@elitedcs/ghl-mcp 3.55.0 → 3.57.0

package/CHANGELOG.md

@@ -1,5 +1,130 @@
 # Changelog
 
+## 3.57.0 — Clone Site: copy a live page for a client, with the guardrails built in
+
+A second bundled skill. Point Claude at any live URL and get a working,
+rebranded copy for a client — same layout, images, video and CSS, with the
+new business's details in place of the original's. It installs itself like
+Blueprint; there is nothing to download and no new tools to learn.
+
+Cloning normally fails because the model *regenerates* the page instead of
+copying it, and you get a worse version of what you pointed at. This skill
+runs real scripts: they download the bytes, swap the strings, and verify the
+result. Nothing is retyped from memory.
+
+- **The rights question is step 0 and cannot be skipped.** Before anything is
+  copied, the skill asks who owns the page — you, your client (authorized),
+  written permission, or none — and records the answer in the run report and
+  in the final report header. It does not verify ownership; the declaration is
+  yours to make. The mirror script refuses to run without it.
+- **"None" gets a real lane, not a refusal.** It extracts the page's actual
+  design system — palette, CSS variables, font stack and type scale, spacing
+  rhythm, radii, shadows, breakpoints, and the section skeleton as shape — so
+  the rebuild starts from the real design instead of a from-memory redraw. No
+  bytes, images, video or copy are copied in that lane.
+- **Substitution that doesn't leak the old brand.** Derives the bare brand word,
+  every phone format, the address as a unit (not just the city), and domain and
+  email variants; runs across JS bundles as well as HTML and CSS, because
+  compiled sites keep contact details only in the bundle. Asset filenames are
+  protected from rewriting. Dry-run counts first, a zero-check after, and a
+  NEAR MISS warning when one of your facts is *almost* right.
+- **Catches the leak a string search cannot see.** A brand mark is usually
+  two-tone — `GHL <span style="color:#D4AF37;">Command</span>` — which reads as
+  the old brand on screen while that string appears nowhere in the file. Every
+  literal check calls it clean. Clone Site renders the page to text while
+  keeping a map back to source offsets, so it reports exactly which occurrences
+  are split by markup, shows the markup, and fails the zero-check until they are
+  hand-edited. Found on a real page, in the header and the footer, after a
+  file-level rebrand had already "passed."
+- **Asset capture from all four places** — HTML, CSS `url()`, CDN URLs in JS
+  bundles, and root-relative paths inside JS bundles (the one that silently
+  breaks images). Oversized files are reported for object storage, never
+  hot-linked back to the original owner's CDN.
+- **A mandatory pre-launch REVIEW REQUIRED report** on every run: form endpoints,
+  webhooks, payment links and publishable keys, booking embeds, analytics and ad
+  pixels (MUST REPOINT); names, addresses, testimonials and likenesses; and
+  inherited claims with regulated health/efficacy language flagged separately.
+  Nothing is auto-deleted — findings go to a human.
+- **Verification by content-type, not status code**, because static hosts answer
+  200 with the page shell for assets that don't exist. It retries once before
+  calling anything broken (a CDN rollout can answer a single request with HTML),
+  and separates references the *source* page was already serving badly from
+  breakage the clone caused.
+- Reports are written outside the deployable folder, so a rights declaration and
+  a liability list can never be published with the site.
+
+Everything below was found by running the tool against real production sites
+rather than test fixtures, and every one of them shipped a fix:
+
+- **Whole-site cloning.** A one-page mirror inherits the original's entire
+  navigation, so every menu item 404s the moment a client clicks it.
+  `--crawl --depth N --max-pages N` follows the site's own navigation, writes
+  each page at its own path, and rewrites links between your pages as
+  root-relative so the nav works locally and after deploy — while canonical and
+  og:url keep their host so the rebrand can point them at the client's domain.
+  The skill asks how deep to go rather than assuming. Real numbers: a 36-page
+  contractor site came to 2,104 files and 935 MB at depth 2.
+- **Assets that only exist at runtime.** Page-builders publish an asset base
+  path and concatenate chunk filenames onto it in JavaScript, so those files
+  appear in no attribute, stylesheet or string literal. Six missing Elementor
+  chunks meant no section background was painted at all: the hero rendered blank
+  and its white headline was invisible on white, while every file-level check
+  reported success. New `repair.mjs` plus a mandatory render-and-repair loop
+  fetches whatever the running page asks for and cannot find.
+- **Media hidden in escaped JSON.** Background slideshows and galleries store
+  image URLs inside entity-encoded, backslash-escaped JSON attributes. Those are
+  now extracted and localised, escaping preserved.
+- **Brand marks split across tags.** `GHL <span style="color:#D4AF37">Command</span>`
+  reads as the old brand on screen while that string exists nowhere in the file.
+  Detected exactly via a rendered-text-to-source offset map; the zero-check now
+  fails until they are hand-edited instead of reporting a false clean.
+- **HTML-entity brand forms.** A brand containing `&` is stored as `&amp;`. On
+  one page the plain token matched twice and the encoded form 56 times.
+- **Brand baked into image pixels.** Logos and graphics carrying the old phone
+  number or web address are flagged — substitution cannot edit artwork, and the
+  logo is the most visible way a clone gives itself away.
+- **New audit rules from real pages:** contractor and professional licence
+  numbers (the highest-severity item on any trades or medical clone), consumer
+  financing links, review widgets that load the original's reviews at runtime,
+  and internal links with no page in the clone.
+- **Bare-word derivation is now cautioned**, because a brand beginning with a
+  place name ("Arizona AC & Heating") would otherwise rewrite ordinary sentences.
+- **Style lane returns the brand's palette, not the framework's.** Plugin CSS
+  repeats neutral greys hundreds of times while the real brand colours appear
+  twice; vendor stylesheets are now separated, accents are attributed to their
+  source file, declared colour tokens are surfaced first, and CSS variables are
+  resolved so the type scale comes back as real pixel values.
+- **The style lane's deliverable is a page, not a document.** Its rebuild is now
+  five explicit steps, including a media step and a leak check against the
+  original page.
+
+## 3.56.0 — Security off-switches: any tool can be disabled; sub-account create/delete is opt-in
+
+Shaped directly by subscriber feedback: some teams keep account-level
+operations human-only, so a prompt-injected or misbehaving AI session can
+never touch them. Two new controls, both enforced at server startup from
+your config — there is deliberately NO way to change them from inside a
+Claude conversation.
+
+- **Sub-account create/delete is now OFF by default.** `create_sub_account`
+  and `delete_sub_account` register only when `GHL_ENABLE_ACCOUNT_ADMIN=1`
+  is set. The setup wizard asks (default No). The allowlist cannot bypass
+  the flag. If you were using these tools, add the flag and restart.
+- **Universal deny-list**: `GHL_DISABLED_TOOLS` / `GHL_DISABLED_MODULES`
+  switch off any tool or module. A disabled tool never registers — it is
+  invisible to the model, so it can't be called *or discovered* from a
+  conversation. Deny wins over the allowlist and the always-on set,
+  including the credential helpers (`enable_workflow_builder`,
+  `auto_capture_firebase_script`, `capture_firebase_interactive`) and
+  `install_skills` (denying it also skips the bundled-skills auto-install).
+- **Un-brickable**: the recovery core (`setup_ghl_mcp`, `request_license`,
+  `get_mcp_version`, `health_check`) ignores denial, with a logged warning.
+- **Verifiable**: `health_check` gained a "Tool gating" section reporting
+  exactly what's disabled, whether account admin is on, and any misspelled
+  name in your gating vars (typos do NOT disable anything — they warn).
+- Advertised default tool count is now 233 (235 with account admin enabled).
+- README: new "Turning tools off (security)" section with examples.
+
 ## 3.55.0 — Skills ship inside the package: Blueprint installs itself
 
