@elitedcs/ghl-mcp 3.54.0 → 3.56.0

package/dist/index.js

@@ -114,8 +114,8 @@ var init_ghl_client = __esm({
           Version: version || GHL_API_VERSION
         };
       }
-      buildUrl(path11, params) {
-        const url = new URL(path11, GHL_BASE_URL);
+      buildUrl(path12, params) {
+        const url = new URL(path12, GHL_BASE_URL);
         if (params) {
           for (const [key, value] of Object.entries(params)) {
             if (value !== void 0 && value !== null) {
@@ -125,8 +125,8 @@ var init_ghl_client = __esm({
         }
         return url.toString();
       }
-      async request(method, path11, options = {}, attempt = 0) {
-        const url = this.buildUrl(path11, options.params);
+      async request(method, path12, options = {}, attempt = 0) {
+        const url = this.buildUrl(path12, options.params);
         const headers = this.buildHeaders(options.version);
         const fetchOptions = {
           method,
@@ -144,14 +144,14 @@ var init_ghl_client = __esm({
         } catch (error) {
           clearTimeout(timeout);
           if (error instanceof Error && error.name === "AbortError") {
-            throw new Error(`Request timeout (30s): ${method} ${path11}`);
+            throw new Error(`Request timeout (30s): ${method} ${path12}`);
           }
           if (!options.noRetry && attempt < MAX_RETRIES) {
             const delay4 = computeRetryDelay(null, attempt, BASE_DELAY_MS);
-            process.stderr.write(`[ghl-mcp] Network error on ${method} ${path11}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
+            process.stderr.write(`[ghl-mcp] Network error on ${method} ${path12}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
 `);
             await new Promise((r) => setTimeout(r, delay4));
-            return this.request(method, path11, options, attempt + 1);
+            return this.request(method, path12, options, attempt + 1);
           }
           throw error;
         } finally {
@@ -159,10 +159,10 @@ var init_ghl_client = __esm({
         }
         if (!options.noRetry && (response.status === 429 || response.status >= 500) && attempt < MAX_RETRIES) {
           const delay4 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS);
-          process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${path11}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
+          process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${path12}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
 `);
           await new Promise((r) => setTimeout(r, delay4));
-          return this.request(method, path11, options, attempt + 1);
+          return this.request(method, path12, options, attempt + 1);
         }
         if (!response.ok) {
           let errorBody = "";
@@ -171,7 +171,7 @@ var init_ghl_client = __esm({
           } catch {
           }
           throw new Error(
-            `GHL API Error ${response.status} ${response.statusText}: ${method} ${path11}
+            `GHL API Error ${response.status} ${response.statusText}: ${method} ${path12}
 ${errorBody}`
           );
         }
@@ -183,20 +183,20 @@ ${errorBody}`
           return { message: text };
         }
       }
-      async get(path11, options) {
-        return this.request("GET", path11, options);
+      async get(path12, options) {
+        return this.request("GET", path12, options);
       }
-      async post(path11, options) {
-        return this.request("POST", path11, options);
+      async post(path12, options) {
+        return this.request("POST", path12, options);
       }
-      async put(path11, options) {
-        return this.request("PUT", path11, options);
+      async put(path12, options) {
+        return this.request("PUT", path12, options);
       }
-      async patch(path11, options) {
-        return this.request("PATCH", path11, options);
+      async patch(path12, options) {
+        return this.request("PATCH", path12, options);
       }
-      async delete(path11, options) {
-        return this.request("DELETE", path11, options);
+      async delete(path12, options) {
+        return this.request("DELETE", path12, options);
       }
       /**
        * Helper: resolves locationId from args or falls back to default
@@ -998,9 +998,9 @@ function planFromPayload(payload) {
   return payload?.plan === "command-os" ? "command-os" : "mcp";
 }
 function legacyDeviceFingerprint() {
-  const os5 = require("node:os");
+  const os6 = require("node:os");
   const crypto4 = require("node:crypto");
-  const raw = `${os5.hostname()}:${os5.userInfo().username}:${os5.platform()}:${os5.arch()}`;
+  const raw = `${os6.hostname()}:${os6.userInfo().username}:${os6.platform()}:${os6.arch()}`;
   return crypto4.createHash("sha256").update(raw).digest("hex").slice(0, 16);
 }
 function deviceFingerprint(opts) {
@@ -1235,7 +1235,7 @@ async function validateFirebase(firebaseKey, refreshToken) {
 function registerSetupTool(server2) {
   server2.tool(
     "setup_ghl_mcp",
-    "First-run setup for GHL Command MCP. Validates your license and GHL credentials, then writes them to a per-user credentials file. Restart Claude after this completes to load all 234 tools (180 if you skip the optional Firebase fields; add Firebase later with enable_workflow_builder).",
+    "First-run setup for GHL Command MCP. Validates your license and GHL credentials, then writes them to a per-user credentials file. Restart Claude after this completes to load all 233 tools (179 if you skip the optional Firebase fields; add Firebase later with enable_workflow_builder).",
     {
       email: import_zod40.z.string().email().describe("Email used at purchase."),
       license_key: import_zod40.z.string().min(20).describe("License key from your purchase email."),
@@ -1317,11 +1317,11 @@ Note: Firebase credentials rejected (${fb.error}). Saved without Workflow Builde
         signed_attestation: lic.signedAttestation
       });
       const isFree = lic.tier === "free";
-      const toolCount = isFree ? workflowBuilderEnabled ? "106" : "88" : workflowBuilderEnabled ? "234" : "180";
+      const toolCount = isFree ? workflowBuilderEnabled ? "107" : "89" : workflowBuilderEnabled ? "233" : "179";
       const wfLine = workflowBuilderEnabled ? "Workflow Builder: enabled." : "Workflow Builder: not configured (optional).";
       const wfTip = workflowBuilderEnabled ? "" : isFree ? `
 Unlock the account auditor next (the free tier's best tool): say "Unlock the Workflow Builder" \u2014 one browser login enables audit_workflows, validate_workflow, and the full-detail reads.` : "\nTo enable Workflow Builder later (52 extra Firebase-gated tools): run enable_workflow_builder with your three Firebase values. No need to re-enter license/API key/location ID.";
-      const freeTip = isFree ? "\n\nFree tier: 106 read-only tools (88 before the one-login auditor unlock). Write tools stay visible but answer with upgrade info instead of acting. Full version ($97/mo founding rate, same key upgrades in place): https://ghlcommand.com" : "";
+      const freeTip = isFree ? "\n\nFree tier: 107 read-only tools (89 before the one-login auditor unlock). Write tools stay visible but answer with upgrade info instead of acting. Full version ($97/mo founding rate, same key upgrades in place): https://ghlcommand.com" : "";
       return {
         content: [{
           type: "text",
@@ -1347,7 +1347,7 @@ Unlock the account auditor next (the free tier's best tool): say "Unlock the Wor
 function registerEnableWorkflowBuilderTool(server2) {
   server2.tool(
     "enable_workflow_builder",
-    "Add Firebase credentials to an existing GHL Command install to unlock 54 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 180 to 234 after the next Claude restart.",
+    "Add Firebase credentials to an existing GHL Command install to unlock 54 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 179 to 233 after the next Claude restart.",
     {
       // v3.25.0: one-paste path. Tool runs `auto_capture_firebase_script` to
       // get the console script; the script returns a JSON object that pastes
@@ -1428,7 +1428,7 @@ DevTools steps: https://elitedcs.com/ghl-mcp-firebase`
             "",
             "**You MUST restart Claude before using any workflow-builder tool.** Quit Claude completely (Cmd+Q on Mac, full exit on Windows) and reopen. Without a restart, the workflow builder tools will keep using the OLD Firebase auth from before this call and fail with 401 errors \u2014 even though this tool reported success.",
             "",
-            'After restart, all 234 tools load. Try: "List my workflows in full detail" or "Validate workflow <id>".',
+            'After restart, all 233 tools load. Try: "List my workflows in full detail" or "Validate workflow <id>".',
             "",
             "Note: Firebase refresh tokens rotate every few weeks. If workflow tools stop working in a few weeks (run `health_check` to confirm Firebase auth: FAIL), run `auto_capture_firebase_script` for fresh values and re-run this tool with the new firebase_paste."
