@elitedcs/ghl-mcp 3.49.0 → 3.50.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 3.50.0 — FREE read-only tier
+
+A free license (`ghlcommand.com/free`, key by email, no card) now runs the same
+npm package in read-only mode on the user's own GHL account.
+
+- **Tier gating in the tool registry** (`tool-filter.ts`, second axis alongside
+  the env allowlist). Free tier: every read-only tool works for real — all
+  `get_*`/`list_*`/`search_*` plus `audit_workflows`, `validate_workflow`,
+  `get_account_health_summary`, `compare_locations`, `verify_funnel`,
+  `check_blog_slug`, `workflow_builder_status`. That's **105 usable tools with
+  the Firebase login (87 before it)**, enumerated from the registry by the
+  drift-guard test. Write tools still register with full schemas but their
+  handlers return a clean upgrade message (checkout link, same-key upgrade
+  note) — never a stack trace, never a half-executed write. Excluded from free
+  by design: `export_account`, the whole Blueprint (`intake-to-build`) module,
+  and the multi-location registry writes (`register_location`,
+  `register_agency_key`, `switch_location`, …) — free is 1 location, 1 machine.
+- **Tier is cryptographically bound.** The license server now signs `tier`
+  inside the Ed25519 attestation payload; the MCP derives the session tier ONLY
+  from a verified attestation (legacy attestations without the field = 'full').
+  Hand-editing credentials.json cannot unlock writes. Old MCP versions ignore
+  the extra payload field — fully backward compatible.
+- **Firebase capture stays available on free** (`capture_firebase_interactive`,
+  `enable_workflow_builder`, `auto_capture_firebase_script`): the one-time GHL
+  login is what powers the read-only auditor suite. Builder writes stay gated.
+- **setup_ghl_mcp / request_license** are tier-aware: free installs see the
+  read-only counts and the auditor-unlock next step; request_license now offers
+  the free tier (`ghlcommand.com/free`) alongside purchase.
+- **Drift guard extended** (`tool-count.test.ts`): free-tier counts (105/87)
+  are computed from the registry and asserted against README + setup-tool copy;
+  a classification change breaks the build until the claims are re-synced. The
+  ghlcommand.com `/free` page and the key-delivery email carry the same number —
+  re-sync those manually when this test moves (different repos).
+- Server side (elite-dcs/website + Supabase, deployed separately): `licenses.status`
+  gains `'free'`; `register_device` returns the row status; `validate-license`
+  returns + signs `tier`; the Stripe webhook upgrades a free row IN PLACE on
+  purchase (same key, installs 1→3, `source: stripe_97mo_from_free`) — proven
+  against a live throwaway row and a mocked-fetch webhook harness. New
+  `/api/free-license` provisioning endpoint (signup → row → key email → 3NA51
+  tag `ghl-command-free-tier`).
+
+## 3.49.1 — Docs patch: one-click capture is now the primary Milestone-2 path
+
+No behavior changes; text only.
+
+- README "Enable the Workflow Builder": `capture_firebase_interactive` (log into a
+  Chrome window, zero pasting) is the supported path; the console-paste script is
+  demoted to a collapsed fallback (still the path for locked-down machines and for
+  capturing CLIENT accounts in multi-tenant). Rotation note now points at the
+  silent re-capture.
+- `enable_workflow_builder` and `auto_capture_firebase_script` tool descriptions
+  point to `capture_firebase_interactive` first.
+
+
 ## 3.49.0 — One-click Workflow Builder unlock (`capture_firebase_interactive`)
 
 The buyer's whole job is now: log into GHL in a Chrome window the tool opens.

package/README.md

@@ -8,6 +8,8 @@ Works with **both the Claude Desktop App and Claude Code terminal** — your cho
 
 **License required.** Get it at [ghlcommand.com](https://ghlcommand.com?utm_source=npm&utm_medium=readme) — $97/mo, covering UNLIMITED GoHighLevel sub-accounts on up to 3 machines (never billed per account). **30-day time-back guarantee**: save 5+ hours on one client build or your first month back.
 
