@elitedcs/ghl-mcp 3.66.0 → 3.66.2

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## 3.66.2 — an export could describe the wrong client
+
+If you asked for one client's account and the server had been started pointing at
+another, part of the report came from the other account. Not an error, not a
+warning: the workflows and funnels of a different business, sitting under the
+name of the one you asked about.
+
+It happened because the export asked two different places for "which account",
+and only one of them listened to the account you named. That is now a single
+answer. If the two ever disagree, the export refuses those sections and tells you
+which account it is actually holding and how to switch, rather than answering for
+the wrong one. Everything else in the report was always correct.
+
+Every section also explains itself when it fails now. They used to all say
+"Error fetching", which told you nothing and hid a real permissions error behind
+what looked like a hiccup.
+
+**New guide: Clone and rebrand a site.** Point Claude at a page you have the
+rights to, and get it rebuilt for your client with their name, colours and
+contact details, plus a review list of everything still belonging to whoever
+owned the original: where the leads and payments still go, other people's
+testimonials, claims that came along with the copy. Proven against a real site
+before it was written.
+
+That guide is deliberately separate from building a page inside GHL. Cloning an
+existing page and composing a new one are different jobs that fail in different
+ways, and one guide covering both served neither.
+
+**Blog guide parked.** Reading a list of blog posts does not work — the address
+it calls does not exist, on any account. Rather than ship a guide that depends on
+it, the blog tools are marked as not guide material until that is fixed.
+
+## 3.66.1 — the tool count was wrong, and so was the thing that checked it
+
+GHL Command has served 239 tools since v3.60.0. Every place we stated the number
+said 238, and had done for twelve releases.
+
+The cause is worth writing down, because the number was the smaller half of it.
+The count was derived from a total that a person kept up to date by hand, and the
+test that checked our claims derived its answer from that same total. So the
+claim and the check always agreed, and both were wrong together. Nothing in the
+suite could see the gap, because everything in the suite was looking at the same
+number.
+
+Three figures were each one low and are now correct: **239 tools**, **184 without
+the optional builder step**, **111 on the free tier**. The upgrade still unlocks
+55 tools; that figure was always right, because the error cancelled out of a
+subtraction.
+
+The mechanism is fixed too, which matters more than the digits. The tools counted
+here are now read from the list the server registers them from, so a tool added
+tomorrow changes the number the day it lands rather than the day someone
+remembers. There is also a new release check that starts a real server, asks it
+what tools it has, and compares that to what we advertise. That is the only check
+that could have caught this, because it is the only one that does not get its
+answer from the code it is checking.
+
+Earlier entries in this file state counts that were one low at the time. They are
+left as they were written rather than quietly corrected.
+
+Also: `update_webhook` now carries the same warning as the other webhook tools
+about `tags` arriving as comma separated text rather than a list.
+
 ## 3.66.0 — webhooks work now
 
 The five webhook tools have never worked for anyone. They called an address

package/README.md

@@ -1,6 +1,6 @@
 # GHL Command — GoHighLevel MCP Server
 
-**Full GoHighLevel API access for Claude.** 238 tools across 50 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers. **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
+**Full GoHighLevel API access for Claude.** 239 tools across 50 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers. **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
 
 **Distributed via npm as [`@elitedcs/ghl-mcp`](https://www.npmjs.com/package/@elitedcs/ghl-mcp).** Buyers install with one config block — no git, no Node.js setup, no terminal commands. Updates flow automatically (`npx @latest` re-resolves on every Claude restart).
 
@@ -8,7 +8,7 @@ Works with **both the Claude Desktop App and Claude Code terminal** — your cho
 
 **License required.** Get it at [ghlcommand.com](https://ghlcommand.com?utm_source=npm&utm_medium=readme) — $97/mo, covering UNLIMITED GoHighLevel sub-accounts on up to 3 machines (never billed per account). **30-day time-back guarantee**: save 5+ hours on one client build or your first month back.
 
-**Try it FREE (read-only tier).** Grab an instant free key at [ghlcommand.com/free](https://ghlcommand.com/free?utm_source=npm&utm_medium=readme) — 110 read-only tools on your own GHL account once the two-step install is finished (the same install as the paid tier — upgrading later is just a license swap): the account-wide workflow audit (`audit_workflows` finds the silently broken references GHL never warns you about), account health, and every read across contacts, pipelines, funnels, and workflows. Write tools stay visible and answer with upgrade info. Buying later with the same email upgrades your key in place — 1 machine on free, 3 when you upgrade.
+**Try it FREE (read-only tier).** Grab an instant free key at [ghlcommand.com/free](https://ghlcommand.com/free?utm_source=npm&utm_medium=readme) — 111 read-only tools on your own GHL account once the two-step install is finished (the same install as the paid tier — upgrading later is just a license swap): the account-wide workflow audit (`audit_workflows` finds the silently broken references GHL never warns you about), account health, and every read across contacts, pipelines, funnels, and workflows. Write tools stay visible and answer with upgrade info. Buying later with the same email upgrades your key in place — 1 machine on free, 3 when you upgrade.
 