           ].join("\n")
@@ -1524,7 +1524,7 @@ The login in the capture window may belong to the wrong GHL account, or the sess
               "",
               "**You MUST restart Claude before using any workflow-builder tool.** Quit Claude completely (Cmd+Q on Mac, full exit on Windows) and reopen.",
               "",
-              'After restart, all 234 tools load. Try: "List my workflows in full detail".',
+              'After restart, all 233 tools load. Try: "List my workflows in full detail".',
               "",
               "Future token rotations re-capture silently \u2014 if workflow tools ever 401, just run capture_firebase_interactive again; no window should appear."
             ].join("\n")
@@ -2102,9 +2102,9 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.54.0",
+      version: "3.56.0",
       mcpName: "io.github.drjerryrelth/ghl-command",
-      description: "GoHighLevel MCP Server for Claude. 234 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
+      description: "GoHighLevel MCP Server for Claude. 233 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
       bin: {
         "ghl-mcp": "dist/index.js"
@@ -2118,7 +2118,8 @@ var require_package = __commonJS({
         "templates/external-funnel/cloudflare-worker.js",
         "templates/external-funnel/README.md",
         "README.md",
-        "CHANGELOG.md"
+        "CHANGELOG.md",
+        "skills"
       ],
       scripts: {
         build: "esbuild src/index.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/index.js --packages=external && esbuild src/capture-helper.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/capture-helper.js --packages=external",
@@ -2191,7 +2192,7 @@ function launchCommand(port = 7300) {
   return `npx -y @elitedcs/ghl-mcp@latest dashboard --port=${port}`;
 }
 function installingEntry() {
-  return path7.join(__dirname, "index.js");
+  return path8.join(__dirname, "index.js");
 }
 function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
   const cmd = launchCommand(port);
@@ -2199,12 +2200,12 @@ function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
     const systemApps = "/Applications";
     let base = home;
     try {
-      fs7.accessSync(systemApps, fs7.constants.W_OK);
+      fs8.accessSync(systemApps, fs8.constants.W_OK);
       base = "";
     } catch {
     }
-    const appDir = base ? path7.join(home, "Applications", "Command OS.app") : path7.join(systemApps, "Command OS.app");
-    const macOSDir = path7.join(appDir, "Contents", "MacOS");
+    const appDir = base ? path8.join(home, "Applications", "Command OS.app") : path8.join(systemApps, "Command OS.app");
+    const macOSDir = path8.join(appDir, "Contents", "MacOS");
     const script = [
       "#!/bin/bash",
       "# GHL Command \u2014 Command OS launcher (regenerate: ghl-mcp install-launcher)",
@@ -2233,13 +2234,13 @@ function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
       targetPath: appDir,
       humanLocation: base ? "your personal Applications folder at ~/Applications (Finder \u2192 Go \u2192 Home \u2192 Applications)" : "your Applications folder \u2014 open Finder \u2192 Applications and look for \u201CCommand OS\u201D",
       files: [
-        { path: path7.join(macOSDir, "command-os"), contents: script, executable: true },
-        { path: path7.join(appDir, "Contents", "Info.plist"), contents: plist, executable: false }
+        { path: path8.join(macOSDir, "command-os"), contents: script, executable: true },
+        { path: path8.join(appDir, "Contents", "Info.plist"), contents: plist, executable: false }
       ]
     };
   }
   if (platform2 === "win32") {
-    const target2 = path7.join(home, "Desktop", "Command OS.cmd");
+    const target2 = path8.join(home, "Desktop", "Command OS.cmd");
     return {
       platform: platform2,
       targetPath: target2,
@@ -2252,7 +2253,7 @@ function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
       ].join("\r\n"), executable: false }]
     };
   }
-  const target = path7.join(home, ".local", "share", "applications", "command-os.desktop");
+  const target = path8.join(home, ".local", "share", "applications", "command-os.desktop");
   return {
     platform: platform2,
     targetPath: target,
@@ -2276,11 +2277,11 @@ function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
 function installLauncher(argv = []) {
   const portArg = argv.find((a) => a.startsWith("--port="));
   const port = portArg ? Number(portArg.split("=")[1]) : 7300;
-  const plan = planLauncher(process.platform, os3.homedir(), port, installingEntry());
+  const plan = planLauncher(process.platform, os4.homedir(), port, installingEntry());
   try {
     for (const f of plan.files) {
-      fs7.mkdirSync(path7.dirname(f.path), { recursive: true });
-      fs7.writeFileSync(f.path, f.contents, { mode: f.executable ? 493 : 420 });
+      fs8.mkdirSync(path8.dirname(f.path), { recursive: true });
+      fs8.writeFileSync(f.path, f.contents, { mode: f.executable ? 493 : 420 });
     }
   } catch (e) {
     process.stderr.write(`
@@ -2300,13 +2301,13 @@ function installLauncher(argv = []) {
   ].join("\n"));
   return 0;
 }
-var fs7, os3, path7;
+var fs8, os4, path8;
 var init_launcher = __esm({
   "src/launcher.ts"() {
     "use strict";
-    fs7 = __toESM(require("fs"));
-    os3 = __toESM(require("os"));
-    path7 = __toESM(require("path"));
+    fs8 = __toESM(require("fs"));
+    os4 = __toESM(require("os"));
+    path8 = __toESM(require("path"));
   }
 });
 
@@ -2335,10 +2336,10 @@ function stageBlockedBy(stages, stage) {
   return null;
 }
 function claudeBin() {
-  const fallback = path8.join(os4.homedir(), ".local", "bin", "claude");
-  const fromPath = (process.env.PATH || "").split(path8.delimiter).map((d) => path8.join(d, "claude")).find((p) => {
+  const fallback = path9.join(os5.homedir(), ".local", "bin", "claude");
+  const fromPath = (process.env.PATH || "").split(path9.delimiter).map((d) => path9.join(d, "claude")).find((p) => {
     try {
-      fs8.accessSync(p, fs8.constants.X_OK);
+      fs9.accessSync(p, fs9.constants.X_OK);
       return true;
     } catch {
       return false;
@@ -2346,7 +2347,7 @@ function claudeBin() {
   });
   if (fromPath) return fromPath;
   try {
-    fs8.accessSync(fallback, fs8.constants.X_OK);
+    fs9.accessSync(fallback, fs9.constants.X_OK);
     return fallback;
   } catch {
   }
@@ -2395,7 +2396,7 @@ function runStage(locationId2, stage, onEvent, opts = {}) {
   const locationName = SANDBOX_ALLOWLIST[locationId2] || opts.name || locationId2;
   const spec = STAGE_SPECS[stage];
   if (!spec) return Promise.reject(new Error(`Stage ${stage} is not powered yet.`));
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const bin = claudeBin();
     onEvent({ kind: "status", line: `Starting ${spec.name} on ${locationName} (headless Claude, ${spec.allowedTools.length} tools allowed)\u2026` });
     const child = (0, import_child_process2.spawn)(bin, buildClaudeArgs(spec, locationId2, locationName, opts.context), {
@@ -2441,31 +2442,31 @@ function runStage(locationId2, stage, onEvent, opts = {}) {
       if (code !== 0 && !lastText) {
         const outcome2 = { ok: false, error: `claude exited ${code}: ${stderrTail.trim().slice(-200) || "no output"}` };
         onEvent({ kind: "error", line: outcome2.error });
-        resolve5(outcome2);
+        resolve6(outcome2);
         return;
       }
       const outcome = parseResultLine(lastText);