+**Try it FREE (read-only tier).** Grab an instant free key at [ghlcommand.com/free](https://ghlcommand.com/free?utm_source=npm&utm_medium=readme) — 105 read-only tools on your own GHL account (87 before the one-login auditor unlock): the account-wide workflow audit (`audit_workflows` finds the silently broken references GHL never warns you about), account health, and every read across contacts, pipelines, funnels, and workflows. Write tools stay visible and answer with upgrade info. Buying later with the same email upgrades your key in place — 1 machine on free, 3 when you upgrade.
+
 Built by [Elite DCs, LLC](https://elitedcs.com).
 
 ---
@@ -158,7 +160,16 @@ https://app.gohighlevel.com/v2/location/YOUR_LOCATION_ID/dashboard
 
 The builder + cloner + validator tools (workflow builder, funnel builder, form builder, pipeline builder, workflow cloner, validate_workflow) use GHL's internal API and require Firebase credentials. Without them, the other 177 tools work fine — you just won't have workflow/funnel/form/pipeline editing. This is the flagship feature: do this step.
 
-**One-paste capture (the supported path):**
+**One-click capture (v3.49.0+, the supported path):**
+
+1. In Claude, ask: `Run capture_firebase_interactive`. Your installed Chrome opens a dedicated window on the GHL login page (no browser download; it never touches your daily browsing profile).
+2. Log into your GHL account in that window. That's the whole job — the tool reads the three Firebase values itself, validates them against Firebase, and saves them. If the call says it's still waiting, finish logging in and run the same tool again.
+3. Restart Claude. The Firebase-gated tools are live.
+
+> Firebase refresh tokens can rotate. If workflow tools stop working after a few weeks (`health_check` shows Firebase auth: FAIL), just re-run `capture_firebase_interactive` — after your first login it re-captures silently, no window at all.
+
+<details>
+<summary><strong>Console-paste fallback</strong> (no Chrome/Edge installed, the window path fails, or you're capturing a CLIENT account for multi-tenant)</summary>
 
 1. In Claude, ask: `Run auto_capture_firebase_script`. It returns a small browser-console script.
 2. In Chrome, open a tab logged into your GHL account. Press **F12** (Windows) or **Cmd+Option+I** (Mac), click the **Console** tab, paste the script, press Enter. If Chrome blocks the paste, type `allow pasting` in the Console first, then paste again.
@@ -168,7 +179,7 @@ The builder + cloner + validator tools (workflow builder, funnel builder, form b
 
 Screenshots and the same script behind a copy button: [elitedcs.com/ghl-mcp-firebase](https://elitedcs.com/ghl-mcp-firebase)
 
-> Firebase refresh tokens can rotate. If workflow tools stop working after a few weeks (`health_check` shows Firebase auth: FAIL), re-run `auto_capture_firebase_script` for fresh values and pass them to `enable_workflow_builder` again.
+</details>
 
 <details>
 <summary><strong>Manual fallback</strong> (locked-down browsers that block console pasting or clipboard access)</summary>