 The gap between "the tools exist" and "the guided experience exists" is

package/README.md

@@ -1,6 +1,6 @@
 # GHL Command — GoHighLevel MCP Server
 
-**Full GoHighLevel API access for Claude.** 235 tools across 49 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers. **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
+**Full GoHighLevel API access for Claude.** 233 tools across 49 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers. **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
 
 **Distributed via npm as [`@elitedcs/ghl-mcp`](https://www.npmjs.com/package/@elitedcs/ghl-mcp).** Buyers install with one config block — no git, no Node.js setup, no terminal commands. Updates flow automatically (`npx @latest` re-resolves on every Claude restart).
 
@@ -12,7 +12,7 @@ Works with **both the Claude Desktop App and Claude Code terminal** — your cho
 
 **How this differs from HighLevel's official MCP.** HighLevel ships an official Anthropic MCP that reads and writes your CRM (contacts, conversations, calendars, opportunities, payments, social) over the public API — it's free and it's good; use it for that. What it *cannot* do, because the public API doesn't expose it: **build or edit workflows, build funnels/landing pages, or build forms.** That's exactly what GHL Command does — the programmatic Workflow Builder, funnel/page builder, form builder, deep workflow cloning, the silent-failure `audit_workflows`, and Blueprint (build a whole client account from one intake — ships as a guided skill that **installs itself automatically** with this package; nothing to download), all on GHL's internal APIs. **Official MCP = read/write your CRM. GHL Command = build and fix it.** They stack fine together.
 
-**Bundled skills (install automatically).** The package ships guided skills that teach Claude complete multi-step workflows on top of the raw tools. On every start the server installs/updates them into your `~/.claude/skills/` (never overwriting files you've edited — your version wins and is reported). Current skills: **Blueprint** — turn one client intake into a complete reviewed GHL account build. Verify or repair any time by asking Claude to `run install_skills`, then fully restart Claude so new skills load.
+**Bundled skills (install automatically).** The package ships guided skills that teach Claude complete multi-step workflows on top of the raw tools. On every start the server installs/updates them into your `~/.claude/skills/` (never overwriting files you've edited — your version wins and is reported). Current skills: **Blueprint** — turn one client intake into a complete reviewed GHL account build; **Clone Site** — point at a live URL and get a rebranded, deploy-ready copy for a client, with a recorded rights declaration, a style-only lane when you have no rights, and a mandatory pre-launch report of every lead/booking/payment destination, borrowed testimonial and inherited claim still belonging to the original owner. Verify or repair any time by asking Claude to `run install_skills`, then fully restart Claude so new skills load.
 
 Built by [Elite DCs, LLC](https://elitedcs.com).
 