 **How this differs from HighLevel's official MCP.** HighLevel ships an official Anthropic MCP that reads and writes your CRM (contacts, conversations, calendars, opportunities, payments, social) over the public API — it's free and it's good; use it for that. What it *cannot* do, because the public API doesn't expose it: **build or edit workflows, build funnels/landing pages, or build forms.** That's exactly what GHL Command does — the programmatic Workflow Builder, funnel/page builder, form builder, deep workflow cloning, the silent-failure `audit_workflows`, and Blueprint (build a whole client account from one intake — ships as a guided skill that **installs itself automatically** with this package; nothing to download), all on GHL's internal APIs. **Official MCP = read/write your CRM. GHL Command = build and fix it.** They stack fine together.
 
@@ -135,7 +135,7 @@ Run setup_ghl_mcp to activate GHL Command:
   ghl_location_id: YOUR_LOCATION_ID
 ```
 
-Approve the tool call. Server validates your license, verifies your GHL credentials, writes them to a per-user config file. **Quit Claude one more time and reopen** — the full core toolset is now unlocked (238 tools total with the optional Workflow Builder Firebase add-on).
+Approve the tool call. Server validates your license, verifies your GHL credentials, writes them to a per-user config file. **Quit Claude one more time and reopen** — the full core toolset is now unlocked (239 tools total with the optional Workflow Builder Firebase add-on).
 
 ### 4. Try it
 
@@ -175,7 +175,7 @@ https://app.gohighlevel.com/v2/location/YOUR_LOCATION_ID/dashboard
 
 ## Enable the Workflow Builder
 
-The builder + cloner + validator tools (workflow builder, funnel builder, form builder, pipeline builder, workflow cloner, validate_workflow) use GHL's internal API and require Firebase credentials. Without them, the other 183 tools work fine — you just won't have workflow/funnel/form/pipeline editing. This is the flagship feature: do this step.
+The builder + cloner + validator tools (workflow builder, funnel builder, form builder, pipeline builder, workflow cloner, validate_workflow) use GHL's internal API and require Firebase credentials. Without them, the other 184 tools work fine — you just won't have workflow/funnel/form/pipeline editing. This is the flagship feature: do this step.
 
 **One-click capture (v3.49.0+, the supported path):**
 
@@ -798,7 +798,7 @@ Source repo is private. Contributors need an invitation from `drjerryrelth`. The
 
 ### Reducing context / token usage
 
-Every registered MCP tool's schema is shipped to the model on every message. With 238 tools that's a meaningful per-message context cost even in chats that never touch GHL. If you only use a slice of GHL Command, restrict the tool surface with `GHL_ENABLED_MODULES` and/or `GHL_ENABLED_TOOLS`:
+Every registered MCP tool's schema is shipped to the model on every message. With 239 tools that's a meaningful per-message context cost even in chats that never touch GHL. If you only use a slice of GHL Command, restrict the tool surface with `GHL_ENABLED_MODULES` and/or `GHL_ENABLED_TOOLS`:
 
 ```jsonc
 // Claude Desktop config — enable whole modules

package/dist/index.js

@@ -1648,7 +1648,7 @@ Note: Firebase credentials rejected (${fb.error}).`;
       const telemetryLine = telemetryDisabled(process.env) ? "" : `
 
 ${TELEMETRY_DISCLOSURE}`;
-      const finishedCount = isFree ? "110" : "238";
+      const finishedCount = isFree ? "111" : "239";
       const freeTip = isFree ? `
 