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.49.0",
+      version: "3.50.0",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 229 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -1947,6 +1947,47 @@ var ALWAYS_ON_TOOL_NAMES = /* @__PURE__ */ new Set([
   "enable_workflow_builder",
   "health_check"
 ]);
+var FREE_TIER_EXTRA_READ_TOOLS = /* @__PURE__ */ new Set([
+  "audit_workflows",
+  // account-wide silent-failure audit — the free tier's wow moment
+  "validate_workflow",
+  // single-workflow pre-flight validation (read-only)
+  "compare_locations",
+  // cross-location config diff (reads only)
+  "verify_funnel",
+  // live funnel QA (reads + public URL probes)
+  "check_blog_slug",
+  // slug availability lookup
+  "workflow_builder_status"
+  // no-Firebase fallback diagnostic (pure status read)
+]);
+var FREE_TIER_EXCLUDED_TOOLS = /* @__PURE__ */ new Set([
+  "export_account"
+  // full-account export is a paid capability
+]);
+var FREE_TIER_EXCLUDED_MODULES = /* @__PURE__ */ new Set([
+  "intake-to-build"
+  // Blueprint lane is paid end-to-end
+]);
+var READ_PREFIXES = ["get_", "list_", "search_"];
+function isFreeTierTool(toolName, moduleName) {
+  if (ALWAYS_ON_TOOL_NAMES.has(toolName)) return true;
+  if (FREE_TIER_EXCLUDED_MODULES.has(moduleName.toLowerCase())) return false;
+  if (FREE_TIER_EXCLUDED_TOOLS.has(toolName)) return false;
+  if (FREE_TIER_EXTRA_READ_TOOLS.has(toolName)) return true;
+  return READ_PREFIXES.some((p) => toolName.startsWith(p));
+}
+var FREE_TIER_DESC_SUFFIX = " [PAID TIER \u2014 this free license is read-only; calling this returns upgrade info, it will NOT perform the action.]";
+function freeTierUpgradeMessage(toolName) {
+  return [
+    `\`${toolName}\` needs the full GHL Command license \u2014 your free key is the read-only tier.`,
+    "",
+    "Free tier (what you have): every read \u2014 audits, account health, pipelines, contacts, conversations, funnels, workflows \u2014 on your own account.",
+    "Full tier ($97/mo founding rate): Claude actually builds and fixes things \u2014 workflows, funnels, forms, pipelines, campaigns \u2014 plus the Workflow Builder, multi-location, and 3-machine activation.",
+    "",
+    "Upgrade at https://ghlcommand.com with the SAME email you used for the free key \u2014 your license upgrades in place (no reinstall, same key). Then fully restart Claude and this tool goes live."
+  ].join("\n");
+}
 function parseList(raw) {
   if (raw === void 0) return null;
   const items = raw.split(/[,\s]+/).map((x) => x.trim().toLowerCase()).filter((x) => x.length > 0);
@@ -1974,7 +2015,7 @@ function shouldRegister(toolName, moduleName, config3) {
   const toolEnabled = config3.enabledTools?.has(toolLower) ?? false;
   return moduleEnabled || toolEnabled;
 }
-function wrapServerForModule(realServer, moduleName, config3, attemptedTools, registeredTools) {
+function wrapServerForModule(realServer, moduleName, config3, attemptedTools, registeredTools, tier = "full", gatedTools) {
   return new Proxy(realServer, {
     get(target, prop, receiver) {
       if (prop === "tool") {
@@ -1984,7 +2025,21 @@ function wrapServerForModule(realServer, moduleName, config3, attemptedTools, re
             return void 0;
           }
           registeredTools.add(name);
-          return target.tool(name, ...rest);
+          let args = rest;
+          if (tier === "free" && !isFreeTierTool(name, moduleName)) {
+            gatedTools?.add(name);
+            args = [...rest];
+            const last = args.length - 1;
+            if (last >= 0 && typeof args[last] === "function") {
+              args[last] = async () => ({
+                content: [{ type: "text", text: freeTierUpgradeMessage(name) }]
+              });
+            }
+            if (typeof args[0] === "string") {
+              args[0] = args[0] + FREE_TIER_DESC_SUFFIX;
+            }
+          }
+          return target.tool(name, ...args);
         };
       }
       return Reflect.get(target, prop, receiver);
@@ -7146,6 +7201,7 @@ async function validateLicense(email, licenseKey) {
     return {
       ok: true,
       installs: `${data.installs_used}/${data.installs_max}`,
+      tier: data.tier === "free" ? "free" : data.tier === "full" ? "full" : void 0,
       signedAttestation: typeof data.signed_attestation === "string" ? data.signed_attestation : void 0
     };
   }
@@ -7279,24 +7335,27 @@ Note: Firebase credentials rejected (${fb.error}). Saved without Workflow Builde
         // verified on every MCP startup. Closes the hand-crafted creds bypass.