@@ -122,7 +122,7 @@ Run setup_ghl_mcp to activate GHL Command:
   ghl_location_id: YOUR_LOCATION_ID
 ```
 
-Approve the tool call. Server validates your license, verifies your GHL credentials, writes them to a per-user config file. **Quit Claude one more time and reopen** — the full core toolset is now unlocked (235 tools total with the optional Workflow Builder Firebase add-on).
+Approve the tool call. Server validates your license, verifies your GHL credentials, writes them to a per-user config file. **Quit Claude one more time and reopen** — the full core toolset is now unlocked (233 tools total with the optional Workflow Builder Firebase add-on).
 
 ### 4. Try it
 
@@ -162,7 +162,7 @@ https://app.gohighlevel.com/v2/location/YOUR_LOCATION_ID/dashboard
 
 ## Enable the Workflow Builder
 
-The builder + cloner + validator tools (workflow builder, funnel builder, form builder, pipeline builder, workflow cloner, validate_workflow) use GHL's internal API and require Firebase credentials. Without them, the other 181 tools work fine — you just won't have workflow/funnel/form/pipeline editing. This is the flagship feature: do this step.
+The builder + cloner + validator tools (workflow builder, funnel builder, form builder, pipeline builder, workflow cloner, validate_workflow) use GHL's internal API and require Firebase credentials. Without them, the other 179 tools work fine — you just won't have workflow/funnel/form/pipeline editing. This is the flagship feature: do this step.
 
 **One-click capture (v3.49.0+, the supported path):**
 
@@ -751,7 +751,7 @@ Source repo is private. Contributors need an invitation from `drjerryrelth`. The
 
 ### Reducing context / token usage
 
-Every registered MCP tool's schema is shipped to the model on every message. With 235 tools that's a meaningful per-message context cost even in chats that never touch GHL. If you only use a slice of GHL Command, restrict the tool surface with `GHL_ENABLED_MODULES` and/or `GHL_ENABLED_TOOLS`:
+Every registered MCP tool's schema is shipped to the model on every message. With 233 tools that's a meaningful per-message context cost even in chats that never touch GHL. If you only use a slice of GHL Command, restrict the tool surface with `GHL_ENABLED_MODULES` and/or `GHL_ENABLED_TOOLS`:
 
 ```jsonc
 // Claude Desktop config — enable whole modules
@@ -786,6 +786,38 @@ Rules of the road:
 
 `contacts`, `conversations`, `opportunities`, `calendars`, `locations`, `workflows`, `funnels`, `forms`, `surveys`, `payments`, `products`, `invoices`, `campaigns`, `users`, `media`, `social-planner`, `courses`, `businesses`, `blogs`, `emails`, `trigger-links`, `custom-objects`, `associations`, `estimates`, `coupons`, `webhooks`, `documents`, `bulk-operations`, `account-export`, `template-deployer`, `workflow-builder`, `funnel-builder`, `form-builder`, `pipeline-builder`, `workflow-cloner`, `smart-lists`, `reputation`, `email-campaigns`, `email-builder`, `memberships`, `validators`, `diagnostics`, `location-switcher`
 
+### Turning tools off (security)
+
+Some teams keep certain operations human-only — for example sub-account management or messaging — so that a prompt-injected or misbehaving AI session can never touch them. Two controls exist for exactly that:
+
+**1. Sub-account create/delete is OFF by default.** `create_sub_account` and `delete_sub_account` do not register unless you explicitly opt in:
+
+```jsonc
+"env": {
+  "GHL_ENABLE_ACCOUNT_ADMIN": "1"   // exactly "1" — nothing else enables it
+}
+```
+
+The setup wizard asks this question during install (default No). Listing these tools in `GHL_ENABLED_TOOLS` does **not** bypass the flag.
+
+**2. Any tool or module can be switched off** with a deny-list:
+
+```jsonc
+"env": {
+  "GHL_DISABLED_TOOLS": "send_message,bulk_delete_contacts",
+  "GHL_DISABLED_MODULES": "snapshots"
+}
+```
+
+How the deny-list behaves:
+
+- **Deny wins over everything** — the allowlist, the always-on set, and `GHL_ENABLE_ACCOUNT_ADMIN`. A denied tool **never registers**: it is invisible to the model, so it cannot be called *or discovered* from a conversation.
+- **There is deliberately no tool to change gating from inside Claude.** Turning something back on requires editing your config file and fully restarting Claude — a human action.
+- **Recovery core stays reachable:** `setup_ghl_mcp`, `request_license`, `get_mcp_version`, and `health_check` ignore denial (with a logged warning) so you can never brick your install. Everything else — including the Firebase credential helpers `enable_workflow_builder`, `auto_capture_firebase_script`, `capture_firebase_interactive`, and `install_skills` (denying it also skips the bundled-skills auto-install) — is deniable.
+- **Verify it took effect:** run `health_check` in Claude. Its "Tool gating" section shows exactly what's disabled, whether account admin is on, and flags any misspelled name in your gating vars (typos do NOT disable anything — they warn instead).
+- Single-location shops that never want cross-account movement can also deny `switch_location` and `register_location`.
+- Honest limit: this gate is enforced at server startup from your config file, so it is as strong as your machine's file permissions. What it guarantees is that nothing *inside a Claude conversation* can widen the tool surface.
+
 ---
 