 Free tier: read-only. Write tools stay visible but answer with upgrade info instead of acting. Full version ($97/mo founding rate) upgrades in place \u2014 same install, you only swap the license key: https://ghlcommand.com` : "";
@@ -1693,7 +1693,7 @@ Free tier: read-only. Write tools stay visible but answer with upgrade info inst
 function registerEnableWorkflowBuilderTool(server2) {
   server2.tool(
     "enable_workflow_builder",
-    "Add Firebase credentials to an existing GHL Command install to unlock 55 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 183 to 238 after the next Claude restart.",
+    "Add Firebase credentials to an existing GHL Command install to unlock 55 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 184 to 239 after the next Claude restart.",
     {
       // v3.25.0: one-paste path. Tool runs `auto_capture_firebase_script` to
       // get the console script; the script returns a JSON object that pastes
@@ -1774,7 +1774,7 @@ DevTools steps: https://elitedcs.com/ghl-mcp-firebase`
             "",
             "**You MUST restart Claude before using any workflow-builder tool.** Quit Claude completely (Cmd+Q on Mac, full exit on Windows) and reopen. Without a restart, the workflow builder tools will keep using the OLD Firebase auth from before this call and fail with 401 errors \u2014 even though this tool reported success.",
             "",
-            'After restart, all 238 tools load. Try: "List my workflows in full detail" or "Validate workflow <id>".',
+            'After restart, all 239 tools load. Try: "List my workflows in full detail" or "Validate workflow <id>".',
             "",
             "Note: Firebase refresh tokens rotate every few weeks. If workflow tools stop working in a few weeks (run `health_check` to confirm Firebase auth: FAIL), run `auto_capture_firebase_script` for fresh values and re-run this tool with the new firebase_paste."
           ].join("\n")
@@ -1870,7 +1870,7 @@ The login in the capture window may belong to the wrong GHL account, or the sess
               "",
               "**You MUST restart Claude before using any workflow-builder tool.** Quit Claude completely (Cmd+Q on Mac, full exit on Windows) and reopen.",
               "",
-              'After restart, all 238 tools load. Try: "List my workflows in full detail".',
+              'After restart, all 239 tools load. Try: "List my workflows in full detail".',
               "",
               "Future token rotations re-capture silently \u2014 if workflow tools ever 401, just run capture_firebase_interactive again; no window should appear."
             ].join("\n")
@@ -2854,9 +2854,9 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.66.0",
+      version: "3.66.2",
       mcpName: "io.github.drjerryrelth/ghl-command",
-      description: "GoHighLevel MCP Server for Claude. 238 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
+      description: "GoHighLevel MCP Server for Claude. 239 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
       bin: {
         "ghl-mcp": "dist/index.js"
@@ -10292,7 +10292,7 @@ function registerWebhookTools(server2, builderClient) {
   );
   server2.tool(
     "update_webhook",
-    "Change a webhook's URL, method, custom data, headers, name, events, or published status. Edits the existing action in place rather than replacing it, so the workflow's history and any other steps around it survive. Only the fields you pass change; everything else is left alone.",
+    "Change a webhook's URL, method, custom data, headers, name, events, or published status. Edits the existing action in place rather than replacing it, so the workflow's history and any other steps around it survive. Only the fields you pass change; everything else is left alone. " + WEBHOOK_PAYLOAD_NOTE,
     {
       webhookId: import_zod34.z.string().describe("The webhook ID (its workflow ID)."),
       url: import_zod34.z.string().optional().describe("New destination URL."),
@@ -13691,8 +13691,22 @@ var import_zod46 = require("zod");
 function delay2(ms) {
   return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
-function registerAccountExportTools(server2, client, registry2) {
-  const builderClient = WorkflowBuilderClient.fromEnv();
+function builderSectionAvailability(builderLocationId, requestedLocationId) {
+  if (!builderLocationId) {
+    return {
+      usable: false,
+      reason: "Not read: the workflow builder is not connected. Run enable_workflow_builder to add Firebase credentials, then export again."
+    };
+  }
+  if (builderLocationId !== requestedLocationId) {
+    return {
+      usable: false,
+      reason: `Not read: the workflow builder is connected to a DIFFERENT sub-account (${builderLocationId}), not the one being exported (${requestedLocationId}). Reading it would describe the wrong account. Run switch_location to ${requestedLocationId} and export again.`
+    };
+  }
+  return { usable: true };
+}
+function registerAccountExportTools(server2, client, registry2, builderClient) {
   server2.tool(
     "export_account",
     "Export a complete inventory of the GHL sub-account: location info, contacts (count + sample), pipelines with stages, workflows (with full actions if builder auth is configured), funnels with pages, forms, custom fields, custom values, tags, calendars, and users. Returns a comprehensive JSON report for auditing or backup.",
@@ -13709,8 +13723,8 @@ function registerAccountExportTools(server2, client, registry2) {
         };
         try {
           report.location = await client.get(`/locations/${locId}`);
-        } catch {
-          report.location = "Error fetching";
+        } catch (e) {
+          report.location = `Error fetching: ${errorMessage(e)}`;
         }
         await delay2(100);
         try {
