SUBJECT: GOHIGHLEVEL MCP SERVER & HYBRID MONETIZATION ARCHITECTURE
AUTHOR: DANIEL HALLMAN
COMPANY: MOOSH WORKS

Launch client sub-accounts in 5 minutes.

$0 FREE
5-MIN FUNNELS · 60-SEC DOMAINS & SSL · 0 ROBOCALLS · 0 SNAPSHOT DRIFT

Connect Claude, ChatGPT, Grok, Cursor, or Muse to GoHighLevel (https://ghlagencymcp.com/mcp). Restyle funnels without breaking 2-step checkouts, set up client domains & SSL in 60 seconds, block robocalls, and compare snapshots before you push.

Workflow Automation & Webhook Routing — GoHighLevel, n8n, Make.com, and ghl-onboard-mcp
TIER 0 · INTERACTIVE MCP TOOL EXPLORER

Interactive MCP Tool Explorer & Schema Inspector

Inspect the strongly typed MCP tool catalog exposed by ghl-onboard-mcp. Every mutating tool enforces 5 pre-flight safety guards: mandatory --dry-run, SHA-256 state hashing, post-write read-back verification, tenant isolation, and secret redaction.

CRM & BUILDER
ghl_crm_doctor

JSON Schema Specification:

Simulated Execution Output:

TIER 0 · PRODUCTION AUDIT DEMO

Live ghl-crm doctor Scorecard Preview

Run a comprehensive 4-pillar health audit across any GoHighLevel sub-account in seconds. The audit checks authoritative DNS/BIMI, Voice AI prompt separation with EMPTY guards, DTMF spam-shield IVRs, and workflow loop guards—outputting both a client assessment report and machine-readable JSON.

84 / 100

Audit Grade: B+ (Production Safe with Warnings)

Location ID: loc_01j9x8k2m4n7p3q5r9s1 · Audited via ghl-crm doctor --demo

Pillar A: DNS, DMARC & BIMI 22 / 25
PASS Authoritative CNAME matches leadconnectorhq.com
PASS DMARC policy enforced at p=quarantine
WARN BIMI SVG Tiny-PS logo missing 1024x1024 viewBox
Pillar B: Voice AI & 20-FAQ KB 18 / 25
PASS Voice prompt cleanly separated from text (no markdown)
WARN 14 / 20 required FAQs loaded in Knowledge Base
FAIL Missing EMPTY escalation guard (hallucination risk)
Pillar C: Call-Screening IVR 20 / 25
FAIL Direct forwarding active without DTMF keypress screening
PASS Missed-Call Text Back active with duplicate suppression
PASS After-hours voicemail routing configured
Pillar D: Workflow Safety 24 / 25
PASS Zero circular webhook triggers or infinite loops
WARN Contact re-enrollment unrestricted on lead nurture
PASS Wait step failure fallback routes present
# HighLevel Sub-Account Audit Scorecard **Target Location:** `loc_01j9x8k2m4n7p3q5r9s1` (Client Sub-Account Demo) **Overall Score:** 84 / 100 (Grade B+ — Production Safe with Warnings) **Auditor Engine:** `ghl-crm doctor v0.2.0` (Native Rust) ## Executive Summary This sub-account demonstrates strong DNS baseline compliance and clean workflow DAG structure. To achieve Grade A+ certification, two critical vulnerabilities must be addressed: 1. **Robocall Exposure:** Provision a 1-digit DTMF call-screening IVR (`workflows create-ivr`) to stop automated robocalls from triggering Voice AI receptionist minutes. 2. **Voice AI Hallucination Guard:** Inject the `EMPTY` escalation guard into the receptionist prompt to transfer unrecognized queries rather than fabricating answers. ## Prioritized Remediation Plan - [x] DNS CNAME configured correctly to `leadconnectorhq.com` - [ ] Fix BIMI SVG header: set viewBox to `0 0 1024 1024` and baseProfile to `tiny-ps` - [ ] Run `ghl-crm kb push --file faq-20.json` to load remaining 6 required answers - [ ] Deploy `EMPTY` prompt guard (`ghl-agency voice update --prompt prompt.txt`) - [ ] Run `ghl-crm workflows create-ivr --digits 3` to shield inbound phone line
{ "overall_score": 84, "status": "Warning", "location_id": "loc_01j9x8k2m4n7p3q5r9s1", "audited_at": "2026-10-15T05:30:00Z", "pillars": { "dns_deliverability": { "score": 22, "max": 25, "warn": 1 }, "voice_sms_prompts": { "score": 18, "max": 25, "fail": 1, "warn": 1 }, "call_screening_ivr": { "score": 20, "max": 25, "fail": 1 }, "workflow_safety": { "score": 24, "max": 25, "warn": 1 } }, "remediation_plan": [ { "priority": 1, "pillar": "call_screening_ivr", "action": "ghl-crm workflows create-ivr" }, { "priority": 2, "pillar": "voice_sms_prompts", "action": "Inject EMPTY escalation guard" }, { "priority": 3, "pillar": "dns_deliverability", "action": "Normalize BIMI SVG Tiny-PS viewBox" } ] }
FREE ASSESSMENT WEDGE

