unauthorized). Tools will fail.\n");
+    } else if (response.status === 403) {
+      process.stderr.write(`[ghl-mcp] WARNING: API key doesn't have access to location ${locationId} (403 Forbidden).
+`);
     } else if (response.ok) {
       process.stderr.write("[ghl-mcp] API key validated.\n");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "GoHighLevel MCP Server for Claude. 175 tools — full CRM, automation, marketing control, and the only programmatic GHL workflow builder.",
   "main": "dist/index.js",
   "bin": {