@@ -13724,36 +13738,38 @@ function registerAccountExportTools(server2, client, registry2) {
             total: typeof meta.total === "number" ? meta.total : contactList.length,
             sample: includeContacts ? contactList : contactList.slice(0, 1)
           };
-        } catch {
-          report.contacts = "Error fetching";
+        } catch (e) {
+          report.contacts = `Error fetching: ${errorMessage(e)}`;
         }
         await delay2(100);
         try {
           report.pipelines = await client.get("/opportunities/pipelines", {
             params: { locationId: locId }
           });
-        } catch {
-          report.pipelines = "Error fetching";
+        } catch (e) {
+          report.pipelines = `Error fetching: ${errorMessage(e)}`;
         }
         await delay2(100);
         try {
           report.workflows = await client.get("/workflows/", {
             params: { locationId: locId }
           });
-        } catch {
-          report.workflows = "Error fetching";
+        } catch (e) {
+          report.workflows = `Error fetching: ${errorMessage(e)}`;
         }
         await delay2(100);
-        if (builderClient) {
+        const builderUse = builderSectionAvailability(builderClient?.locationId, locId);
+        if (builderUse.usable && builderClient) {
           try {
-            const fullWorkflows = await builderClient.listWorkflows(50, 0);
-            report.workflowsFull = fullWorkflows;
-          } catch {
-            report.workflowsFull = "Error fetching (builder auth may have expired)";
+            report.workflowsFull = await builderClient.listWorkflows(50, 0);
+          } catch (e) {
+            report.workflowsFull = `Error fetching: ${errorMessage(e)}`;
           }
           await delay2(100);
+        } else {
+          report.workflowsFull = builderUse.reason;
         }
-        if (builderClient) {
+        if (builderUse.usable && builderClient) {
           try {
             const headers = await builderClient.buildHeaders();
             const res = await fetch(
@@ -13761,9 +13777,9 @@ function registerAccountExportTools(server2, client, registry2) {
               { headers }
             );
             if (res.ok) report.funnels = await res.json();
-            else report.funnels = "Error fetching";
-          } catch {
-            report.funnels = "Error fetching";
+            else report.funnels = `Error fetching: builder returned HTTP ${res.status}`;
+          } catch (e) {
+            report.funnels = `Error fetching: ${errorMessage(e)}`;
           }
           await delay2(100);
         } else {
@@ -13771,50 +13787,50 @@ function registerAccountExportTools(server2, client, registry2) {
             report.funnels = await client.get("/funnels/", {
               params: { locationId: locId }
             });
-          } catch {
-            report.funnels = "Error fetching";
+          } catch (e) {
+            report.funnels = `Error fetching: ${errorMessage(e)}`;
           }
         }
         try {
           report.forms = await client.get("/forms/", {
             params: { locationId: locId }
           });
-        } catch {
-          report.forms = "Error fetching";
+        } catch (e) {
+          report.forms = `Error fetching: ${errorMessage(e)}`;
         }
         await delay2(100);
         try {
           report.customFields = await client.get("/locations/" + locId + "/customFields");
-        } catch {
-          report.customFields = "Error fetching";
+        } catch (e) {
+          report.customFields = `Error fetching: ${errorMessage(e)}`;
         }
         await delay2(100);
         try {
           report.customValues = await client.get("/locations/" + locId + "/customValues");
-        } catch {
-          report.customValues = "Error fetching";
+        } catch (e) {
+          report.customValues = `Error fetching: ${errorMessage(e)}`;
         }
         await delay2(100);
         try {
           report.tags = await client.get("/locations/" + locId + "/tags");
-        } catch {
-          report.tags = "Error fetching";
+        } catch (e) {
+          report.tags = `Error fetching: ${errorMessage(e)}`;
         }
         await delay2(100);
         try {
           report.calendars = await client.get("/calendars/", {
             params: { locationId: locId }
           });
-        } catch {
-          report.calendars = "Error fetching";
+        } catch (e) {
+          report.calendars = `Error fetching: ${errorMessage(e)}`;
         }
         await delay2(100);
         try {
           report.users = await client.get("/users/", {
             params: { locationId: locId }
           });
-        } catch {
-          report.users = "Error fetching";
+        } catch (e) {
+          report.users = `Error fetching: ${errorMessage(e)}`;
         }
         return jsonResponse(report);
       } catch (error) {
@@ -19411,7 +19427,7 @@ function registerAllTools(server2, client, registry2, mcpVersion, env = process.
     () => buildGatingReport(config3, KNOWN_MODULES, attemptedTools, registeredTools, outOfBand)
   );
   registerSnapshotTools(wrap(SNAPSHOTS_MODULE), client, registry2);
-  registerAccountExportTools(wrap(ACCOUNT_EXPORT_MODULE), client, registry2);
+  registerAccountExportTools(wrap(ACCOUNT_EXPORT_MODULE), client, registry2, builderClient);
   registerLocationSwitcherTools(
     wrap(LOCATION_SWITCHER_MODULE),
     client,
@@ -19439,6 +19455,13 @@ init_telemetry_transport();
 function makeOutOfBandTracker() {
   return { registered: /* @__PURE__ */ new Set(), denied: /* @__PURE__ */ new Set() };
 }
+var NORMAL_MODE_OUT_OF_BAND_TOOLS = [
+  "setup_ghl_mcp",
+  "enable_workflow_builder",
+  "auto_capture_firebase_script",
+  "capture_firebase_interactive",
+  "install_skills"
+];
