@elitedcs/ghl-mcp 3.70.0 → 3.72.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 3.72.0 — an audit that counts your workflows once
+
+A member ran the account audit on a large agency account. The report came back claiming
+5,000 workflows with six percent of them scanned, printed every single finding three
+times word for word, and closed by advising her to re-run the audit in further batches.
+She did. It ran ninety minutes before she stopped it, with no idea how many tokens it
+was burning.
+
+None of those numbers were real. GoHighLevel's workflow list endpoint ignores the `skip`
+parameter: ask it for the second page and it hands back the first one again. The catalog
+builder believed it fifty times over, so one hundred-workflow page became a
+five-thousand-workflow account, the scan list held the same hundred workflows three
+times, and every finding was reported once per copy. There was no next batch to re-run
+for, and there never had been. Accounts under a hundred workflows finish on the first
+page and were never affected, which is why this reached a customer before it reached us.
+
+**The audit now counts each workflow once.** A workflow already listed is never listed
+again, so duplicate scans and tripled findings cannot happen whatever the endpoint does.
+The total comes from GoHighLevel's own count, and that count is used carefully: it can
+tell the audit it has seen less than the whole account, never that it has seen all of it.
+Believing it in the other direction would let a stale number turn a workflow reference
+that merely could not be checked into a confident "this is broken", which this audit
+must never say. When the whole account cannot be listed, the report says so in plain
+words, says how many were reached, and no longer sends you round a loop that cannot
+finish.
+
+Two things this also fixes, quietly. Workflows past the first hundred were never being
+scanned on any account, while the report implied full coverage. And `validate_workflow`,
+which shares the same catalog, was marking workflow-to-workflow references "unverified"
+on those larger accounts for the same reason.
+
+Counts: 247 tools across 51 modules, unchanged. The free read-only tier is unchanged at
+111. Restart Claude after updating.
+
+## 3.71.0 — a task you can close
+
+A subscriber's Claude created a callback task on a contact and, come Monday, could not
+close it. It said so plainly: the server can create tasks but has no way to update or
+complete one, tick it off by hand. It was right. `create_contact_task` and
+`get_contact_tasks` were the whole task surface.
+
+**Three tools close the loop.** `complete_contact_task` marks a task done, or reopens it
+with `completed: false`. `update_contact_task` changes a task's title, description, due
+date, assignee or completed state, and sends only the fields you pass, so changing a due
+date never blanks the title; an update with no fields is refused before any request goes
+out. `delete_contact_task` removes a task for good and, like every delete in this server,
+asks for `confirm: "DELETE"`. All three use the routes in
+GoHighLevel's published contacts spec and were proven live before release on a throwaway
+contact in a sandbox account: create, complete, read back completed, update, reopen,
+delete, read back gone, contact removed (`docs/proofs/2026-08-26-task-lifecycle.md`).
+
+Counts: 245 tools across 51 modules (was 242). The free read-only tier is unchanged at
+111; the three new tools are writes and answer with upgrade information there. Restart
+Claude after the update to see them.
+
 ## 3.70.0 — a clean validation now means something
 
 A subscriber built an Instagram-comment-to-DM workflow, ran `validate_workflow`, got

package/README.md

@@ -1,6 +1,6 @@
 # GHL Command — GoHighLevel MCP Server
 
-**Full GoHighLevel API access for Claude.** 242 tools across 51 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers. **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
+**Full GoHighLevel API access for Claude.** 247 tools across 51 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers. **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
 
 **Distributed via npm as [`@elitedcs/ghl-mcp`](https://www.npmjs.com/package/@elitedcs/ghl-mcp).** Buyers install with one config block — no git, no Node.js setup, no terminal commands. Updates flow automatically (`npx @latest` re-resolves on every Claude restart).
 