       const detail = outcome.error || (outcome.issues?.length ? outcome.issues.join(" \xB7 ") : "") || outcome.summary || "no detail reported";
       const success = outcome.formId ? `Done: form "${outcome.formName}" (${outcome.formId})` : `Done: ${outcome.summary ?? "stage complete"}`;
       onEvent({ kind: "result", line: outcome.ok ? success : `Not passed: ${detail}` });
-      resolve5(outcome);
+      resolve6(outcome);
     });
     child.on("error", (err) => {
       clearTimeout(timeout);
       const outcome = { ok: false, error: `could not start claude: ${err.message}` };
       onEvent({ kind: "error", line: outcome.error });
-      resolve5(outcome);
+      resolve6(outcome);
     });
   });
 }
-var import_child_process2, fs8, os4, path8, SANDBOX_ALLOWLIST, PROTECTED_LOCATIONS, STAGE_SPECS, HUMAN_GATE_STAGES;
+var import_child_process2, fs9, os5, path9, SANDBOX_ALLOWLIST, PROTECTED_LOCATIONS, STAGE_SPECS, HUMAN_GATE_STAGES;
 var init_stage_runner = __esm({
   "src/stage-runner.ts"() {
     "use strict";
     import_child_process2 = require("child_process");
-    fs8 = __toESM(require("fs"));
-    os4 = __toESM(require("os"));
-    path8 = __toESM(require("path"));
+    fs9 = __toESM(require("fs"));
+    os5 = __toESM(require("os"));
+    path9 = __toESM(require("path"));
     SANDBOX_ALLOWLIST = {
       JrV2p35O3hY2wqhr2c0T: "MCP Testing",
       jHP5wkYRineXDlzAOEbW: "Blueprint Demo"
@@ -3185,11 +3186,11 @@ __export(dashboard_exports, {
   writeOverlay: () => writeOverlay
 });
 function overlayPath() {
-  return path9.join(appDataDir(), "intake-overlay.json");
+  return path10.join(appDataDir(), "intake-overlay.json");
 }
 function readOverlay() {
   try {
-    const raw = JSON.parse(fs9.readFileSync(overlayPath(), "utf8"));
+    const raw = JSON.parse(fs10.readFileSync(overlayPath(), "utf8"));
     if (raw && typeof raw === "object") return raw;
   } catch {
   }
@@ -3197,7 +3198,7 @@ function readOverlay() {
 }
 function writeOverlay(layer) {
   ensureAppDataDir();
-  fs9.writeFileSync(overlayPath(), JSON.stringify(layer, null, 2), { mode: 384 });
+  fs10.writeFileSync(overlayPath(), JSON.stringify(layer, null, 2), { mode: 384 });
 }
 function recoverStuckStages(state) {
   let recovered = 0;
@@ -3209,11 +3210,11 @@ function recoverStuckStages(state) {
   return { state: { ...state, clients }, recovered };
 }
 function cockpitStatePath() {
-  return path9.join(appDataDir(), "cockpit-state.json");
+  return path10.join(appDataDir(), "cockpit-state.json");
 }
 function readCockpitState() {
   try {
-    const raw = JSON.parse(fs9.readFileSync(cockpitStatePath(), "utf8"));
+    const raw = JSON.parse(fs10.readFileSync(cockpitStatePath(), "utf8"));
     if (raw && raw.v === 1 && raw.clients && typeof raw.clients === "object") return raw;
   } catch {
   }
@@ -3221,7 +3222,7 @@ function readCockpitState() {
 }
 function writeCockpitState(state) {
   ensureAppDataDir();
-  fs9.writeFileSync(cockpitStatePath(), JSON.stringify(state, null, 2), { mode: 384 });
+  fs10.writeFileSync(cockpitStatePath(), JSON.stringify(state, null, 2), { mode: 384 });
 }
 function setStage(state, locationId2, stageIndex, status) {
   if (!Number.isInteger(stageIndex) || stageIndex < 0 || stageIndex >= STAGES.length) throw new Error("bad stage index");
@@ -3313,7 +3314,7 @@ function notify(message) {
 `);
   try {
     ensureAppDataDir();
-    fs9.appendFileSync(path9.join(appDataDir(), "cockpit.log"), `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
+    fs10.appendFileSync(path10.join(appDataDir(), "cockpit.log"), `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
 `);
   } catch {
   }
@@ -4014,17 +4015,17 @@ async function runDashboard(argv) {
             const source = args.url ? { kind: "url", url: String(args.url) } : args.instruction ? { kind: "recorder", instruction: String(args.instruction) } : { kind: "text", text: String(args.transcript ?? "") };
             let recorderPatterns = [];
             if (source.kind === "recorder") {
-              recorderPatterns = await new Promise((resolve5) => {
+              recorderPatterns = await new Promise((resolve6) => {
                 const ls = (0, import_child_process4.spawn)(claudeBin(), ["mcp", "list"], { stdio: ["ignore", "pipe", "ignore"] });
                 let buf = "";
                 ls.stdout.on("data", (d) => {
                   buf += d.toString();
                 });
-                ls.on("close", () => resolve5(recorderAllowPatterns(buf)));
-                ls.on("error", () => resolve5([]));
+                ls.on("close", () => resolve6(recorderAllowPatterns(buf)));
+                ls.on("error", () => resolve6([]));
                 setTimeout(() => {
                   ls.kill("SIGKILL");
-                  resolve5(recorderAllowPatterns(buf));
+                  resolve6(recorderAllowPatterns(buf));
                 }, 9e4).unref?.();
               });
               if (!recorderPatterns.length) {
@@ -4034,7 +4035,7 @@ async function runDashboard(argv) {
               }
             }
             const out = await prefillFromSource(
-              (prompt, tools) => new Promise((resolve5, reject) => {
+              (prompt, tools) => new Promise((resolve6, reject) => {
                 const argv2 = ["-p", prompt, "--max-turns", "25", "--disallowedTools", tools.deny];
                 if (tools.allow) argv2.push("--allowedTools", tools.allow);
                 else argv2.push("--allowedTools", "");
@@ -4043,7 +4044,7 @@ async function runDashboard(argv) {
                 child.stdout.on("data", (d) => {
                   out2 += d.toString();
                 });
-                child.on("close", () => resolve5(out2));
+                child.on("close", () => resolve6(out2));
                 child.on("error", reject);
                 setTimeout(() => child.kill("SIGKILL"), 5 * 60 * 1e3).unref?.();
               }),
@@ -4175,13 +4176,13 @@ async function runDashboard(argv) {
             }
           }
           const review = await generateReview(
-            (prompt) => new Promise((resolve5, reject) => {
+            (prompt) => new Promise((resolve6, reject) => {
               const child = (0, import_child_process4.spawn)(claudeBin(), ["-p", prompt, "--allowedTools", "", "--disallowedTools", "Bash,Write,Edit,WebFetch,WebSearch,Task,Read,Glob,Grep", "--max-turns", "6"], { stdio: ["ignore", "pipe", "pipe"] });
               let out = "";
               child.stdout.on("data", (d) => {
                 out += d.toString();
               });
-              child.on("close", () => resolve5(out));
+              child.on("close", () => resolve6(out));
               child.on("error", reject);
               setTimeout(() => child.kill("SIGKILL"), 6 * 60 * 1e3).unref?.();
             }),
@@ -4354,9 +4355,9 @@ async function runDashboard(argv) {
     res.end();
   });
   try {
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve6, reject) => {
       server2.once("error", reject);
-      server2.listen(port, "127.0.0.1", resolve5);
+      server2.listen(port, "127.0.0.1", resolve6);
     });
   } catch (e) {
     const msg2 = e?.code === "EADDRINUSE" ? `Port ${port} is busy with another program. Close it, or start Command OS on a different port.` : `Command OS could not start: ${e instanceof Error ? e.message : String(e)}`;
@@ -4382,18 +4383,18 @@ async function runDashboard(argv) {
     if (adopted) process.stderr.write(`  Synced ${adopted} client${adopted === 1 ? "" : "s"} from your GHL (teammate updates).