 function registerOutOfBand(entries, config3, tracker, log = (m) => process.stderr.write(m)) {
   for (const entry of entries) {
     if (isToolDenied(entry.name, "", config3)) {
@@ -20190,48 +20213,51 @@ async function resolveAccessAndRegister() {
   } else {
     const client = new GHLClient({ apiKey, locationId });
     registerAllTools(server, client, registry, pkg.version, process.env, sessionTier, outOfBandTracker);
-    registerOutOfBand(
-      [
-        // Available in normal mode so buyers can add Firebase later without
-        // re-running setup_ghl_mcp with all 7 fields, and so they can re-grab
-        // a fresh refresh token when it rotates. Registered on the FREE tier too:
-        // the Firebase login powers the read-only auditor tools (audit_workflows,
-        // validate_workflow, *_full reads) — only the write tools stay gated.
-        // v3.60.0: setup_ghl_mcp registers in NORMAL mode too — it is the
-        // ONE-LINE UPGRADE path ("email + new license key, nothing else").
-        // Before this it existed only in bootstrap, so an installed free user
-        // pasting the upgrade line got "Tool setup_ghl_mcp not found" — the
-        // exact audience the upgrade exists for. Caught by the live wire
-        // proof, not by unit tests (the handler worked; registration didn't).
-        { name: "setup_ghl_mcp", register: () => registerSetupTool(server, pkg.version) },
-        { name: "enable_workflow_builder", register: () => registerEnableWorkflowBuilderTool(server) },
-        { name: "auto_capture_firebase_script", register: () => registerFirebaseCaptureScriptTool(server) },
-        // One-click Builder unlock — buyer just logs into a Chrome window the
-        // helper opens; also the silent re-capture path for token rotations.
-        { name: "capture_firebase_interactive", register: () => registerInteractiveCaptureTool(server) },
-        // Skills rail (2026-07-28): bundled skills (Blueprint) install themselves
-        // into ~/.claude/skills — subscribers never download anything separately.
-        // Auto-runs on every start (idempotent, never clobbers user edits);
-        // the tool exists for verification/repair. Every tier: local file copy
-        // only. Denying install_skills also skips the auto-install — a buyer who
-        // gated it clearly doesn't want this server writing files into ~/.claude.
-        {
-          name: "install_skills",
-          register: () => registerSkillsTool(server, pkg.version, __dirname),
-          deniedNote: "bundled-skills auto-install skipped too",
-          sideEffect: () => {
-            try {
-              const skillsResult = installBundledSkills({ packageVersion: pkg.version, baseDir: __dirname });
-              const line = summarizeInstall(skillsResult);
-              if (line) process.stderr.write(`[ghl-mcp] ${line}
+    const normalModeOutOfBand = {
+      // Available in normal mode so buyers can add Firebase later without
+      // re-running setup_ghl_mcp with all 7 fields, and so they can re-grab
+      // a fresh refresh token when it rotates. Registered on the FREE tier too:
+      // the Firebase login powers the read-only auditor tools (audit_workflows,
+      // validate_workflow, *_full reads) — only the write tools stay gated.
+      //
+      // v3.60.0: setup_ghl_mcp registers in NORMAL mode too — it is the
+      // ONE-LINE UPGRADE path ("email + new license key, nothing else").
+      // Before this it existed only in bootstrap, so an installed free user
+      // pasting the upgrade line got "Tool setup_ghl_mcp not found" — the
+      // exact audience the upgrade exists for. Caught by the live wire
+      // proof, not by unit tests (the handler worked; registration didn't).
+      // The SAME change also went uncounted for twelve releases, which is why
+      // this block is now driven by a list the count guard can read.
+      setup_ghl_mcp: { register: () => registerSetupTool(server, pkg.version) },
+      enable_workflow_builder: { register: () => registerEnableWorkflowBuilderTool(server) },
+      auto_capture_firebase_script: { register: () => registerFirebaseCaptureScriptTool(server) },
+      // One-click Builder unlock — buyer just logs into a Chrome window the
+      // helper opens; also the silent re-capture path for token rotations.
+      capture_firebase_interactive: { register: () => registerInteractiveCaptureTool(server) },
+      // Skills rail (2026-07-28): bundled skills (Blueprint) install themselves
+      // into ~/.claude/skills — subscribers never download anything separately.
+      // Auto-runs on every start (idempotent, never clobbers user edits);
+      // the tool exists for verification/repair. Every tier: local file copy
+      // only. Denying install_skills also skips the auto-install — a buyer who
+      // gated it clearly doesn't want this server writing files into ~/.claude.
+      install_skills: {
+        register: () => registerSkillsTool(server, pkg.version, __dirname),
+        deniedNote: "bundled-skills auto-install skipped too",
+        sideEffect: () => {
+          try {
+            const skillsResult = installBundledSkills({ packageVersion: pkg.version, baseDir: __dirname });
+            const line = summarizeInstall(skillsResult);
+            if (line) process.stderr.write(`[ghl-mcp] ${line}
 `);
-            } catch (e) {
-              process.stderr.write(`[ghl-mcp] Skills install skipped: ${String(e).slice(0, 120)}
+          } catch (e) {
+            process.stderr.write(`[ghl-mcp] Skills install skipped: ${String(e).slice(0, 120)}
 `);
-            }
           }
         }
-      ],
+      }
+    };
+    registerOutOfBand(
+      NORMAL_MODE_OUT_OF_BAND_TOOLS.map((name) => ({ name, ...normalModeOutOfBand[name] })),
       gatingConfig,
       outOfBandTracker
     );