@@ -135,7 +135,7 @@ Run setup_ghl_mcp to activate GHL Command:
   ghl_location_id: YOUR_LOCATION_ID
 ```
 
-Approve the tool call. Server validates your license, verifies your GHL credentials, writes them to a per-user config file. **Quit Claude one more time and reopen** — the full core toolset is now unlocked (242 tools total with the optional Workflow Builder Firebase add-on).
+Approve the tool call. Server validates your license, verifies your GHL credentials, writes them to a per-user config file. **Quit Claude one more time and reopen** — the full core toolset is now unlocked (247 tools total with the optional Workflow Builder Firebase add-on).
 
 ### 4. Try it
 
@@ -175,7 +175,7 @@ https://app.gohighlevel.com/v2/location/YOUR_LOCATION_ID/dashboard
 
 ## Enable the Workflow Builder
 
-The builder + cloner + validator tools (workflow builder, funnel builder, form builder, pipeline builder, workflow cloner, validate_workflow) use GHL's internal API and require Firebase credentials. Without them, the other 187 tools work fine — you just won't have workflow/funnel/form/pipeline editing. This is the flagship feature: do this step.
+The builder + cloner + validator tools (workflow builder, funnel builder, form builder, pipeline builder, workflow cloner, validate_workflow) use GHL's internal API and require Firebase credentials. Without them, the other 192 tools work fine — you just won't have workflow/funnel/form/pipeline editing. This is the flagship feature: do this step.
 
 **One-click capture (v3.49.0+, the supported path):**
 
@@ -269,7 +269,7 @@ Highlights (full guide: [`docs/HEADLESS.md`](docs/HEADLESS.md)):
 
 > **v3.10.0 adds Email Templates** (`list_email_templates`, `create_email_template`, `update_email_template`) — Claude can now create new HTML email templates and save content into them via the public API. Templates power both standalone marketing emails and workflow email actions. Delete + rename remain UI-only (no public-API endpoint exists).
 
-### CRM & Contacts (15 tools)
+### CRM & Contacts (18 tools)
 
 | Tool | What It Does |
 |---|---|
@@ -283,6 +283,9 @@ Highlights (full guide: [`docs/HEADLESS.md`](docs/HEADLESS.md)):
 | `remove_contact_tags` | Remove tags from a contact |
 | `get_contact_tasks` | List tasks for a contact |
 | `create_contact_task` | Create a task on a contact |
+| `complete_contact_task` | Mark a task done (or reopen it) |
+| `update_contact_task` | Change a task's title, description, due date, assignee or state |
+| `delete_contact_task` | Delete a task from a contact |
 | `get_contact_notes` | List notes on a contact |
 | `create_contact_note` | Add a note to a contact |
 | `get_contact_appointments` | List a contact's appointments |
@@ -798,7 +801,7 @@ Source repo is private. Contributors need an invitation from `drjerryrelth`. The
 
 ### Reducing context / token usage
 
-Every registered MCP tool's schema is shipped to the model on every message. With 242 tools that's a meaningful per-message context cost even in chats that never touch GHL. If you only use a slice of GHL Command, restrict the tool surface with `GHL_ENABLED_MODULES` and/or `GHL_ENABLED_TOOLS`:
+Every registered MCP tool's schema is shipped to the model on every message. With 247 tools that's a meaningful per-message context cost even in chats that never touch GHL. If you only use a slice of GHL Command, restrict the tool surface with `GHL_ENABLED_MODULES` and/or `GHL_ENABLED_TOOLS`:
 
 ```jsonc
 // Claude Desktop config — enable whole modules

package/dist/capture-helper.js

@@ -52,7 +52,16 @@ var CredentialsSchema = import_zod.z.object({
   /** Stable machine id (2026-07-28). Replaces the hostname-derived
    *  fingerprint, which changed with the network on laptops and silently ate
    *  install slots. Written once and reused forever. */
-  device_id: import_zod.z.string().optional()
+  device_id: import_zod.z.string().optional(),
+  /** Per-seat cockpit key (2026-08-27, Command OS PRD row 0). The cockpit binds
+   *  127.0.0.1, which stops other machines reaching the port but not other
+   *  PROGRAMS and other browsers on this one — and on a shared team machine that
+   *  is everybody. Every state-changing cockpit request must carry this value;
+   *  the served page gets it injected so the operator never types anything.
+   *  Written once on the first cockpit run, replaced by
+   *  `ghl-mcp dashboard --rotate-token`. Optional in the schema so files written
+   *  by earlier versions still parse. NEVER printed, logged or displayed. */
+  cockpit_seat_token: import_zod.z.string().optional()
 });
 function appDataDir() {
   const override = process.env.GHL_MCP_CONFIG_DIR?.trim();