 ## Troubleshooting

package/dist/index.js

@@ -1235,7 +1235,7 @@ async function validateFirebase(firebaseKey, refreshToken) {
 function registerSetupTool(server2) {
   server2.tool(
     "setup_ghl_mcp",
-    "First-run setup for GHL Command MCP. Validates your license and GHL credentials, then writes them to a per-user credentials file. Restart Claude after this completes to load all 235 tools (181 if you skip the optional Firebase fields; add Firebase later with enable_workflow_builder).",
+    "First-run setup for GHL Command MCP. Validates your license and GHL credentials, then writes them to a per-user credentials file. Restart Claude after this completes to load all 233 tools (179 if you skip the optional Firebase fields; add Firebase later with enable_workflow_builder).",
     {
       email: import_zod40.z.string().email().describe("Email used at purchase."),
       license_key: import_zod40.z.string().min(20).describe("License key from your purchase email."),
@@ -1317,7 +1317,7 @@ Note: Firebase credentials rejected (${fb.error}). Saved without Workflow Builde
         signed_attestation: lic.signedAttestation
       });
       const isFree = lic.tier === "free";
-      const toolCount = isFree ? workflowBuilderEnabled ? "107" : "89" : workflowBuilderEnabled ? "235" : "181";
+      const toolCount = isFree ? workflowBuilderEnabled ? "107" : "89" : workflowBuilderEnabled ? "233" : "179";
       const wfLine = workflowBuilderEnabled ? "Workflow Builder: enabled." : "Workflow Builder: not configured (optional).";
       const wfTip = workflowBuilderEnabled ? "" : isFree ? `
 Unlock the account auditor next (the free tier's best tool): say "Unlock the Workflow Builder" \u2014 one browser login enables audit_workflows, validate_workflow, and the full-detail reads.` : "\nTo enable Workflow Builder later (52 extra Firebase-gated tools): run enable_workflow_builder with your three Firebase values. No need to re-enter license/API key/location ID.";
@@ -1347,7 +1347,7 @@ Unlock the account auditor next (the free tier's best tool): say "Unlock the Wor
 function registerEnableWorkflowBuilderTool(server2) {
   server2.tool(
     "enable_workflow_builder",
-    "Add Firebase credentials to an existing GHL Command install to unlock 54 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 181 to 235 after the next Claude restart.",
+    "Add Firebase credentials to an existing GHL Command install to unlock 54 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 179 to 233 after the next Claude restart.",
     {
       // v3.25.0: one-paste path. Tool runs `auto_capture_firebase_script` to
       // get the console script; the script returns a JSON object that pastes
@@ -1428,7 +1428,7 @@ DevTools steps: https://elitedcs.com/ghl-mcp-firebase`
             "",
             "**You MUST restart Claude before using any workflow-builder tool.** Quit Claude completely (Cmd+Q on Mac, full exit on Windows) and reopen. Without a restart, the workflow builder tools will keep using the OLD Firebase auth from before this call and fail with 401 errors \u2014 even though this tool reported success.",
             "",
-            'After restart, all 235 tools load. Try: "List my workflows in full detail" or "Validate workflow <id>".',
+            'After restart, all 233 tools load. Try: "List my workflows in full detail" or "Validate workflow <id>".',
             "",
             "Note: Firebase refresh tokens rotate every few weeks. If workflow tools stop working in a few weeks (run `health_check` to confirm Firebase auth: FAIL), run `auto_capture_firebase_script` for fresh values and re-run this tool with the new firebase_paste."
           ].join("\n")
@@ -1524,7 +1524,7 @@ The login in the capture window may belong to the wrong GHL account, or the sess
               "",
               "**You MUST restart Claude before using any workflow-builder tool.** Quit Claude completely (Cmd+Q on Mac, full exit on Windows) and reopen.",
               "",
-              'After restart, all 235 tools load. Try: "List my workflows in full detail".',