package/guide/guide.html

@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>GHL Command — User Guide</title>
-<!-- guides-hash: a156991f1141b0d5 -->
+<!-- guides-hash: eb1eef4169720b47 -->
 <style>
 /* Deliberately light in every environment, including a dark-mode OS. This is a
    reference document people read at length, print, and save to PDF, and a page
@@ -226,7 +226,7 @@ body.app.reading #indexview{display:none}
   <p class="eyebrow">GHL Command</p>
   <h1>What do you want to get done?</h1>
   <p class="sub">Every guide is a job, in plain English: open one, copy a prompt, paste it to Claude. A job is not a button, so one guide usually puts a dozen of GHL Command's tools to work at once. Every prompt marked "Proven live" was run against a real GoHighLevel account before it shipped.</p>
-  <div class="badges"><span class="badge on">28 guides</span><span class="badge">10 categories</span><span class="badge">Updates with the product</span></div>
+  <div class="badges"><span class="badge on">29 guides</span><span class="badge">10 categories</span><span class="badge">Updates with the product</span></div>
 </div></section>
 <div class="shell">
 <main>
@@ -247,10 +247,10 @@ body.app.reading #indexview{display:none}
 <a class="card pub" href="#g-invoices-and-payments" data-k="invoice bill billing payment paid product price coupon promo code discount transactions orders revenue estimate"><h3>Bill a client and see what you were paid</h3><p>Products, invoices, coupons, and the money reads, without opening the billing screen.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~5 minutes</span><span class="open">Open guide &#8594;</span></div></a>
 <a class="card pub" href="#g-stand-up-a-pipeline" data-k="pipeline stages create new client setup opportunity sales process deal stages"><h3>Stand up a pipeline</h3><p>Stages, fields, and tags for a new client in one conversation.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~10 minutes</span><span class="open">Open guide &#8594;</span></div></a>
 <a class="card pub" href="#g-track-and-move-opportunities" data-k="opportunities deals move stage track stuck value won lost pipeline board"><h3>Track and move opportunities</h3><p>Move deals between stages, update values, and see what is stuck.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~1 minute</span><span class="open">Open guide &#8594;</span></div></a></div></div>
-<div class="catsec" id="cat-client-builds-and-pages"><h2>Client builds and pages</h2><div class="cards"><a class="card pub" href="#g-snapshots-and-reusing-a-build" data-k="snapshot template reuse clone account new client share link import rollout onboarding"><h3>Reuse a build across client accounts</h3><p>Find your snapshots, share one, and know exactly what does not travel with it.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~5 minutes</span><span class="open">Open guide &#8594;</span></div></a>
+<div class="catsec" id="cat-client-builds-and-pages"><h2>Client builds and pages</h2><div class="cards"><a class="card pub" href="#g-clone-and-rebrand-a-site" data-k="clone site copy rebrand landing page existing url duplicate make one like this mirror"><h3>Clone and rebrand a site</h3><p>Rebuild an existing page for a new client, with a rights check and a review report.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~30 minutes</span><span class="open">Open guide &#8594;</span></div></a>
+<a class="card pub" href="#g-snapshots-and-reusing-a-build" data-k="snapshot template reuse clone account new client share link import rollout onboarding"><h3>Reuse a build across client accounts</h3><p>Find your snapshots, share one, and know exactly what does not travel with it.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~5 minutes</span><span class="open">Open guide &#8594;</span></div></a>
 <button class="card locked" type="button" data-k="blueprint client account build intake onboarding new complete template" data-toast="This guide arrives in a product update — your install picks it up automatically." title="Coming in a product update." aria-label="The Blueprint: build a client account. Coming in a product update."><h3>The Blueprint: build a client account</h3><p>From intake form to a complete, reviewed account build you approve before it runs.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~1 hour</span><span class="applabel">Coming in an update</span></div></button>
-<button class="card locked" type="button" data-k="page studio compose website landing pages funnel" data-toast="This guide arrives in a product update — your install picks it up automatically." title="Coming in a product update." aria-label="Page Studio: pages and sites. Coming in a product update."><h3>Page Studio: pages and sites</h3><p>Compose landing pages and full sites that render correctly in GHL.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~20 min</span><span class="applabel">Coming in an update</span></div></button>