 `);
   });
-  return await new Promise((resolve5) => {
-    const stop = () => server2.close(() => resolve5(0));
+  return await new Promise((resolve6) => {
+    const stop = () => server2.close(() => resolve6(0));
     process.on("SIGINT", stop);
     process.on("SIGTERM", stop);
   });
 }
-var fs9, path9, http, import_child_process3, import_child_process4, osmod, STAGES, ACCOUNT_TYPES, activeRun, UPGRADE_MSG;
+var fs10, path10, http, import_child_process3, import_child_process4, osmod, STAGES, ACCOUNT_TYPES, activeRun, UPGRADE_MSG;
 var init_dashboard = __esm({
   "src/dashboard.ts"() {
     "use strict";
-    fs9 = __toESM(require("fs"));
-    path9 = __toESM(require("path"));
+    fs10 = __toESM(require("fs"));
+    path10 = __toESM(require("path"));
     http = __toESM(require("http"));
     import_child_process3 = require("child_process");
     init_credentials_store();
@@ -4428,8 +4429,8 @@ var init_dashboard = __esm({
 
 // src/index.ts
 var dotenv2 = __toESM(require("dotenv"));
-var path10 = __toESM(require("path"));
-var fs10 = __toESM(require("fs"));
+var path11 = __toESM(require("path"));
+var fs11 = __toESM(require("fs"));
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 init_ghl_client();
@@ -5682,6 +5683,25 @@ var ALWAYS_ON_TOOL_NAMES = /* @__PURE__ */ new Set([
   "enable_workflow_builder",
   "health_check"
 ]);
+var HARD_CORE_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "setup_ghl_mcp",
+  "request_license",
+  "get_mcp_version",
+  "health_check"
+]);
+var ACCOUNT_ADMIN_TOOLS = /* @__PURE__ */ new Set([
+  "create_sub_account",
+  "delete_sub_account"
+]);
+var OUT_OF_BAND_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "setup_ghl_mcp",
+  "request_license",
+  "get_mcp_version",
+  "enable_workflow_builder",
+  "auto_capture_firebase_script",
+  "capture_firebase_interactive",
+  "install_skills"
+]);
 var FREE_TIER_EXTRA_READ_TOOLS = /* @__PURE__ */ new Set([
   "audit_workflows",
   // account-wide silent-failure audit — the free tier's wow moment
@@ -5731,17 +5751,39 @@ function parseList(raw) {
 function parseAllowlist(env) {
   const moduleList = parseList(env.GHL_ENABLED_MODULES);
   const toolList = parseList(env.GHL_ENABLED_TOOLS);
+  const disabledModuleList = parseList(env.GHL_DISABLED_MODULES);
+  const disabledToolList = parseList(env.GHL_DISABLED_TOOLS);
   return {
     enabledModules: moduleList ? new Set(moduleList) : null,
     enabledTools: toolList ? new Set(toolList) : null,
+    disabledModules: disabledModuleList ? new Set(disabledModuleList) : null,
+    disabledTools: disabledToolList ? new Set(disabledToolList) : null,
+    accountAdminEnabled: env.GHL_ENABLE_ACCOUNT_ADMIN === "1",
     rawModuleInput: moduleList,
-    rawToolInput: toolList
+    rawToolInput: toolList,
+    rawDisabledModuleInput: disabledModuleList,
+    rawDisabledToolInput: disabledToolList
   };
 }
 function isAllowlistActive(config3) {
   return config3.enabledModules !== null || config3.enabledTools !== null;
 }
+function isDenyListActive(config3) {
+  return config3.disabledModules !== null || config3.disabledTools !== null;
+}
+function isGatingActive(config3) {
+  return isAllowlistActive(config3) || isDenyListActive(config3) || config3.accountAdminEnabled;
+}
+function isToolDenied(toolName, moduleName, config3) {
+  if (HARD_CORE_TOOL_NAMES.has(toolName)) return false;
+  const toolDenied = config3.disabledTools?.has(toolName.toLowerCase()) ?? false;
+  const moduleDenied = moduleName.length > 0 && (config3.disabledModules?.has(moduleName.toLowerCase()) ?? false);
+  return toolDenied || moduleDenied;
+}
 function shouldRegister(toolName, moduleName, config3) {
+  if (HARD_CORE_TOOL_NAMES.has(toolName)) return true;
+  if (isToolDenied(toolName, moduleName, config3)) return false;
+  if (ACCOUNT_ADMIN_TOOLS.has(toolName) && !config3.accountAdminEnabled) return false;
   if (ALWAYS_ON_TOOL_NAMES.has(toolName)) return true;
   if (!isAllowlistActive(config3)) return true;
   const toolLower = toolName.toLowerCase();
@@ -5781,32 +5823,57 @@ function wrapServerForModule(realServer, moduleName, config3, attemptedTools, re
     }
   });
 }
+function buildGatingReport(config3, knownModules, attemptedTools, registeredTools, outOfBand) {
+  const knownLower = new Set([...knownModules].map((m) => m.toLowerCase()));
+  const knownToolsLower = /* @__PURE__ */ new Set([
+    ...[...attemptedTools].map((t) => t.toLowerCase()),
+    ...[...OUT_OF_BAND_TOOL_NAMES].map((t) => t.toLowerCase())
+  ]);
+  const unknownModules = (raw) => (raw ?? []).filter((m) => !knownLower.has(m));
+  const unknownTools = (raw) => (raw ?? []).filter((t) => !knownToolsLower.has(t));
+  const hardCoreLower = new Set([...HARD_CORE_TOOL_NAMES].map((t) => t.toLowerCase()));
+  return {
+    gatingActive: isGatingActive(config3),
+    allowlistActive: isAllowlistActive(config3),
+    denyListActive: isDenyListActive(config3),
+    accountAdminEnabled: config3.accountAdminEnabled,
+    enabledModules: [...config3.enabledModules ?? []].sort(),
+    enabledTools: [...config3.enabledTools ?? []].sort(),
+    disabledModules: [...config3.disabledModules ?? []].sort(),
+    disabledTools: [...config3.disabledTools ?? []].sort(),
+    ignoredHardCoreDenials: (config3.rawDisabledToolInput ?? []).filter((t) => hardCoreLower.has(t)),
+    unknownEnabledModules: unknownModules(config3.rawModuleInput),
+    unknownEnabledTools: unknownTools(config3.rawToolInput),
+    unknownDisabledModules: unknownModules(config3.rawDisabledModuleInput),
+    unknownDisabledTools: unknownTools(config3.rawDisabledToolInput),
+    outOfBandDenied: [...outOfBand?.denied ?? []].sort(),
+    registeredCount: registeredTools.size + (outOfBand?.registered.size ?? 0),
+    attemptedCount: attemptedTools.size + (outOfBand?.registered.size ?? 0) + (outOfBand?.denied.size ?? 0)
+  };
+}
 function validateAndLog(config3, knownModules, attemptedTools, registeredTools, log = (m) => process.stderr.write(m)) {
-  if (!isAllowlistActive(config3)) return;
-  if (config3.rawModuleInput) {
-    const knownLower = new Set([...knownModules].map((m) => m.toLowerCase()));
-    const unknown = config3.rawModuleInput.filter((m) => !knownLower.has(m));
-    if (unknown.length > 0) {
-      log(
-        `[ghl-mcp] WARNING: GHL_ENABLED_MODULES has unrecognized name(s): ${unknown.join(", ")}. Known modules: ${[...knownModules].sort().join(", ")}.
-`
-      );
+  if (!isGatingActive(config3)) return;
+  const report = buildGatingReport(config3, knownModules, attemptedTools, registeredTools);
+  const warnUnknown = (varName, names, hint = "") => {
+    if (names.length > 0) {
+      log(`[ghl-mcp] WARNING: ${varName} has unrecognized name(s): ${names.join(", ")}.${hint}
+`);
     }
-  }
-  if (config3.rawToolInput) {
-    const attemptedLower = new Set([...attemptedTools].map((t) => t.toLowerCase()));
-    const unknown = config3.rawToolInput.filter((t) => !attemptedLower.has(t));
-    if (unknown.length > 0) {
-      log(
-        `[ghl-mcp] WARNING: GHL_ENABLED_TOOLS has unrecognized name(s): ${unknown.join(", ")}.
+  };
+  const modulesHint = ` Known modules: ${[...knownModules].sort().join(", ")}.`;
+  warnUnknown("GHL_ENABLED_MODULES", report.unknownEnabledModules, modulesHint);
+  warnUnknown("GHL_ENABLED_TOOLS", report.unknownEnabledTools);
+  warnUnknown("GHL_DISABLED_MODULES", report.unknownDisabledModules, modulesHint);
+  warnUnknown("GHL_DISABLED_TOOLS", report.unknownDisabledTools);
+  if (report.ignoredHardCoreDenials.length > 0) {
+    log(
+      `[ghl-mcp] WARNING: GHL_DISABLED_TOOLS lists recovery-core tool(s) that cannot be disabled (ignored): ${report.ignoredHardCoreDenials.join(", ")}.