         signed_attestation: lic.signedAttestation
       });
-      const toolCount = workflowBuilderEnabled ? "229" : "177";
+      const isFree = lic.tier === "free";
+      const toolCount = isFree ? workflowBuilderEnabled ? "105" : "87" : workflowBuilderEnabled ? "229" : "177";
       const wfLine = workflowBuilderEnabled ? "Workflow Builder: enabled." : "Workflow Builder: not configured (optional).";
-      const wfTip = workflowBuilderEnabled ? "" : "\nTo enable Workflow Builder later (49 extra Firebase-gated tools): run enable_workflow_builder with your three Firebase values. No need to re-enter license/API key/location ID.";
+      const wfTip = workflowBuilderEnabled ? "" : isFree ? `
+Unlock the account auditor next (the free tier's best tool): say "Unlock the Workflow Builder" \u2014 one browser login enables audit_workflows, validate_workflow, and the full-detail reads.` : "\nTo enable Workflow Builder later (52 extra Firebase-gated tools): run enable_workflow_builder with your three Firebase values. No need to re-enter license/API key/location ID.";
+      const freeTip = isFree ? "\n\nFree tier: 105 read-only tools (87 before the one-login auditor unlock). Write tools stay visible but answer with upgrade info instead of acting. Full version ($97/mo founding rate, same key upgrades in place): https://ghlcommand.com" : "";
       return {
         content: [{
           type: "text",
           text: [
             `Setup complete!`,
             ``,
-            `License: verified (installs ${lic.installs}).`,
+            `License: verified (installs ${lic.installs})${isFree ? " \u2014 FREE read-only tier" : ""}.`,
             `GHL: connected to "${ghl.locationName}".`,
             wfLine,
             ``,
             `Credentials saved to: ${credentialsPath()}`,
             ``,
-            `**Restart Claude (quit fully and reopen) to load all ${toolCount} tools.**`,
+            `**Restart Claude (quit fully and reopen) to load all ${toolCount} ${isFree ? "read-only " : ""}tools.**`,
             ``,
-            `After restart, try: "List my GHL contacts" or "Show my pipelines".${wfTip}`,
+            `After restart, try: "List my GHL contacts" or "Show my pipelines".${wfTip}${freeTip}`,
             workflowBuilderNote
           ].join("\n")
         }]
@@ -7307,7 +7366,7 @@ Note: Firebase credentials rejected (${fb.error}). Saved without Workflow Builde
 function registerEnableWorkflowBuilderTool(server2) {
   server2.tool(
     "enable_workflow_builder",
-    "Add Firebase credentials to an existing GHL Command install to unlock 52 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. Requires you've already run setup_ghl_mcp. EASIEST PATH: run `auto_capture_firebase_script` first, paste the JSON output into `firebase_paste` here. MANUAL PATH: capture the three Firebase fields via DevTools and pass them individually. Tool count goes from 177 to 229 after the next Claude restart.",
+    "Add Firebase credentials to an existing GHL Command install to unlock 52 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 177 to 229 after the next Claude restart.",
     {
       // v3.25.0: one-paste path. Tool runs `auto_capture_firebase_script` to
       // get the console script; the script returns a JSON object that pastes
@@ -7400,7 +7459,7 @@ DevTools steps: https://elitedcs.com/ghl-mcp-firebase`
 function registerFirebaseCaptureScriptTool(server2) {
   server2.tool(
     "auto_capture_firebase_script",
-    "Get the browser-console script that auto-extracts the 3 Firebase fields needed to enable the Workflow Builder. Run this, copy the script, paste it into Chrome DevTools Console on a tab logged into GHL, press Enter, and the result lands in your clipboard. Then paste the JSON into setup_ghl_mcp's firebase_paste field (or enable_workflow_builder's). No manual IndexedDB digging.",
+    "Get the browser-console script that auto-extracts the 3 Firebase fields needed to enable the Workflow Builder. PREFER `capture_firebase_interactive` when Chrome/Edge is installed (one-click, zero pasting); this script is the fallback for locked-down machines and the path for capturing a CLIENT account's Firebase (multi-tenant). Run this, copy the script, paste it into Chrome DevTools Console on a tab logged into GHL, press Enter, and the result lands in your clipboard. Then paste the JSON into setup_ghl_mcp's firebase_paste field (or enable_workflow_builder's).",
     {},
     async () => {
       const steps = [
@@ -7437,7 +7496,7 @@ function registerFirebaseCaptureScriptTool(server2) {