+              'After restart, all 233 tools load. Try: "List my workflows in full detail".',
               "",
               "Future token rotations re-capture silently \u2014 if workflow tools ever 401, just run capture_firebase_interactive again; no window should appear."
             ].join("\n")
@@ -2102,9 +2102,9 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.55.0",
+      version: "3.57.0",
       mcpName: "io.github.drjerryrelth/ghl-command",
-      description: "GoHighLevel MCP Server for Claude. 235 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
+      description: "GoHighLevel MCP Server for Claude. 233 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
       bin: {
         "ghl-mcp": "dist/index.js"
@@ -5683,6 +5683,25 @@ var ALWAYS_ON_TOOL_NAMES = /* @__PURE__ */ new Set([
   "enable_workflow_builder",
   "health_check"
 ]);
+var HARD_CORE_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "setup_ghl_mcp",
+  "request_license",
+  "get_mcp_version",
+  "health_check"
+]);
+var ACCOUNT_ADMIN_TOOLS = /* @__PURE__ */ new Set([
+  "create_sub_account",
+  "delete_sub_account"
+]);
+var OUT_OF_BAND_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "setup_ghl_mcp",
+  "request_license",
+  "get_mcp_version",
+  "enable_workflow_builder",
+  "auto_capture_firebase_script",
+  "capture_firebase_interactive",
+  "install_skills"
+]);
 var FREE_TIER_EXTRA_READ_TOOLS = /* @__PURE__ */ new Set([
   "audit_workflows",
   // account-wide silent-failure audit — the free tier's wow moment
@@ -5732,17 +5751,39 @@ function parseList(raw) {
 function parseAllowlist(env) {
   const moduleList = parseList(env.GHL_ENABLED_MODULES);
   const toolList = parseList(env.GHL_ENABLED_TOOLS);
+  const disabledModuleList = parseList(env.GHL_DISABLED_MODULES);
+  const disabledToolList = parseList(env.GHL_DISABLED_TOOLS);
   return {
     enabledModules: moduleList ? new Set(moduleList) : null,
     enabledTools: toolList ? new Set(toolList) : null,
+    disabledModules: disabledModuleList ? new Set(disabledModuleList) : null,
+    disabledTools: disabledToolList ? new Set(disabledToolList) : null,
+    accountAdminEnabled: env.GHL_ENABLE_ACCOUNT_ADMIN === "1",
     rawModuleInput: moduleList,
-    rawToolInput: toolList
+    rawToolInput: toolList,
+    rawDisabledModuleInput: disabledModuleList,
+    rawDisabledToolInput: disabledToolList
   };
 }
 function isAllowlistActive(config3) {
   return config3.enabledModules !== null || config3.enabledTools !== null;
 }
+function isDenyListActive(config3) {
+  return config3.disabledModules !== null || config3.disabledTools !== null;
+}
+function isGatingActive(config3) {
+  return isAllowlistActive(config3) || isDenyListActive(config3) || config3.accountAdminEnabled;
+}
+function isToolDenied(toolName, moduleName, config3) {
+  if (HARD_CORE_TOOL_NAMES.has(toolName)) return false;
+  const toolDenied = config3.disabledTools?.has(toolName.toLowerCase()) ?? false;
+  const moduleDenied = moduleName.length > 0 && (config3.disabledModules?.has(moduleName.toLowerCase()) ?? false);
+  return toolDenied || moduleDenied;
+}
 function shouldRegister(toolName, moduleName, config3) {
+  if (HARD_CORE_TOOL_NAMES.has(toolName)) return true;
+  if (isToolDenied(toolName, moduleName, config3)) return false;
+  if (ACCOUNT_ADMIN_TOOLS.has(toolName) && !config3.accountAdminEnabled) return false;
   if (ALWAYS_ON_TOOL_NAMES.has(toolName)) return true;
   if (!isAllowlistActive(config3)) return true;
   const toolLower = toolName.toLowerCase();
@@ -5782,32 +5823,57 @@ function wrapServerForModule(realServer, moduleName, config3, attemptedTools, re
     }
   });
 }
+function buildGatingReport(config3, knownModules, attemptedTools, registeredTools, outOfBand) {
+  const knownLower = new Set([...knownModules].map((m) => m.toLowerCase()));
+  const knownToolsLower = /* @__PURE__ */ new Set([
+    ...[...attemptedTools].map((t) => t.toLowerCase()),
+    ...[...OUT_OF_BAND_TOOL_NAMES].map((t) => t.toLowerCase())
+  ]);
+  const unknownModules = (raw) => (raw ?? []).filter((m) => !knownLower.has(m));
+  const unknownTools = (raw) => (raw ?? []).filter((t) => !knownToolsLower.has(t));