 `
-      );
-    }
+    );
   }
-  const moduleSummary = config3.enabledModules && config3.enabledModules.size > 0 ? `modules=[${[...config3.enabledModules].sort().join(",")}]` : "modules=(none)";
-  const toolSummary = config3.enabledTools && config3.enabledTools.size > 0 ? `explicit-tools=[${[...config3.enabledTools].sort().join(",")}]` : "explicit-tools=(none)";
+  const listOr = (label, items) => items.length > 0 ? `${label}=[${items.join(",")}]` : `${label}=(none)`;
   log(
-    `[ghl-mcp] Tool allowlist active: registered ${registeredTools.size} of ${attemptedTools.size} tools (${moduleSummary}; ${toolSummary}).
+    `[ghl-mcp] Tool gating active: registered ${registeredTools.size} of ${attemptedTools.size} tools (${listOr("modules", report.enabledModules)}; ${listOr("explicit-tools", report.enabledTools)}; ${listOr("disabled-modules", report.disabledModules)}; ${listOr("disabled-tools", report.disabledTools)}; account-admin=${report.accountAdminEnabled ? "ENABLED" : "off (default)"}).
 `
   );
 }
@@ -8376,16 +8443,16 @@ function registerEmailTools(server2, client) {
 function registerEmailBuilderInternalTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function builderRequest(method, path11, body) {
+  async function builderRequest(method, path12, body) {
     const headers = await client.buildHeaders();
-    const response = await fetch(`${EMAIL_BUILDER_BASE}${path11}`, {
+    const response = await fetch(`${EMAIL_BUILDER_BASE}${path12}`, {
       method,
       headers,
       body: body ? JSON.stringify(body) : void 0
     });
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Email Builder API Error ${response.status}: ${method} /emails/builder${path11}
+      throw new Error(`Email Builder API Error ${response.status}: ${method} /emails/builder${path12}
 ${text2}`);
     }
     const text = await response.text();
@@ -9642,23 +9709,23 @@ var import_zod34 = require("zod");
 function registerFunnelBuilderTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function internalGet(path11) {
-    return client.request("GET", path11);
+  async function internalGet(path12) {
+    return client.request("GET", path12);
   }
-  async function internalPost(path11, body) {
-    return client.request("POST", path11, body);
+  async function internalPost(path12, body) {
+    return client.request("POST", path12, body);
   }
-  async function internalPut(path11, body) {
-    return client.request("PUT", path11, body);
+  async function internalPut(path12, body) {
+    return client.request("PUT", path12, body);
   }
-  async function internalDelete(path11) {
-    return client.request("DELETE", path11);
+  async function internalDelete(path12) {
+    return client.request("DELETE", path12);
   }
-  async function funnelRequest(method, path11, body) {
+  async function funnelRequest(method, path12, body) {
     const headers = await client.buildHeaders();
     headers.Origin = "https://app.gohighlevel.com";
     headers.Referer = "https://app.gohighlevel.com/";
-    const url = `https://backend.leadconnectorhq.com/funnels${path11}`;
+    const url = `https://backend.leadconnectorhq.com/funnels${path12}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT")) {
       options.body = JSON.stringify(body);
@@ -9666,7 +9733,7 @@ function registerFunnelBuilderTools(server2, builderClient) {
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Funnel API Error ${response.status}: ${method} ${path11}
+      throw new Error(`Funnel API Error ${response.status}: ${method} ${path12}
 ${text2}`);
     }
     const text = await response.text();
@@ -10611,12 +10678,12 @@ var valueCardSchema = import_zod35.z.object({
 function registerPageStudioTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function funnelRequest(method, path11) {
+  async function funnelRequest(method, path12) {
     const headers = await client.buildHeaders();
     headers.Origin = "https://app.gohighlevel.com";
     headers.Referer = "https://app.gohighlevel.com/";
-    const response = await fetch(`https://backend.leadconnectorhq.com/funnels${path11}`, { method, headers });
-    if (!response.ok) throw new Error(`Funnel API Error ${response.status}: ${method} ${path11}
+    const response = await fetch(`https://backend.leadconnectorhq.com/funnels${path12}`, { method, headers });
+    if (!response.ok) throw new Error(`Funnel API Error ${response.status}: ${method} ${path12}
 ${await response.text()}`);
     const text = await response.text();
     return text ? JSON.parse(text) : {};
@@ -10935,9 +11002,9 @@ function buildUpdateFormPath(formId, locationId2) {
 function buildUpdateFormBody(name, formData) {
   return { name, formData };
 }
-async function formApiRequest(client, method, path11, body) {
+async function formApiRequest(client, method, path12, body) {
   const headers = await client.buildHeaders();
-  const url = `https://backend.leadconnectorhq.com/forms${path11}`;
+  const url = `https://backend.leadconnectorhq.com/forms${path12}`;
   const options = { method, headers };
   if (body && (method === "POST" || method === "PUT")) {
     options.body = JSON.stringify(body);
@@ -10945,7 +11012,7 @@ async function formApiRequest(client, method, path11, body) {
   const response = await fetch(url, options);
   if (!response.ok) {
     const text2 = await response.text();
-    throw new Error(`Form API Error ${response.status}: ${method} ${path11}
+    throw new Error(`Form API Error ${response.status}: ${method} ${path12}
 ${text2}`);
   }
   const text = await response.text();
@@ -10959,7 +11026,7 @@ ${text2}`);
 function registerFormBuilderTools(server2, builderClient, publicClient) {
   const client = builderClient;
   if (!client) return;
-  const formRequest = (method, path11, body) => formApiRequest(client, method, path11, body);
+  const formRequest = (method, path12, body) => formApiRequest(client, method, path12, body);
   server2.tool(
     "get_form_full",
     "Get a form with full builder data: all fields (labels, types, IDs, validation), conditional logic, auto-responder config, email notification settings, styling, and version history. This is the internal API \u2014 it returns everything the form builder UI shows.",
@@ -11080,10 +11147,10 @@ function registerFormBuilderTools(server2, builderClient, publicClient) {
     },
     async ({ formId, limit, skip }) => {
       try {
-        let path11 = `/submissions?locationId=${client.locationId}&limit=${limit ?? 20}`;
-        if (formId) path11 += `&formId=${formId}`;
-        if (skip) path11 += `&skip=${skip}`;
-        const result = await formRequest("GET", path11);
+        let path12 = `/submissions?locationId=${client.locationId}&limit=${limit ?? 20}`;
+        if (formId) path12 += `&formId=${formId}`;
+        if (skip) path12 += `&skip=${skip}`;
+        const result = await formRequest("GET", path12);
         return {
           content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
         };
@@ -11476,9 +11543,9 @@ var import_zod38 = require("zod");
 function registerPipelineBuilderTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function pipelineRequest(method, path11, body) {
+  async function pipelineRequest(method, path12, body) {
     const headers = await client.buildHeaders();
-    const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path11}`;
+    const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path12}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
       options.body = JSON.stringify(body);
@@ -11486,7 +11553,7 @@ function registerPipelineBuilderTools(server2, builderClient) {
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Pipeline API Error ${response.status}: ${method} ${path11}
+      throw new Error(`Pipeline API Error ${response.status}: ${method} ${path12}
 ${text2}`);
     }
     const text = await response.text();
@@ -12231,7 +12298,7 @@ ${lines.join("\n")}
 // src/tools/bulk-operations.ts
 var import_zod42 = require("zod");
 function delay(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 function formatResults(op, results, total) {
   return `${op}: ${results.success} success, ${results.failed} failed out of ${total}.${results.errors.length ? "\nErrors:\n" + results.errors.join("\n") : ""}`;
@@ -12356,7 +12423,7 @@ function registerBulkOperationTools(server2, client) {
 // src/tools/account-export.ts
 var import_zod43 = require("zod");
 function delay2(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 function registerAccountExportTools(server2, client) {
   const builderClient = WorkflowBuilderClient.fromEnv();
@@ -12677,9 +12744,9 @@ var OBJECT_KEYS = ["contacts", "opportunity"];
 function registerSmartListTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function smartListRequest(method, path11, body) {