 function registerInteractiveCaptureTool(server2) {
   server2.tool(
     "capture_firebase_interactive",
-    "One-click Workflow Builder unlock (EASIEST PATH \u2014 try this before auto_capture_firebase_script). Opens a Chrome window where you just log into GHL; the MCP captures the Firebase credentials itself and saves them. No DevTools, no pasting. Re-run the same tool if the first call says it's still waiting for your login. After the first successful run, future re-captures (refresh-token rotations) happen silently with no window at all. Falls back cleanly: if no Chrome/Edge is installed, use auto_capture_firebase_script instead.",
+    "One-click Workflow Builder unlock (EASIEST PATH \u2014 try this before auto_capture_firebase_script). Also the unlock for the FREE tier's account auditor (audit_workflows, validate_workflow) \u2014 same one-time login. Opens a Chrome window where you just log into GHL; the MCP captures the Firebase credentials itself and saves them. No DevTools, no pasting. Re-run the same tool if the first call says it's still waiting for your login. After the first successful run, future re-captures (refresh-token rotations) happen silently with no window at all. Falls back cleanly: if no Chrome/Edge is installed, use auto_capture_firebase_script instead.",
     {},
     async () => {
       const existing = readCredentials();
@@ -7568,7 +7627,7 @@ ${fallbackNote}`
 function registerLeadCaptureTool(server2) {
   server2.tool(
     "request_license",
-    "Get a GHL Command license. Use this if you installed from npm but don't have a license yet (or setup_ghl_mcp says your license is missing/invalid). GHL Command is $97/mo \u2014 every sub-account you manage, 3-machine activation, includes the only programmatic GHL workflow builder. Leave your email and we'll send the purchase link + setup help; the tool also returns where to buy right now.",
+    "Get a GHL Command license. Use this if you installed from npm but don't have a license yet (or setup_ghl_mcp says your license is missing/invalid). GHL Command is $97/mo \u2014 every sub-account you manage, 3-machine activation, includes the only programmatic GHL workflow builder. There's also a FREE read-only tier (account audits + all reads on your own account) \u2014 instant key at https://ghlcommand.com/free. Leave your email and we'll send the purchase link + setup help; the tool also returns where to buy right now.",
     {
       email: import_zod39.z.string().email().describe("Your email \u2014 where to send the purchase link and setup help."),
       name: import_zod39.z.string().optional().describe("Your name (optional).")
@@ -7592,6 +7651,7 @@ function registerLeadCaptureTool(server2) {
               "GHL Command is $97/mo: every sub-account you manage, 3 machines, including the only programmatic GHL workflow builder. Cancel anytime.",
               "",
               `Buy now: ${url}`,
+              "Want to try it first? FREE read-only tier (account audits + every read tool on your own account): https://ghlcommand.com/free",
               "Your license key arrives by email within a couple minutes. Then run setup_ghl_mcp with your email + key."
             ].join("\n")
           }]
@@ -13986,11 +14046,12 @@ var KNOWN_MODULES = /* @__PURE__ */ new Set([
   LOCATION_SWITCHER_MODULE,
   SNAPSHOTS_MODULE
 ]);
-function registerAllTools(server2, client, registry2, mcpVersion, env = process.env) {
+function registerAllTools(server2, client, registry2, mcpVersion, env = process.env, tier = "full") {
   const config3 = parseAllowlist(env);
   const attemptedTools = /* @__PURE__ */ new Set();
   const registeredTools = /* @__PURE__ */ new Set();
-  const wrap = (moduleName) => wrapServerForModule(server2, moduleName, config3, attemptedTools, registeredTools);
+  const gatedTools = /* @__PURE__ */ new Set();
+  const wrap = (moduleName) => wrapServerForModule(server2, moduleName, config3, attemptedTools, registeredTools, tier, gatedTools);
   for (const [register, moduleName] of publicApiTools) {
     register(wrap(moduleName), client);
   }
@@ -14020,6 +14081,13 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
   if (isAllowlistActive(config3)) {
     validateAndLog(config3, KNOWN_MODULES, attemptedTools, registeredTools);
   }
+  if (tier === "free") {
+    process.stderr.write(
+      `[ghl-mcp] FREE tier: ${registeredTools.size - gatedTools.size} read-only tools live; ${gatedTools.size} write tools answer with upgrade info. Full version: https://ghlcommand.com
+`
+    );
+  }
+  return { registeredTools, gatedTools };
 }
 