+  const hardCoreLower = new Set([...HARD_CORE_TOOL_NAMES].map((t) => t.toLowerCase()));
+  return {
+    gatingActive: isGatingActive(config3),
+    allowlistActive: isAllowlistActive(config3),
+    denyListActive: isDenyListActive(config3),
+    accountAdminEnabled: config3.accountAdminEnabled,
+    enabledModules: [...config3.enabledModules ?? []].sort(),
+    enabledTools: [...config3.enabledTools ?? []].sort(),
+    disabledModules: [...config3.disabledModules ?? []].sort(),
+    disabledTools: [...config3.disabledTools ?? []].sort(),
+    ignoredHardCoreDenials: (config3.rawDisabledToolInput ?? []).filter((t) => hardCoreLower.has(t)),
+    unknownEnabledModules: unknownModules(config3.rawModuleInput),
+    unknownEnabledTools: unknownTools(config3.rawToolInput),
+    unknownDisabledModules: unknownModules(config3.rawDisabledModuleInput),
+    unknownDisabledTools: unknownTools(config3.rawDisabledToolInput),
+    outOfBandDenied: [...outOfBand?.denied ?? []].sort(),
+    registeredCount: registeredTools.size + (outOfBand?.registered.size ?? 0),
+    attemptedCount: attemptedTools.size + (outOfBand?.registered.size ?? 0) + (outOfBand?.denied.size ?? 0)
+  };
+}
 function validateAndLog(config3, knownModules, attemptedTools, registeredTools, log = (m) => process.stderr.write(m)) {
-  if (!isAllowlistActive(config3)) return;
-  if (config3.rawModuleInput) {
-    const knownLower = new Set([...knownModules].map((m) => m.toLowerCase()));
-    const unknown = config3.rawModuleInput.filter((m) => !knownLower.has(m));
-    if (unknown.length > 0) {
-      log(
-        `[ghl-mcp] WARNING: GHL_ENABLED_MODULES has unrecognized name(s): ${unknown.join(", ")}. Known modules: ${[...knownModules].sort().join(", ")}.
-`
-      );
+  if (!isGatingActive(config3)) return;
+  const report = buildGatingReport(config3, knownModules, attemptedTools, registeredTools);
+  const warnUnknown = (varName, names, hint = "") => {
+    if (names.length > 0) {
+      log(`[ghl-mcp] WARNING: ${varName} has unrecognized name(s): ${names.join(", ")}.${hint}
+`);
     }
-  }
-  if (config3.rawToolInput) {
-    const attemptedLower = new Set([...attemptedTools].map((t) => t.toLowerCase()));
-    const unknown = config3.rawToolInput.filter((t) => !attemptedLower.has(t));
-    if (unknown.length > 0) {
-      log(
-        `[ghl-mcp] WARNING: GHL_ENABLED_TOOLS has unrecognized name(s): ${unknown.join(", ")}.
+  };
+  const modulesHint = ` Known modules: ${[...knownModules].sort().join(", ")}.`;
+  warnUnknown("GHL_ENABLED_MODULES", report.unknownEnabledModules, modulesHint);
+  warnUnknown("GHL_ENABLED_TOOLS", report.unknownEnabledTools);
+  warnUnknown("GHL_DISABLED_MODULES", report.unknownDisabledModules, modulesHint);
+  warnUnknown("GHL_DISABLED_TOOLS", report.unknownDisabledTools);
+  if (report.ignoredHardCoreDenials.length > 0) {
+    log(
+      `[ghl-mcp] WARNING: GHL_DISABLED_TOOLS lists recovery-core tool(s) that cannot be disabled (ignored): ${report.ignoredHardCoreDenials.join(", ")}.
 `
-      );
-    }
+    );
   }
-  const moduleSummary = config3.enabledModules && config3.enabledModules.size > 0 ? `modules=[${[...config3.enabledModules].sort().join(",")}]` : "modules=(none)";
-  const toolSummary = config3.enabledTools && config3.enabledTools.size > 0 ? `explicit-tools=[${[...config3.enabledTools].sort().join(",")}]` : "explicit-tools=(none)";
+  const listOr = (label, items) => items.length > 0 ? `${label}=[${items.join(",")}]` : `${label}=(none)`;
   log(
-    `[ghl-mcp] Tool allowlist active: registered ${registeredTools.size} of ${attemptedTools.size} tools (${moduleSummary}; ${toolSummary}).
+    `[ghl-mcp] Tool gating active: registered ${registeredTools.size} of ${attemptedTools.size} tools (${listOr("modules", report.enabledModules)}; ${listOr("explicit-tools", report.enabledTools)}; ${listOr("disabled-modules", report.disabledModules)}; ${listOr("disabled-tools", report.disabledTools)}; account-admin=${report.accountAdminEnabled ? "ENABLED" : "off (default)"}).
 `
   );
 }
@@ -14083,10 +14149,10 @@ async function getVersionStatus(installed) {
 }
 