+  async function smartListRequest(method, path12, body) {
     const headers = await client.buildHeaders();
-    const url = `${SMARTLIST_BASE}${path11}`;
+    const url = `${SMARTLIST_BASE}${path12}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT")) {
       options.body = JSON.stringify(body);
@@ -12687,7 +12754,7 @@ function registerSmartListTools(server2, builderClient) {
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Smart Lists API Error ${response.status}: ${method} ${path11}
+      throw new Error(`Smart Lists API Error ${response.status}: ${method} ${path12}
 ${text2}`);
     }
     const text = await response.text();
@@ -12819,12 +12886,12 @@ var REPUTATION_BASE = "https://backend.leadconnectorhq.com/reputation";
 function registerReputationTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function reputationRequest(method, path11) {
+  async function reputationRequest(method, path12) {
     const headers = await client.buildHeaders();
-    const response = await fetch(`${REPUTATION_BASE}${path11}`, { method, headers });
+    const response = await fetch(`${REPUTATION_BASE}${path12}`, { method, headers });
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Reputation API Error ${response.status}: ${method} ${path11}
+      throw new Error(`Reputation API Error ${response.status}: ${method} ${path12}
 ${text2}`);
     }
     const text = await response.text();
@@ -12939,16 +13006,16 @@ var MEMBERSHIP_BASE = "https://backend.leadconnectorhq.com/membership";
 function registerMembershipTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function membershipRequest(path11, method = "GET", body) {
+  async function membershipRequest(path12, method = "GET", body) {
     const headers = await client.buildHeaders();
-    const response = await fetch(`${MEMBERSHIP_BASE}${path11}`, {
+    const response = await fetch(`${MEMBERSHIP_BASE}${path12}`, {
       method,
       headers,
       body: body ? JSON.stringify(body) : void 0
     });
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Membership API Error ${response.status}: ${method} ${path11}
+      throw new Error(`Membership API Error ${response.status}: ${method} ${path12}
 ${text2}`);
     }
     const text = await response.text();
@@ -13117,7 +13184,7 @@ var import_zod49 = require("zod");
 var fs5 = __toESM(require("fs"));
 var path5 = __toESM(require("path"));
 function delay3(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 var TemplateSchema = import_zod49.z.object({
   templateName: import_zod49.z.string(),
@@ -13261,7 +13328,7 @@ function registerTemplateDeployerTools(server2, client) {
         const locId = client.resolveLocationId(locationId2);
         const safePath = validateTemplatePath(templateFile);
         const template = TemplateSchema.parse(JSON.parse(fs5.readFileSync(safePath, "utf-8")));
-        const resolve5 = (text) => {
+        const resolve6 = (text) => {
           if (typeof text !== "string") return text;
           let result = text;
           for (const [key, value] of Object.entries(answers)) {
@@ -13274,7 +13341,7 @@ function registerTemplateDeployerTools(server2, client) {
           return result;
         };
         const resolveObj = (obj) => {
-          if (typeof obj === "string") return resolve5(obj);
+          if (typeof obj === "string") return resolve6(obj);
           if (Array.isArray(obj)) return obj.map(resolveObj);
           if (obj && typeof obj === "object") {
             const result = {};
@@ -14082,10 +14149,10 @@ async function getVersionStatus(installed) {
 }
 
 // src/tools/diagnostics.ts
-function registerDiagnosticTools(server2, installedVersion, client, builderClient, registry2) {
+function registerDiagnosticTools(server2, installedVersion, client, builderClient, registry2, getGatingReport) {
   server2.tool(
     "health_check",
-    "Run a full health check of the GHL Command MCP install. Reports on: npm registry + version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), and token registry. Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change.",
+    "Run a full health check of the GHL Command MCP install. Reports on: npm registry + version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), token registry, and the tool-gating policy (disabled tools/modules, account-admin opt-in, typos in gating env vars). Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change.",
     {},
     async () => {
       const checks = [];
@@ -14135,7 +14202,7 @@ function registerDiagnosticTools(server2, installedVersion, client, builderClien
       })();
       const firebasePromise = (async () => {
         if (!builderClient) {
-          return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured. The 49 Firebase-gated tools need Firebase credentials. The other 163 tools work fine without. To add it: run enable_workflow_builder with the three Firebase values from your GHL browser session (see elitedcs.com/ghl-mcp-firebase for DevTools steps). Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart. enable_workflow_builder saves and verifies them for you." };
+          return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured. The 54 Firebase-gated tools need Firebase credentials. The other 179 tools work fine without. To add it: run enable_workflow_builder with the three Firebase values from your GHL browser session (see elitedcs.com/ghl-mcp-firebase for DevTools steps). Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart. enable_workflow_builder saves and verifies them for you." };
         }
         const result = await builderClient.checkAuth();
         const tokenCompany = builderClient.getTokenCompanyId();
@@ -14184,7 +14251,32 @@ function registerDiagnosticTools(server2, installedVersion, client, builderClien
       } else {
         versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed} but latest is v${versionStatus.latest}. Quit Claude (Cmd+Q) and reopen to upgrade.` };
       }
-      checks.push(versionCheck, apiKeyCheck, locationCheck, firebaseCheck, registryCheck);
+      const gatingCheck = (() => {
+        const r = getGatingReport?.();
+        if (!r) {
+          return { name: "Tool gating", status: "skip", detail: "Gating report unavailable in this mode." };
+        }
+        if (!r.gatingActive) {
+          return { name: "Tool gating", status: "pass", detail: `No gating configured \u2014 all ${r.registeredCount} tools registered. Sub-account create/delete stays OFF unless GHL_ENABLE_ACCOUNT_ADMIN=1 is set.` };
+        }
+        const parts = [`${r.registeredCount} of ${r.attemptedCount} tools registered.`];
+        if (r.disabledTools.length > 0) parts.push(`Disabled tools: ${r.disabledTools.join(", ")}.`);
+        if (r.disabledModules.length > 0) parts.push(`Disabled modules: ${r.disabledModules.join(", ")}.`);
+        if (r.outOfBandDenied.length > 0) parts.push(`Confirmed unregistered (setup/helper tools): ${r.outOfBandDenied.join(", ")}.`);
+        if (r.allowlistActive) parts.push(`Allowlist: modules=[${r.enabledModules.join(",") || "-"}], tools=[${r.enabledTools.join(",") || "-"}].`);
+        parts.push(`Account admin (sub-account create/delete): ${r.accountAdminEnabled ? "ENABLED via GHL_ENABLE_ACCOUNT_ADMIN=1" : "OFF (default)"}.`);
+        const problems = [];
+        if (r.ignoredHardCoreDenials.length > 0) problems.push(`recovery-core tool(s) in GHL_DISABLED_TOOLS cannot be disabled and were IGNORED: ${r.ignoredHardCoreDenials.join(", ")}`);
+        if (r.unknownDisabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_TOOLS (possible typo \u2014 those tools are NOT disabled): ${r.unknownDisabledTools.join(", ")}`);
+        if (r.unknownDisabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_MODULES (possible typo): ${r.unknownDisabledModules.join(", ")}`);
+        if (r.unknownEnabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_TOOLS: ${r.unknownEnabledTools.join(", ")}`);
+        if (r.unknownEnabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_MODULES: ${r.unknownEnabledModules.join(", ")}`);
+        if (problems.length > 0) {
+          return { name: "Tool gating", status: "warn", detail: `${parts.join(" ")} PROBLEMS: ${problems.join("; ")}. Fix the env var in your Claude config and fully restart Claude.` };
+        }
+        return { name: "Tool gating", status: "pass", detail: parts.join(" ") };
+      })();
+      checks.push(versionCheck, apiKeyCheck, locationCheck, firebaseCheck, registryCheck, gatingCheck);
       const symbols = { pass: "\u2713", fail: "\u2717", warn: "!", skip: "\u2014" };
       const lines = [];
       lines.push("GHL Command \u2014 Health Check");
