@elitedcs/ghl-mcp 3.71.0 → 3.72.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 3.72.0 — an audit that counts your workflows once
+
+A member ran the account audit on a large agency account. The report came back claiming
+5,000 workflows with six percent of them scanned, printed every single finding three
+times word for word, and closed by advising her to re-run the audit in further batches.
+She did. It ran ninety minutes before she stopped it, with no idea how many tokens it
+was burning.
+
+None of those numbers were real. GoHighLevel's workflow list endpoint ignores the `skip`
+parameter: ask it for the second page and it hands back the first one again. The catalog
+builder believed it fifty times over, so one hundred-workflow page became a
+five-thousand-workflow account, the scan list held the same hundred workflows three
+times, and every finding was reported once per copy. There was no next batch to re-run
+for, and there never had been. Accounts under a hundred workflows finish on the first
+page and were never affected, which is why this reached a customer before it reached us.
+
+**The audit now counts each workflow once.** A workflow already listed is never listed
+again, so duplicate scans and tripled findings cannot happen whatever the endpoint does.
+The total comes from GoHighLevel's own count, and that count is used carefully: it can
+tell the audit it has seen less than the whole account, never that it has seen all of it.
+Believing it in the other direction would let a stale number turn a workflow reference
+that merely could not be checked into a confident "this is broken", which this audit
+must never say. When the whole account cannot be listed, the report says so in plain
+words, says how many were reached, and no longer sends you round a loop that cannot
+finish.
+
+Two things this also fixes, quietly. Workflows past the first hundred were never being
+scanned on any account, while the report implied full coverage. And `validate_workflow`,
+which shares the same catalog, was marking workflow-to-workflow references "unverified"
+on those larger accounts for the same reason.
+
+Counts: 247 tools across 51 modules, unchanged. The free read-only tier is unchanged at
+111. Restart Claude after updating.
+
 ## 3.71.0 — a task you can close
 
 A subscriber's Claude created a callback task on a contact and, come Monday, could not

package/README.md

@@ -1,6 +1,6 @@
 # GHL Command — GoHighLevel MCP Server
 
-**Full GoHighLevel API access for Claude.** 245 tools across 51 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers. **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
+**Full GoHighLevel API access for Claude.** 247 tools across 51 modules — manage contacts, conversations, pipelines, calendars, funnels, workflows, invoices, custom objects, webhooks, and more. **Includes full workflow builder, funnel/page editor, form builder, pipeline builder, bulk operations, account export, and workflow cloning** — capabilities no other GHL tool offers. **Multi-tenant:** one install can run the workflow builder across multiple clients' GHL accounts.
 
 **Distributed via npm as [`@elitedcs/ghl-mcp`](https://www.npmjs.com/package/@elitedcs/ghl-mcp).** Buyers install with one config block — no git, no Node.js setup, no terminal commands. Updates flow automatically (`npx @latest` re-resolves on every Claude restart).
 
@@ -135,7 +135,7 @@ Run setup_ghl_mcp to activate GHL Command:
   ghl_location_id: YOUR_LOCATION_ID
 ```
 
-Approve the tool call. Server validates your license, verifies your GHL credentials, writes them to a per-user config file. **Quit Claude one more time and reopen** — the full core toolset is now unlocked (245 tools total with the optional Workflow Builder Firebase add-on).
+Approve the tool call. Server validates your license, verifies your GHL credentials, writes them to a per-user config file. **Quit Claude one more time and reopen** — the full core toolset is now unlocked (247 tools total with the optional Workflow Builder Firebase add-on).
 
 ### 4. Try it
 
@@ -175,7 +175,7 @@ https://app.gohighlevel.com/v2/location/YOUR_LOCATION_ID/dashboard
 
 ## Enable the Workflow Builder
 
-The builder + cloner + validator tools (workflow builder, funnel builder, form builder, pipeline builder, workflow cloner, validate_workflow) use GHL's internal API and require Firebase credentials. Without them, the other 190 tools work fine — you just won't have workflow/funnel/form/pipeline editing. This is the flagship feature: do this step.
+The builder + cloner + validator tools (workflow builder, funnel builder, form builder, pipeline builder, workflow cloner, validate_workflow) use GHL's internal API and require Firebase credentials. Without them, the other 192 tools work fine — you just won't have workflow/funnel/form/pipeline editing. This is the flagship feature: do this step.
 
 **One-click capture (v3.49.0+, the supported path):**
 
@@ -801,7 +801,7 @@ Source repo is private. Contributors need an invitation from `drjerryrelth`. The
 
 ### Reducing context / token usage
 
-Every registered MCP tool's schema is shipped to the model on every message. With 245 tools that's a meaningful per-message context cost even in chats that never touch GHL. If you only use a slice of GHL Command, restrict the tool surface with `GHL_ENABLED_MODULES` and/or `GHL_ENABLED_TOOLS`:
+Every registered MCP tool's schema is shipped to the model on every message. With 247 tools that's a meaningful per-message context cost even in chats that never touch GHL. If you only use a slice of GHL Command, restrict the tool surface with `GHL_ENABLED_MODULES` and/or `GHL_ENABLED_TOOLS`:
 
 ```jsonc
 // Claude Desktop config — enable whole modules

package/dist/capture-helper.js

@@ -52,7 +52,16 @@ var CredentialsSchema = import_zod.z.object({
   /** Stable machine id (2026-07-28). Replaces the hostname-derived
    *  fingerprint, which changed with the network on laptops and silently ate
    *  install slots. Written once and reused forever. */
-  device_id: import_zod.z.string().optional()
+  device_id: import_zod.z.string().optional(),
+  /** Per-seat cockpit key (2026-08-27, Command OS PRD row 0). The cockpit binds
+   *  127.0.0.1, which stops other machines reaching the port but not other
+   *  PROGRAMS and other browsers on this one — and on a shared team machine that
+   *  is everybody. Every state-changing cockpit request must carry this value;
+   *  the served page gets it injected so the operator never types anything.
+   *  Written once on the first cockpit run, replaced by
+   *  `ghl-mcp dashboard --rotate-token`. Optional in the schema so files written
+   *  by earlier versions still parse. NEVER printed, logged or displayed. */
+  cockpit_seat_token: import_zod.z.string().optional()
 });
 function appDataDir() {
   const override = process.env.GHL_MCP_CONFIG_DIR?.trim();