SUBJECT: GOHIGHLEVEL MCP SERVER & DETERMINISTIC RUST CLI
AUTHOR: DANIEL HALLMAN
COMPANY: MOOSH WORKS

Stop doing click-ops in GoHighLevel.

PLAN (--DRY-RUN) → APPLY (--YES) → READ-BACK VERIFY

Most HighLevel agencies lose 2 to 4 hours per client onboarding clicking through 40+ browser tabs: copying DNS records by hand, tweaking funnel sections without version control, chaining inbound call workflows in the UI, and blind-pushing snapshots that silently overwrite client customizations.

At Moosh Works, we built ghl-tools—a compiled, native Rust CLI and Model Context Protocol (MCP) suite that lets operators and AI coding agents (Claude Code, Cursor, Codex, Grok) inspect, plan, mutate, and verify GoHighLevel sub-accounts deterministically.

SECTION 01 · OPERATOR ARCHITECTURE

The 5-Binary Rust CLI & MCP Suite

Instead of mixing credentials or relying on brittle browser automation, ghl-tools separates agency, sub-account CRM, domain onboarding, Marketplace administration, and email deliverability into dedicated native binaries and bounded MCP servers:

SUB-ACCOUNT & BUILDER OPS ghl-crm

ghl-crm + CRM MCP

Direct inspection and deterministic mutation of sub-account resources that public REST endpoints cannot reach.

  • Funnel & Website Layout Engine: Read, diff, and publish layout JSON, CSS styles, copy, and SEO meta tags with SHA-256 layout hash guards.
  • Workflows & Spam-Shield IVR: Inspect full workflow graphs and provision 1-step DTMF call-screening IVRs (workflows create-ivr) to stop Google Business robocalls from burning Voice AI minutes.
  • Knowledge Bases & Forms: Manage 20–80 FAQ Receptionist Knowledge Bases, intake forms, custom fields, and saved views.
MULTI-TENANT & VOICE AI ghl-agency

ghl-agency + Agency MCP

Agency-level control across sub-accounts, snapshots, Private Integration Tokens, and v3 AI resources.

  • Context Isolation: Explicit account routing (--context moosh-growth vs. marketplace-sandbox) with hard guardrails on protected client locations.
  • Voice AI & Conversation AI: Inspect and configure speech-to-speech Voice AI agents, spoken prompts, calendar actions, and kill-switch tags.
  • Zero-Downtime PIT Lifecycle: Programmatic minting, scoping, rotation (pit rotate), and audit of Private Integration Tokens.
ZERO-TOUCH DNS & SSL ghl-onboard-mcp

ghl-onboard & ghl-onboard-mcp

Desired-state planning, execution, and RFC 1035 DNS verification for HighLevel white-label and branded-link domains.

  • Declarative Manifests: Define location and domain intent in ops/ghl-location.json.
  • Short-Lived Plan IDs: ghl-onboard plan generates a read-only diff; apply requires the exact reviewed plan ID and aborts if live DNS or sub-account state drifted.
  • Stdio & HTTP MCP: Runs over stdio or authenticated loopback HTTP (:27192) for AI agent orchestration.
MARKETPLACE & DELIVERABILITY ghl-mkt + mail

ghl-mkt & apple-branded-mail

Developer portal governance and pure-Rust RFC 1035 email authentication audits.

  • Marketplace MCP (ghl-mkt): Manage Marketplace app listings, versions, OAuth scopes, webhook routing, billing, and release-check portal read-backs.
  • Apple Branded Mail & BIMI: Pure Rust RFC 1035 UDP DNS verification for DMARC (p=quarantine/p=reject), DKIM, SPF, and 1024×1024 SVG BIMI brand logos.
SECTION 02 · DETERMINISTIC SAFETY CONTRACT

Why AI Agents Need Guarded MCP Tools for HighLevel

Giving an LLM raw write access to a live client CRM without state checks is a recipe for overwritten funnels and broken automations. Every write operation in ghl-tools enforces five non-negotiable engineering guards:

  1. Mandatory --dry-run Plan / --yes Apply Split: Every mutation first computes a read-only execution plan showing the exact fields, layout nodes, or DNS records that will change.
  2. Stale-Plan SHA-256 Fingerprinting: Plans embed a cryptographic hash of the current live state. If a client or teammate edits a funnel or workflow in the browser before apply runs, execution fails closed instead of clobbering their work.
  3. Post-Write Live Read-Back Verification: No command reports success from an HTTP 200 OK response alone. Every write immediately fetches the live resource back from HighLevel (or queries authoritative RFC 1035 DNS servers) to prove persistence.
  4. Strict Tenant & Context Isolation: Credentials live in isolated 0600 local directories per context and vault lane. Production client sub-accounts cannot be mutated without explicit location targeting.
  5. Zero-Knowledge Local Execution & Automatic Redaction: All HighLevel API, session, and DNS calls execute directly from your machine. Bearer tokens, PITs, cookies, and keys are automatically stripped from terminal output, logs, and JSON receipts.
SECTION 03 · CAPABILITY MATRIX