@@ -14897,9 +14989,9 @@ function presetForBusinessType(type) {
       return "generic";
   }
 }
-function setPath(target, path11, value) {
+function setPath(target, path12, value) {
   if (value === void 0) return;
-  const parts = path11.split(".");
+  const parts = path12.split(".");
   let node = target;
   for (let i = 0; i < parts.length - 1; i++) {
     const k = parts[i];
@@ -16985,15 +17077,15 @@ function extractFunnelId(result) {
   return void 0;
 }
 function makeExecuteDeps(client, builderClient, locationId2) {
-  const pipelineApi = async (method, path11, body) => {
+  const pipelineApi = async (method, path12, body) => {
     const headers = await builderClient.buildHeaders();
-    const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path11}`;
+    const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path12}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Pipeline API ${response.status}: ${method} ${path11}
+      throw new Error(`Pipeline API ${response.status}: ${method} ${path12}
 ${text2.slice(0, 300)}`);
     }
     const text = await response.text();
@@ -17004,17 +17096,17 @@ ${text2.slice(0, 300)}`);
       return JSON.parse(text.replace(/[\x00-\x1F\x7F]/g, ""));
     }
   };
-  const funnelApi = async (method, path11, body) => {
+  const funnelApi = async (method, path12, body) => {
     const headers = await builderClient.buildHeaders();
     headers.Origin = "https://app.gohighlevel.com";
     headers.Referer = "https://app.gohighlevel.com/";
-    const url = `https://backend.leadconnectorhq.com/funnels${path11}`;
+    const url = `https://backend.leadconnectorhq.com/funnels${path12}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Funnel API ${response.status}: ${method} ${path11}
+      throw new Error(`Funnel API ${response.status}: ${method} ${path12}
 ${text2.slice(0, 300)}`);
     }
     const text = await response.text();
@@ -17676,7 +17768,7 @@ var KNOWN_MODULES = /* @__PURE__ */ new Set([
   LOCATION_SWITCHER_MODULE,
   SNAPSHOTS_MODULE
 ]);
-function registerAllTools(server2, client, registry2, mcpVersion, env = process.env, tier = "full") {
+function registerAllTools(server2, client, registry2, mcpVersion, env = process.env, tier = "full", outOfBand) {
   const config3 = parseAllowlist(env);
   const attemptedTools = /* @__PURE__ */ new Set();
   const registeredTools = /* @__PURE__ */ new Set();
@@ -17698,7 +17790,8 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
     mcpVersion ?? "unknown",
     client,
     builderClient,
-    registry2 ?? null
+    registry2 ?? null,
+    () => buildGatingReport(config3, KNOWN_MODULES, attemptedTools, registeredTools, outOfBand)
   );
   registerSnapshotTools(wrap(SNAPSHOTS_MODULE), client, registry2);
   registerLocationSwitcherTools(
@@ -17708,7 +17801,7 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
     registry2,
     mcpVersion
   );
-  if (isAllowlistActive(config3)) {
+  if (isGatingActive(config3)) {
     validateAndLog(config3, KNOWN_MODULES, attemptedTools, registeredTools);
   }
   if (tier === "free") {
@@ -17720,9 +17813,180 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
   return { registeredTools, gatedTools };
 }
 
+// src/out-of-band.ts
+function makeOutOfBandTracker() {
+  return { registered: /* @__PURE__ */ new Set(), denied: /* @__PURE__ */ new Set() };
+}
+function registerOutOfBand(entries, config3, tracker, log = (m) => process.stderr.write(m)) {
+  for (const entry of entries) {
+    if (isToolDenied(entry.name, "", config3)) {
+      tracker.denied.add(entry.name);
+      log(
+        `[ghl-mcp] Tool disabled by GHL_DISABLED_TOOLS: ${entry.name}${entry.deniedNote ? ` (${entry.deniedNote})` : ""}
+`
+      );
+      continue;
+    }
+    tracker.registered.add(entry.name);
+    entry.register();
+    entry.sideEffect?.();
+  }
+}
+
 // src/index.ts
 init_credentials_store();
 init_setup_tool();
+
+// src/tools/skills.ts
+var import_zod57 = require("zod");
+
+// src/skill-installer.ts
+var import_node_crypto2 = require("node:crypto");
+var fs6 = __toESM(require("node:fs"));
+var path6 = __toESM(require("node:path"));
+var os3 = __toESM(require("node:os"));
+function sha256(buf) {
+  return (0, import_node_crypto2.createHash)("sha256").update(buf).digest("hex");
+}
+function bundledSkillsDir(baseDir) {
+  const candidate = path6.resolve(baseDir, "..", "skills");
+  try {
+    return fs6.statSync(candidate).isDirectory() ? candidate : null;
+  } catch {
+    return null;
+  }
+}
+function listFiles(root) {
+  const out = [];
+  const walk = (dir) => {
+    for (const entry of fs6.readdirSync(dir, { withFileTypes: true })) {
+      const full = path6.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.isFile()) out.push(path6.relative(root, full));
+    }
+  };
+  walk(root);
+  return out.sort();
+}
+function readMarker(markerPath) {
+  try {
+    const parsed = JSON.parse(fs6.readFileSync(markerPath, "utf8"));
+    return parsed && typeof parsed === "object" && parsed.files ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function installBundledSkills(opts) {
+  const result = {
+    installed: [],
+    updated: [],
+    skippedUserModified: [],
+    unchanged: [],
+    errors: [],
+    targetDir: opts.targetDir ?? path6.join(os3.homedir(), ".claude", "skills"),
+    bundledDir: null
+  };
+  const bundled = bundledSkillsDir(opts.baseDir);
+  result.bundledDir = bundled;
+  if (!bundled) return result;
+  try {
+    fs6.mkdirSync(result.targetDir, { recursive: true });
+  } catch (e) {
+    result.errors.push(`cannot create ${result.targetDir}: ${String(e)}`);
+    return result;
+  }
+  const markerPath = path6.join(result.targetDir, ".ghl-command-skills.json");
+  const marker = readMarker(markerPath) ?? { packageVersion: "", files: {} };
+  const newMarker = { packageVersion: opts.packageVersion, files: { ...marker.files } };
+  for (const rel of listFiles(bundled)) {
+    try {
+      const src = fs6.readFileSync(path6.join(bundled, rel));
+      const dest = path6.join(result.targetDir, rel);
+      const srcHash = sha256(src);
+      let destBuf = null;
+      try {
+        destBuf = fs6.readFileSync(dest);
+      } catch {
+        destBuf = null;
+      }
+      if (destBuf === null) {
+        fs6.mkdirSync(path6.dirname(dest), { recursive: true });
+        fs6.writeFileSync(dest, src);
+        newMarker.files[rel] = srcHash;
+        result.installed.push(rel);
+        continue;
+      }
+      const destHash = sha256(destBuf);
+      if (destHash === srcHash) {
+        newMarker.files[rel] = srcHash;
+        result.unchanged.push(rel);
+        continue;
+      }
+      const lastWritten = marker.files[rel];
+      if (lastWritten && destHash === lastWritten) {
+        fs6.writeFileSync(dest, src);
+        newMarker.files[rel] = srcHash;
+        result.updated.push(rel);
+      } else {
+        result.skippedUserModified.push(rel);
+      }
+    } catch (e) {
+      result.errors.push(`${rel}: ${String(e)}`);
+    }
+  }
+  try {
+    fs6.writeFileSync(markerPath, JSON.stringify(newMarker, null, 2));
+  } catch (e) {
+    result.errors.push(`marker write failed: ${String(e)}`);
+  }
+  return result;
+}
+function summarizeInstall(r) {
+  if (!r.bundledDir) return "";
+  const bits = [];
+  if (r.installed.length) bits.push(`${r.installed.length} installed`);
+  if (r.updated.length) bits.push(`${r.updated.length} updated`);
+  if (r.skippedUserModified.length) bits.push(`${r.skippedUserModified.length} kept (your edits)`);
+  if (r.errors.length) bits.push(`${r.errors.length} errors`);
+  if (bits.length === 0) return "";
+  return `Skills: ${bits.join(", ")} \u2192 ${r.targetDir}`;
+}
+
+// src/tools/skills.ts
+function registerSkillsTool(server2, packageVersion, baseDir) {
+  server2.tool(
+    "install_skills",
+    "Install (or repair) the guided skills bundled with GHL Command \u2014 currently the Blueprint skill (build a whole client account from one intake) \u2014 into your ~/.claude/skills/ so Claude can use them. Runs automatically on startup; call this to verify what is installed, or to re-install after deleting a skill. NEVER overwrites files you have edited (your version is kept and reported). Restart Claude after install for new skills to load.",
+    {
+      targetDir: import_zod57.z.string().optional().describe("Override the install directory. Default: ~/.claude/skills")
+    },
+    async ({ targetDir }) => {
+      try {
+        const result = installBundledSkills({ packageVersion, baseDir, targetDir });
+        if (!result.bundledDir) {
+          return jsonResponse({
+            ok: false,
+            note: "No bundled skills directory found in this install (development checkout without skills/, or a pre-3.55.0 package)."