 // src/tools/diagnostics.ts
-function registerDiagnosticTools(server2, installedVersion, client, builderClient, registry2) {
+function registerDiagnosticTools(server2, installedVersion, client, builderClient, registry2, getGatingReport) {
   server2.tool(
     "health_check",
-    "Run a full health check of the GHL Command MCP install. Reports on: npm registry + version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), and token registry. Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change.",
+    "Run a full health check of the GHL Command MCP install. Reports on: npm registry + version status, GHL API key validity, default location reachability, Firebase auth status (workflow builder), token registry, and the tool-gating policy (disabled tools/modules, account-admin opt-in, typos in gating env vars). Returns a structured pass/fail/warn list with detail per check. Use this when something feels broken or after credentials change.",
     {},
     async () => {
       const checks = [];
@@ -14136,7 +14202,7 @@ function registerDiagnosticTools(server2, installedVersion, client, builderClien
       })();
       const firebasePromise = (async () => {
         if (!builderClient) {
-          return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured. The 49 Firebase-gated tools need Firebase credentials. The other 163 tools work fine without. To add it: run enable_workflow_builder with the three Firebase values from your GHL browser session (see elitedcs.com/ghl-mcp-firebase for DevTools steps). Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart. enable_workflow_builder saves and verifies them for you." };
+          return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured. The 54 Firebase-gated tools need Firebase credentials. The other 179 tools work fine without. To add it: run enable_workflow_builder with the three Firebase values from your GHL browser session (see elitedcs.com/ghl-mcp-firebase for DevTools steps). Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart. enable_workflow_builder saves and verifies them for you." };
         }
         const result = await builderClient.checkAuth();
         const tokenCompany = builderClient.getTokenCompanyId();
@@ -14185,7 +14251,32 @@ function registerDiagnosticTools(server2, installedVersion, client, builderClien
       } else {
         versionCheck = { name: "npm registry + version", status: "warn", detail: `Installed v${versionStatus.installed} but latest is v${versionStatus.latest}. Quit Claude (Cmd+Q) and reopen to upgrade.` };
       }
-      checks.push(versionCheck, apiKeyCheck, locationCheck, firebaseCheck, registryCheck);
+      const gatingCheck = (() => {
+        const r = getGatingReport?.();
+        if (!r) {
+          return { name: "Tool gating", status: "skip", detail: "Gating report unavailable in this mode." };
+        }
+        if (!r.gatingActive) {
+          return { name: "Tool gating", status: "pass", detail: `No gating configured \u2014 all ${r.registeredCount} tools registered. Sub-account create/delete stays OFF unless GHL_ENABLE_ACCOUNT_ADMIN=1 is set.` };
+        }
+        const parts = [`${r.registeredCount} of ${r.attemptedCount} tools registered.`];
+        if (r.disabledTools.length > 0) parts.push(`Disabled tools: ${r.disabledTools.join(", ")}.`);
+        if (r.disabledModules.length > 0) parts.push(`Disabled modules: ${r.disabledModules.join(", ")}.`);
+        if (r.outOfBandDenied.length > 0) parts.push(`Confirmed unregistered (setup/helper tools): ${r.outOfBandDenied.join(", ")}.`);
+        if (r.allowlistActive) parts.push(`Allowlist: modules=[${r.enabledModules.join(",") || "-"}], tools=[${r.enabledTools.join(",") || "-"}].`);
+        parts.push(`Account admin (sub-account create/delete): ${r.accountAdminEnabled ? "ENABLED via GHL_ENABLE_ACCOUNT_ADMIN=1" : "OFF (default)"}.`);
+        const problems = [];
+        if (r.ignoredHardCoreDenials.length > 0) problems.push(`recovery-core tool(s) in GHL_DISABLED_TOOLS cannot be disabled and were IGNORED: ${r.ignoredHardCoreDenials.join(", ")}`);
+        if (r.unknownDisabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_TOOLS (possible typo \u2014 those tools are NOT disabled): ${r.unknownDisabledTools.join(", ")}`);
+        if (r.unknownDisabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_DISABLED_MODULES (possible typo): ${r.unknownDisabledModules.join(", ")}`);
+        if (r.unknownEnabledTools.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_TOOLS: ${r.unknownEnabledTools.join(", ")}`);
+        if (r.unknownEnabledModules.length > 0) problems.push(`unrecognized name(s) in GHL_ENABLED_MODULES: ${r.unknownEnabledModules.join(", ")}`);
+        if (problems.length > 0) {
+          return { name: "Tool gating", status: "warn", detail: `${parts.join(" ")} PROBLEMS: ${problems.join("; ")}. Fix the env var in your Claude config and fully restart Claude.` };
+        }
+        return { name: "Tool gating", status: "pass", detail: parts.join(" ") };
+      })();
+      checks.push(versionCheck, apiKeyCheck, locationCheck, firebaseCheck, registryCheck, gatingCheck);
       const symbols = { pass: "\u2713", fail: "\u2717", warn: "!", skip: "\u2014" };
       const lines = [];
       lines.push("GHL Command \u2014 Health Check");
@@ -17677,7 +17768,7 @@ var KNOWN_MODULES = /* @__PURE__ */ new Set([
   LOCATION_SWITCHER_MODULE,
   SNAPSHOTS_MODULE
 ]);
-function registerAllTools(server2, client, registry2, mcpVersion, env = process.env, tier = "full") {
+function registerAllTools(server2, client, registry2, mcpVersion, env = process.env, tier = "full", outOfBand) {
   const config3 = parseAllowlist(env);
   const attemptedTools = /* @__PURE__ */ new Set();
   const registeredTools = /* @__PURE__ */ new Set();
@@ -17699,7 +17790,8 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
     mcpVersion ?? "unknown",
     client,
     builderClient,
-    registry2 ?? null
+    registry2 ?? null,
+    () => buildGatingReport(config3, KNOWN_MODULES, attemptedTools, registeredTools, outOfBand)
   );
   registerSnapshotTools(wrap(SNAPSHOTS_MODULE), client, registry2);
   registerLocationSwitcherTools(
@@ -17709,7 +17801,7 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
     registry2,
     mcpVersion
   );
-  if (isAllowlistActive(config3)) {
+  if (isGatingActive(config3)) {
     validateAndLog(config3, KNOWN_MODULES, attemptedTools, registeredTools);
   }
   if (tier === "free") {
@@ -17721,6 +17813,26 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
   return { registeredTools, gatedTools };
 }
 