 // src/attestation.ts
@@ -14027,6 +14095,9 @@ var import_node_crypto = require("node:crypto");
 var ATTESTATION_PUBLIC_KEY_B64 = "8KJo8V3Z7ngeToIQfOXpKdlr/EA34hXJVEIpW0A7wqs=";
 var ATTESTATION_VERSION = 1;
 var ATTESTATION_GRACE_DAYS = 14;
+function tierFromPayload(payload) {
+  return payload?.tier === "free" ? "free" : "full";
+}
 function deviceFingerprint2() {
   const os3 = require("node:os");
   const crypto4 = require("node:crypto");
@@ -14051,6 +14122,20 @@ async function getPublicKey() {
   );
   return cachedPublicKey;
 }
+function parseAttestationPayload(token) {
+  try {
+    const dot = token.indexOf(".");
+    if (dot <= 0 || dot === token.length - 1) return null;
+    const payloadJson = new TextDecoder().decode(base64urlDecode(token.slice(0, dot)));
+    const payload = JSON.parse(payloadJson);
+    if (typeof payload.v !== "number" || typeof payload.email !== "string" || typeof payload.license_key !== "string" || typeof payload.device_fingerprint !== "string" || typeof payload.installs_max !== "number" || typeof payload.issued_at !== "string" || typeof payload.expires_at !== "string") {
+      return null;
+    }
+    return payload;
+  } catch {
+    return null;
+  }
+}
 async function verifyAttestation(token, bindings, now = /* @__PURE__ */ new Date()) {
   if (typeof token !== "string" || !token) return { ok: false, reason: "malformed" };
   const dot = token.indexOf(".");
@@ -14538,6 +14623,8 @@ function renewAttestationInBackground(creds) {
 async function resolveAccessAndRegister() {
   let licenseVerified = false;
   let attestationStatus = "no-creds";
+  let sessionTier = "full";
+  const tierFromDisk = () => tierFromPayload(parseAttestationPayload(readCredentials()?.signed_attestation ?? ""));
   if (fileCreds?.email && fileCreds?.license_key && fileCreds.signed_attestation) {
     const verify = await verifyAttestation(fileCreds.signed_attestation, {
       email: fileCreds.email,
@@ -14546,6 +14633,7 @@ async function resolveAccessAndRegister() {
     if (verify.ok) {
       licenseVerified = true;
       attestationStatus = verify.reason;
+      sessionTier = tierFromPayload(verify.payload);
       void renewAttestationInBackground(fileCreds);
     } else {
       process.stderr.write(`[ghl-mcp] Stored attestation rejected: ${verify.reason}. Re-validating online.
@@ -14554,6 +14642,7 @@ async function resolveAccessAndRegister() {
       if (renewed === "renewed") {
         licenseVerified = true;
         attestationStatus = "renewed-after-tamper";
+        sessionTier = tierFromDisk();
       } else if (renewed === "renewed-unsigned" && Date.now() < TRANSITIONAL_ATTESTATION_DEADLINE) {
         licenseVerified = true;
         attestationStatus = "renewed-after-tamper";
@@ -14567,6 +14656,7 @@ async function resolveAccessAndRegister() {
     if (renewed === "renewed") {
       licenseVerified = true;
       attestationStatus = "renewed-from-legacy";
+      sessionTier = tierFromDisk();
     } else if (renewed === "renewed-unsigned" && Date.now() < TRANSITIONAL_ATTESTATION_DEADLINE) {
       licenseVerified = true;
       attestationStatus = "renewed-from-legacy";
@@ -14591,6 +14681,7 @@ async function resolveAccessAndRegister() {
       if (lic.ok && acceptUnsigned) {
         licenseVerified = true;
         attestationStatus = "renewed";
+        sessionTier = lic.signedAttestation ? tierFromPayload(parseAttestationPayload(lic.signedAttestation)) : lic.tier === "free" ? "free" : "full";
         try {
           writeCredentials({
             license_key: licKey,
@@ -14618,7 +14709,7 @@ async function resolveAccessAndRegister() {
     }
   }
   if (licenseVerified) {
-    process.stderr.write(`[ghl-mcp] License gate: ${attestationStatus}.
+    process.stderr.write(`[ghl-mcp] License gate: ${attestationStatus}${sessionTier === "free" ? " (FREE read-only tier)" : ""}.
 `);
   }
   inBootstrapMode = !apiKey || !locationId || !licenseVerified;
@@ -14634,7 +14725,7 @@ async function resolveAccessAndRegister() {
     registerFirebaseCaptureScriptTool(server);
   } else {
     const client = new GHLClient({ apiKey, locationId });
-    registerAllTools(server, client, registry, pkg.version);
+    registerAllTools(server, client, registry, pkg.version, process.env, sessionTier);
     registerEnableWorkflowBuilderTool(server);
     registerFirebaseCaptureScriptTool(server);
     registerInteractiveCaptureTool(server);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.49.0",
+  "version": "3.50.0",
   "mcpName": "io.github.drjerryrelth/ghl-command",
   "description": "GoHighLevel MCP Server for Claude. 229 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",