+          });
+        }
+        return jsonResponse({
+          ok: result.errors.length === 0,
+          targetDir: result.targetDir,
+          installed: result.installed,
+          updated: result.updated,
+          keptYourEdits: result.skippedUserModified,
+          unchanged: result.unchanged.length,
+          errors: result.errors,
+          next: result.installed.length > 0 || result.updated.length > 0 ? "Fully restart Claude (quit and reopen) so the new/updated skills load." : "Everything already current."
+        });
+      } catch (error) {
+        return errorResponse(error);
+      }
+    }
+  );
+}
+
+// src/index.ts
 init_attestation();
 
 // src/tools/meta.ts
@@ -17756,8 +18020,8 @@ function registerMetaTools(server2, installedVersion) {
 
 // src/cli.ts
 var import_node_util = require("node:util");
-var fs6 = __toESM(require("fs"));
-var path6 = __toESM(require("path"));
+var fs7 = __toESM(require("fs"));
+var path7 = __toESM(require("path"));
 var import_crypto2 = require("crypto");
 init_ghl_client();
 init_token_registry();
@@ -17800,9 +18064,9 @@ function errLine(msg2) {
 function preflightWritable() {
   try {
     const dir = ensureAppDataDir();
-    const probe = path6.join(dir, `.write-probe.${process.pid}.${(0, import_crypto2.randomBytes)(4).toString("hex")}`);
-    fs6.writeFileSync(probe, "ok");
-    fs6.unlinkSync(probe);
+    const probe = path7.join(dir, `.write-probe.${process.pid}.${(0, import_crypto2.randomBytes)(4).toString("hex")}`);
+    fs7.writeFileSync(probe, "ok");
+    fs7.unlinkSync(probe);
     return true;
   } catch (error) {
     errLine(`Config dir is not writable: ${error instanceof Error ? error.message : String(error)}`);
@@ -18052,7 +18316,7 @@ var bundledPkg = require_package();
 var pkg = (() => {
   try {
     const onDisk = JSON.parse(
-      fs10.readFileSync(path10.resolve(__dirname, "..", "package.json"), "utf8")
+      fs11.readFileSync(path11.resolve(__dirname, "..", "package.json"), "utf8")
     );
     if (typeof onDisk.version === "string" && onDisk.version.length > 0) {
       return { version: onDisk.version };
@@ -18064,7 +18328,7 @@ var pkg = (() => {
 dotenv2.config();
 {
   const configDirOverride = process.env.GHL_MCP_CONFIG_DIR?.trim();
-  if (configDirOverride && !path10.isAbsolute(configDirOverride)) {
+  if (configDirOverride && !path11.isAbsolute(configDirOverride)) {
     process.stderr.write(
       `[ghl-mcp] GHL_MCP_CONFIG_DIR must be an absolute path (got "${configDirOverride}"). Use e.g. /data/ghl-mcp in a container, with a volume mounted at /data.
 `
@@ -18077,20 +18341,20 @@ process.on("unhandledRejection", (reason) => {
 `);
 });
 function hardenSecretFilePerms() {
-  const repoDir = path10.resolve(__dirname, "..");
+  const repoDir = path11.resolve(__dirname, "..");
   const candidates = [
-    { file: path10.join(repoDir, "start-mcp.sh"), mode: 448 },
+    { file: path11.join(repoDir, "start-mcp.sh"), mode: 448 },
     // Legacy registry location (pre-migration); new location lives in app-data.
-    { file: path10.join(repoDir, ".ghl-tokens.json"), mode: 384 },
+    { file: path11.join(repoDir, ".ghl-tokens.json"), mode: 384 },
     { file: tokenRegistryPath(), mode: 384 }
   ];
   for (const { file, mode } of candidates) {
     let current;
     try {
-      if (!fs10.existsSync(file)) continue;
-      current = fs10.statSync(file).mode & 511;
+      if (!fs11.existsSync(file)) continue;
+      current = fs11.statSync(file).mode & 511;
       if (current !== mode) {
-        fs10.chmodSync(file, mode);
+        fs11.chmodSync(file, mode);
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
@@ -18256,6 +18520,9 @@ async function resolveAccessAndRegister() {
 `);
   }
   inBootstrapMode = !apiKey || !locationId || !licenseVerified;
+  const gatingConfig = parseAllowlist(process.env);
+  const outOfBandTracker = makeOutOfBandTracker();
+  outOfBandTracker.registered.add("get_mcp_version");
   if (inBootstrapMode) {
     process.stderr.write(
       `[ghl-mcp] Bootstrap mode.
@@ -18265,13 +18532,52 @@ async function resolveAccessAndRegister() {
     );
     registerSetupTool(server);
     registerLeadCaptureTool(server);
-    registerFirebaseCaptureScriptTool(server);
+    registerOutOfBand(
+      [{ name: "auto_capture_firebase_script", register: () => registerFirebaseCaptureScriptTool(server) }],
+      gatingConfig,
+      outOfBandTracker
+    );
   } else {
     const client = new GHLClient({ apiKey, locationId });
-    registerAllTools(server, client, registry, pkg.version, process.env, sessionTier);
-    registerEnableWorkflowBuilderTool(server);
-    registerFirebaseCaptureScriptTool(server);
-    registerInteractiveCaptureTool(server);
+    registerAllTools(server, client, registry, pkg.version, process.env, sessionTier, outOfBandTracker);
+    registerOutOfBand(
+      [
+        // Available in normal mode so buyers can add Firebase later without
+        // re-running setup_ghl_mcp with all 7 fields, and so they can re-grab
+        // a fresh refresh token when it rotates. Registered on the FREE tier too:
+        // the Firebase login powers the read-only auditor tools (audit_workflows,
+        // validate_workflow, *_full reads) — only the write tools stay gated.
+        { name: "enable_workflow_builder", register: () => registerEnableWorkflowBuilderTool(server) },
+        { name: "auto_capture_firebase_script", register: () => registerFirebaseCaptureScriptTool(server) },
+        // One-click Builder unlock — buyer just logs into a Chrome window the
+        // helper opens; also the silent re-capture path for token rotations.
+        { name: "capture_firebase_interactive", register: () => registerInteractiveCaptureTool(server) },
+        // Skills rail (2026-07-28): bundled skills (Blueprint) install themselves
+        // into ~/.claude/skills — subscribers never download anything separately.
+        // Auto-runs on every start (idempotent, never clobbers user edits);
+        // the tool exists for verification/repair. Every tier: local file copy
+        // only. Denying install_skills also skips the auto-install — a buyer who
+        // gated it clearly doesn't want this server writing files into ~/.claude.
+        {
+          name: "install_skills",
+          register: () => registerSkillsTool(server, pkg.version, __dirname),
+          deniedNote: "bundled-skills auto-install skipped too",
+          sideEffect: () => {
+            try {
+              const skillsResult = installBundledSkills({ packageVersion: pkg.version, baseDir: __dirname });
+              const line = summarizeInstall(skillsResult);
+              if (line) process.stderr.write(`[ghl-mcp] ${line}
+`);
+            } catch (e) {
+              process.stderr.write(`[ghl-mcp] Skills install skipped: ${String(e).slice(0, 120)}
+`);
+            }
+          }
+        }
+      ],
+      gatingConfig,
+      outOfBandTracker
+    );
     if (fileCreds && !process.env.GHL_API_KEY) {
       process.stderr.write(`[ghl-mcp] Loaded credentials from ${credentialsPath()}
 `);