Public API v2/v3 vs. Hosted MCP vs. ghl-tools Native MCP

HighLevel's official REST API and hosted LeadConnector MCP cover standard contact and opportunity CRUD, but leave high-leverage agency fulfillment gaps that require native builder and DNS tooling:

Capability / Operation Public REST API v2/v3 Hosted LeadConnector MCP ghl-tools Native Rust CLI & MCP
Funnel & Website Layout JSON / CSS Not exposed Not exposed Full read/diff/publish (save-draft, publish-styles, publish-copy) with SHA-256 hash guards
Authoritative DNS, CNAME & SSL Cutover No DNS endpoints 0 DNS operations in catalog Automated Cloudflare/Porkbun CNAME + RFC 1035 UDP verification (ghl-onboard-mcp)
Spam-Shield DTMF Call-Screening IVR Manual UI only Manual UI only 1-command provisioning (ghl-crm workflows create-ivr) with Missed-Call Text Back intact
Workflow DAG Inspection & Updates Basic trigger list only Limited trigger execution Full Firestore trigger & action graph inspection and guarded PUTs
Voice AI & 20–80 FAQ Knowledge Bases Complex v3 headers Partial First-class CLI & MCP commands for speech-to-speech prompts, KBs, and kill-switch tags
Apple Branded Mail & BIMI SVG Audit None None Pure Rust RFC 1035 DMARC/DKIM/BIMI audit + 1024×1024 SVG validator
Stale-Plan Hash & Read-Back Proof Caller must build No layout/DNS read-back Built into every mutation command by default
SECTION 04 · PRODUCTION EXAMPLES

What Deterministic HighLevel Operations Look Like

Instead of spending an afternoon clicking through sub-account settings, an operator or MCP-connected agent runs verified commands in seconds:

# 1. Verify account context & run a sub-account health check $ ghl-agency contexts --json $ ghl-crm --context moosh-growth --location P6wBuhTelIlgzaVqQx7A doctor ✓ Context resolved: moosh-growth (Location P6wBuhTelIlgzaVqQx7A verified) # 2. Plan & verify zero-touch custom domain onboarding via MCP / CLI $ ghl-onboard plan --manifest ops/ghl-location.json --json $ ghl-onboard apply --plan-id plan_01j9x8k2 --yes --json $ ghl-onboard verify --manifest ops/ghl-location.json --json ✓ Authoritative CNAME & SSL verified via RFC 1035 read-back # 3. Provision a DTMF Call-Screening IVR to block Google Business robocalls $ ghl-crm --context moosh-growth --location P6wBuhTelIlgzaVqQx7A \ workflows create-ivr --name "Inbound Call Screening" \ --phone "+14238222232" --forward-to "+14238222232" --digits 3 --dry-run ✓ Dry-run plan generated (SHA-256 state hash locked)
SECTION 05 · DEPLOY IN YOUR AGENCY

Get the Workflows, Voice AI Kits & GoHighLevel Stack

Whether you are launching your first 4-client ($2,500/month) AI agency or managing 50+ HighLevel sub-accounts, you can deploy the exact workflow blueprints, Voice AI & Knowledge Base kits, and GoHighLevel setup we run in production.

FREE AFFILIATE BONUS · $47 VALUE

Start a 14-day GoHighLevel trial or upgrade an existing account through my referral link below and email your confirmation to daniel@danielhallman.com to receive the GHL Workflow Recipe Pack ($47 value — all 12 sub-account workflow blueprints) and Agency Setup Checklist free.

Affiliate disclosure: I am a GoHighLevel affiliate. I may earn a commission from signups through my referral link at no extra cost to you.

Start a 14-Day GoHighLevel Trial (+ Free $47 Workflow Pack)

GHL Workflow Recipe Pack ($47) Voice AI & 80-FAQ KB Kit ($47) AI Agency Launch Kit ($197) Full Agency Operator Bundle ($297)

Running 15+ HighLevel sub-accounts or building with Claude Code / Cursor? Email daniel@danielhallman.com with your current sub-account count and workflow stack to discuss early access to the ghl-tools Operator CLI & MCP suite.