-<button class="card locked" type="button" data-k="clone site copy rebrand landing page existing url" data-toast="This guide arrives in a product update — your install picks it up automatically." title="Coming in a product update." aria-label="Clone and rebrand a site. Coming in a product update."><h3>Clone and rebrand a site</h3><p>Rebuild an existing page for a new client, with a rights check and a review report.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~30 min</span><span class="applabel">Coming in an update</span></div></button></div></div>
+<button class="card locked" type="button" data-k="page studio compose website landing pages funnel" data-toast="This guide arrives in a product update — your install picks it up automatically." title="Coming in a product update." aria-label="Page Studio: pages and sites. Coming in a product update."><h3>Page Studio: pages and sites</h3><p>Compose landing pages and full sites that render correctly in GHL.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~20 min</span><span class="applabel">Coming in an update</span></div></button></div></div>
 <div class="catsec" id="cat-booking-and-calendars"><h2>Booking and calendars</h2><div class="cards"><a class="card pub" href="#g-see-and-manage-appointments" data-k="appointments today schedule upcoming who is booked list no show cancel reschedule diary"><h3>See and manage appointments</h3><p>Who is booked today, this week, or for a specific client, in one ask.</p><div class="meta"><span class="pill free">Free plan</span><span class="time">~10 seconds</span><span class="open">Open guide &#8594;</span></div></a>
 <a class="card pub" href="#g-set-up-a-booking-calendar" data-k="calendar create booking consult slots availability buffer appointment types schedule daily limit notice same day"><h3>Set up a booking calendar</h3><p>A consult calendar with the right slots, buffers, and the right person attached.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~10 minutes</span><span class="open">Open guide &#8594;</span></div></a></div></div>
 <div class="catsec" id="cat-email-and-sms"><h2>Email and SMS</h2><div class="cards"><a class="card pub" href="#g-build-email-templates" data-k="email template design create campaign builder reusable branded rename archive"><h3>Build email templates</h3><p>Reusable, branded templates created and edited without the GHL editor.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~10 minutes</span><span class="open">Open guide &#8594;</span></div></a>
@@ -262,7 +262,7 @@ body.app.reading #indexview{display:none}
 <div class="catsec" id="cat-forms-and-reviews"><h2>Forms and reviews</h2><div class="cards"><a class="card pub" href="#g-create-forms-and-read-submissions" data-k="form create intake survey fields submissions responses questions who filled in"><h3>Create forms and read submissions</h3><p>Intake forms built to spec, and submissions pulled into a clean summary.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~10 minutes</span><span class="open">Open guide &#8594;</span></div></a>
 <a class="card pub" href="#g-trigger-links" data-k="trigger links tracking click automations tracked link who clicked interest"><h3>Trigger links</h3><p>Create tracked links that fire automations when clicked.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~2 minutes</span><span class="open">Open guide &#8594;</span></div></a>
 <a class="card pub" href="#g-watch-your-reviews" data-k="reviews reputation ratings google stars new review negative feedback review link"><h3>Watch your reviews</h3><p>See new reviews across clients without logging into each account.</p><div class="meta"><span class="pill free">Free plan</span><span class="time">~30 seconds</span><span class="open">Open guide &#8594;</span></div></a></div></div>
-<div class="catsec" id="cat-account-admin"><h2>Account admin</h2><div class="cards"><a class="card pub" href="#g-account-admin-basics" data-k="users phone numbers media export snapshot webhooks admin settings who has access compare"><h3>Account admin basics</h3><p>Users, phone numbers, media, and account exports without hunting through menus.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~1 minute</span><span class="open">Open guide &#8594;</span></div></a>
+<div class="catsec" id="cat-account-admin"><h2>Account admin</h2><div class="cards"><a class="card pub" href="#g-account-admin-basics" data-k="users phone numbers media export snapshot admin settings who has access compare"><h3>Account admin basics</h3><p>Users, phone numbers, media, and account exports without hunting through menus.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~1 minute</span><span class="open">Open guide &#8594;</span></div></a>
 <a class="card pub" href="#g-custom-fields-and-objects" data-k="custom fields objects records associations create field dropdown date field niche"><h3>Custom fields and objects</h3><p>The fields and records your niche needs, created correctly the first time.</p><div class="meta"><span class="pill full">Full license</span><span class="time">~5 minutes</span><span class="open">Open guide &#8594;</span></div></a></div></div>
   <div class="noresults" id="noresults"><p><b>No guides match that yet.</b> Try a different word, like "contacts" or "workflow".</p></div>
 </main>
@@ -817,6 +817,67 @@ Do not change any contact, and do not delete any list that is already there.</p>
   </main></div>
 </section>
 