+// src/out-of-band.ts
+function makeOutOfBandTracker() {
+  return { registered: /* @__PURE__ */ new Set(), denied: /* @__PURE__ */ new Set() };
+}
+function registerOutOfBand(entries, config3, tracker, log = (m) => process.stderr.write(m)) {
+  for (const entry of entries) {
+    if (isToolDenied(entry.name, "", config3)) {
+      tracker.denied.add(entry.name);
+      log(
+        `[ghl-mcp] Tool disabled by GHL_DISABLED_TOOLS: ${entry.name}${entry.deniedNote ? ` (${entry.deniedNote})` : ""}
+`
+      );
+      continue;
+    }
+    tracker.registered.add(entry.name);
+    entry.register();
+    entry.sideEffect?.();
+  }
+}
+
 // src/index.ts
 init_credentials_store();
 init_setup_tool();
@@ -17844,7 +17956,7 @@ function summarizeInstall(r) {
 function registerSkillsTool(server2, packageVersion, baseDir) {
   server2.tool(
     "install_skills",
-    "Install (or repair) the guided skills bundled with GHL Command \u2014 currently the Blueprint skill (build a whole client account from one intake) \u2014 into your ~/.claude/skills/ so Claude can use them. Runs automatically on startup; call this to verify what is installed, or to re-install after deleting a skill. NEVER overwrites files you have edited (your version is kept and reported). Restart Claude after install for new skills to load.",
+    "Install (or repair) the guided skills bundled with GHL Command \u2014 Blueprint (build a whole client account from one intake) and Clone Site (clone and rebrand a live web page for a client, with a rights declaration and a pre-launch liability report) \u2014 into your ~/.claude/skills/ so Claude can use them. Runs automatically on startup; call this to verify what is installed, or to re-install after deleting a skill. NEVER overwrites files you have edited (your version is kept and reported). Restart Claude after install for new skills to load.",
     {
       targetDir: import_zod57.z.string().optional().describe("Override the install directory. Default: ~/.claude/skills")
     },
@@ -18408,6 +18520,9 @@ async function resolveAccessAndRegister() {
 `);
   }
   inBootstrapMode = !apiKey || !locationId || !licenseVerified;
+  const gatingConfig = parseAllowlist(process.env);
+  const outOfBandTracker = makeOutOfBandTracker();
+  outOfBandTracker.registered.add("get_mcp_version");
   if (inBootstrapMode) {
     process.stderr.write(
       `[ghl-mcp] Bootstrap mode.
@@ -18417,23 +18532,52 @@ async function resolveAccessAndRegister() {
     );
     registerSetupTool(server);
     registerLeadCaptureTool(server);
-    registerFirebaseCaptureScriptTool(server);
+    registerOutOfBand(
+      [{ name: "auto_capture_firebase_script", register: () => registerFirebaseCaptureScriptTool(server) }],
+      gatingConfig,
+      outOfBandTracker
+    );
   } else {
     const client = new GHLClient({ apiKey, locationId });
-    registerAllTools(server, client, registry, pkg.version, process.env, sessionTier);
-    registerEnableWorkflowBuilderTool(server);
-    registerFirebaseCaptureScriptTool(server);
-    registerInteractiveCaptureTool(server);
-    registerSkillsTool(server, pkg.version, __dirname);
-    try {
-      const skillsResult = installBundledSkills({ packageVersion: pkg.version, baseDir: __dirname });
-      const line = summarizeInstall(skillsResult);
-      if (line) process.stderr.write(`[ghl-mcp] ${line}
+    registerAllTools(server, client, registry, pkg.version, process.env, sessionTier, outOfBandTracker);
+    registerOutOfBand(
+      [
+        // Available in normal mode so buyers can add Firebase later without
+        // re-running setup_ghl_mcp with all 7 fields, and so they can re-grab
+        // a fresh refresh token when it rotates. Registered on the FREE tier too:
+        // the Firebase login powers the read-only auditor tools (audit_workflows,
+        // validate_workflow, *_full reads) — only the write tools stay gated.
+        { name: "enable_workflow_builder", register: () => registerEnableWorkflowBuilderTool(server) },
+        { name: "auto_capture_firebase_script", register: () => registerFirebaseCaptureScriptTool(server) },
+        // One-click Builder unlock — buyer just logs into a Chrome window the
+        // helper opens; also the silent re-capture path for token rotations.
+        { name: "capture_firebase_interactive", register: () => registerInteractiveCaptureTool(server) },
+        // Skills rail (2026-07-28): bundled skills (Blueprint) install themselves
+        // into ~/.claude/skills — subscribers never download anything separately.
+        // Auto-runs on every start (idempotent, never clobbers user edits);
+        // the tool exists for verification/repair. Every tier: local file copy
+        // only. Denying install_skills also skips the auto-install — a buyer who
+        // gated it clearly doesn't want this server writing files into ~/.claude.
+        {
+          name: "install_skills",
+          register: () => registerSkillsTool(server, pkg.version, __dirname),
+          deniedNote: "bundled-skills auto-install skipped too",
+          sideEffect: () => {
+            try {
+              const skillsResult = installBundledSkills({ packageVersion: pkg.version, baseDir: __dirname });
+              const line = summarizeInstall(skillsResult);
+              if (line) process.stderr.write(`[ghl-mcp] ${line}
 `);
-    } catch (e) {
-      process.stderr.write(`[ghl-mcp] Skills install skipped: ${String(e).slice(0, 120)}
+            } catch (e) {
+              process.stderr.write(`[ghl-mcp] Skills install skipped: ${String(e).slice(0, 120)}
 `);
-    }
+            }
+          }
+        }
+      ],
+      gatingConfig,
+      outOfBandTracker
+    );
     if (fileCreds && !process.env.GHL_API_KEY) {
       process.stderr.write(`[ghl-mcp] Loaded credentials from ${credentialsPath()}
 `);

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.55.0",
+  "version": "3.57.0",
   "mcpName": "io.github.drjerryrelth/ghl-command",
-  "description": "GoHighLevel MCP Server for Claude. 235 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
+  "description": "GoHighLevel MCP Server for Claude. 233 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",
   "bin": {
     "ghl-mcp": "dist/index.js"