+<section class="gpage" id="g-clone-and-rebrand-a-site">
+  <div class="hero"><div class="hero-in">
+    <p class="eyebrow">GHL Command User Guide</p>
+    <h1>Clone and rebrand a site</h1>
+    <p class="sub">Rebuild an existing page for a new client, with a rights check and a review report.</p>
+    <div class="badges"><span class="badge on">Full license</span><span class="badge">~30 minutes</span><span class="badge">Client builds and pages</span></div>
+  </div></div>
+  <div class="shell"><main class="gview">
+  <a class="back" href="#top">&#8592; All guides</a>
+  <div class="gsec"><h2>What you'll get</h2>
+<ul>
+<li>A page rebuilt for your client from a page you point at, with their name, colours, contact details, and copy.</li>
+<li>A rights question at the start that decides how the rebuild is done, and an honest answer either way.</li>
+<li>A review report at the end listing everything that still belongs to whoever owned the original.</li>
+</ul>
+</div>
+<div class="gsec"><h2>Say this</h2>
+<div class="prompt"><q>Clone this page for my client: [paste the URL].</q><button class="copy" type="button">Copy</button></div>
+<div class="prompt"><q>Rebuild this landing page for Radiance Med Spa.</q><button class="copy" type="button">Copy</button></div>
+<div class="prompt"><q>What is left over from the original on this clone?</q><button class="copy" type="button">Copy</button></div>
+</div>
+<div class="gsec"><h2>The pro prompt</h2>
+<div class="pro"><div class="pro-head"><b>The exact ask we run on real client accounts</b><span class="pill full">Proven live</span><button class="copy" type="button">Copy</button></div><p class="pro-body">Clone [https://example.com/their-landing-page] for my client [Radiance Med Spa].
+My rights to that page: [I built it for a previous client of mine and reuse the layout].
+Rebrand it: company name [Radiance Med Spa], phone [512-555-0100], email [hello@radiance.example], colours [deep green and cream].
+Leave the page's words alone for now. I will ask for a rewrite separately.
+Point the form and any booking button at my [MCP Testing] account, not at whatever it points at now.
+When you are done, give me the review list of everything still belonging to the original owner: names, testimonials, photos of their people, any claim I cannot back up, and anywhere a lead or a payment would still go to them.</p></div>
+<p class="gpara">Everything in [brackets] is yours to change. Answer the rights question honestly. It changes what gets built, and getting it wrong is your problem, not the tool's.</p>
+</div>
+<div class="gsec"><h2>What happens when you ask</h2>
+<ol class="steps">
+<li>Claude asks what rights you have to the page, and records your answer.</li>
+<li>With rights, it makes a faithful rebuild. Without them, it takes the design system, meaning the layout logic, spacing, and type scale, and builds a fresh page on it instead of copying the original.</li>
+<li>It swaps in your client's brand: name, contact details, colours. It does NOT rewrite the page's words.</li>
+<li>It hands you a review list: everything it found that still belongs to the original owner and everything it could not be sure about.</li>
+</ol>
+</div>
+<div class="gsec"><h2>Good to know</h2>
+<ul>
+<li><b>Changing the colours is riskier than it sounds.</b> A palette is a set of relationships, not a list of hex codes. Swap a dark background for a light one and text that was white for the dark background is now white on light, and invisible. Nothing checks this for you. After any colour change, look at the page before you show anyone.</li>
+<li><b>A clone copies. It does not rewrite.</b> When it finishes, the layout and brand are your client's and every word is still the original's, so the page still reads as the other business. Rewriting is a second ask, on purpose: a clone that paraphrases as it copies is the one that comes back &quot;not even close&quot;.</li>
+<li>Read the review list. It exists because some things cannot be caught by find and replace: a brand name split across styled text, a logo inside an image, branding baked into a booking widget, another business's testimonials.</li>
+<li>Lead and payment destinations are the dangerous ones. A cloned page that still posts leads to the original owner is worse than no page.</li>
+<li>Regulated claims travel with the copy. If the original made a medical or income claim, it is now on your client's page and it is now your client's liability.</li>
+<li>Needs the full license.</li>
+</ul>
+</div>
+<div class="gsec"><h2>Where people go wrong</h2>
+<div style="overflow-x:auto"><table class="wrongtbl"><tr><th>What happened</th><th>The fix</th></tr><tr><td>&quot;The clone still has the other company's name in one spot.&quot;</td><td>That is what the review list catches, usually a name split across styled text. Fix the items it names before you show the client.</td></tr><tr><td>&quot;A booking button still goes to the original business.&quot;</td><td>Say which account and which calendar the buttons should point at, in the ask. Then check every button on the live page.</td></tr><tr><td>&quot;The new colours made half the page unreadable.&quot;</td><td>Text colours were not swapped alongside the backgrounds they sit on. Caught live: a navy-to-cream background left white headings invisible. Change colours only if you will check the result by eye, or leave them alone and clone exactly.</td></tr><tr><td>&quot;The header still showed the old brand after a clean replace.&quot;</td><td>A two-tone brand mark is split across markup, so no find-and-replace can reach it. It is caught and listed for a hand edit. The proving run had exactly two.</td></tr><tr><td>&quot;The logo still says the other company.&quot;</td><td>The brand is inside the image file. Pixels cannot be substituted; the review list names the files so you can swap the artwork.</td></tr><tr><td>&quot;It refused to make an exact copy.&quot;</td><td>You said you have no rights to the page. That answer routes you to a rebuild on the design system instead, which is the version you can actually ship.</td></tr></table></div>
+</div>
+<div class="gsec"><h2>Related guides</h2>
+<ul>
+<li>page-studio-pages-and-sites</li>
+<li>create-forms-and-read-submissions</li>
+</ul>
+</div>
+  <p class="gfoot">Works in Claude Desktop and Claude Code. Stuck? Email support@ghlcommand.com and a human answers.</p>
+  </main></div>
+</section>
+
 <section class="gpage" id="g-count-and-report-contacts">
   <div class="hero"><div class="hero-in">
     <p class="eyebrow">GHL Command User Guide</p>

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.66.0",
+  "version": "3.66.2",
   "mcpName": "io.github.drjerryrelth/ghl-command",
-  "description": "GoHighLevel MCP Server for Claude. 238 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
+  "description": "GoHighLevel MCP Server for Claude. 239 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",
   "bin": {
     "ghl-mcp": "dist/index.js"