Claim Your Sub-Account Audit & CLI Quickstart

Enter your details below to receive the complete sample ghl-crm doctor assessment scorecard, the 4-pillar audit checklist, and Claude Code / Cursor MCP configuration snippets. Contacts are verified and synced directly with GoHighLevel.

INSTANT SCORECARD & CLI QUICKSTART DELIVERY

Your request delivers the sample ghl-crm doctor 0–100 JSON scorecard, the 4-pillar pre-flight checklist, and copy-paste MCP server config for Claude Code and Cursor.

TIER 1 · MODULAR FEATURE PACKS

Modular Feature Packs ($47 One-Time) & Operator Bundle

Targeted, production-tested implementation packs for recurring HighLevel operational failure modes. Buy individual packs standalone, or claim all three packs plus the 90-Minute Install Runbook ($291 total value) free when you start a 14-day HighLevel trial.

Workflow & Call-Screening IVR Pack
SKU: KIT-WF-IVR · PACK 1 $47

Workflow & Call-Screening IVR Pack

0 SPAM
  • 7 Ready-to-Import Workflows: Speed-to-lead, reminders, no-show recovery & Google reviews
  • 1-Prompt Robocall Screen: Stop spam bots from ringing clients or burning Voice AI minutes
  • Missed-Call Text Back: Instant SMS reply without duplicate texts
FREE WITH 14-DAY GHL TRIAL ($291 STACK)

Included FREE when you start or upgrade HighLevel via /go/ghl-trial (claim bonus →).

Voice AI & 20-FAQ Knowledge Base Pack
SKU: KIT-VOICE-KB · PACK 2 $47

Voice AI & 20-FAQ Receptionist Pack

20 FAQS
  • Natural Voice Prompts: Clean spoken receptionist scripts that never read markdown out loud
  • 20-FAQ Receptionist Template: Hours, services, pricing floors & booking rules
  • Zero-Hallucination Guard: Transfers unknown questions instead of making up prices
Deliverability, DNS & Apple Branded Mail Pack
SKU: KIT-DNS-BIMI · PACK 3 $47

Deliverability, DNS & Apple Branded Mail

INBOX
  • 60-Second Domain Checklist: Connect client funnel & white-label domains without delays
  • Primary Inbox DMARC Setup: Keep client emails out of Promotions and Spam
  • Apple Branded Mail Logos: Put your client's verified logo inside Apple Mail & Gmail
Full Agency Operator Bundle ($612 Value)
SKU: BND-PRO · COMPLETE LIBRARY $297 OR $0 W/ GHL REFERRAL

Full Agency Operator Bundle ($612 Value)

$297
  • ✓ Pack 1: Workflows & Call-Screen IVR ($47)
  • ✓ Pack 2: Voice AI & 20-FAQ KB ($47)
  • ✓ Pack 3: DNS & Apple Branded Mail ($47)
  • ✓ $197 AI Agency Launch Kit
  • ✓ Grok Bot Roster: 8 Seats ($47)
  • ✓ Social + Prompt Jumbo Pack ($27)
TIER 2 · RECURRING MCP SUBSCRIPTIONS & AFFILIATE VIP UNLOCK

HighLevel Agency & Builder MCP ($0 / $29 / $79)

Connect your favorite AI once (https://ghlagencymcp.com/mcp). Never pay per sub-account or per prompt.

STARTER · FREE FOREVER

Starter

$0/MO

1 Sub-Account · No Credit Card

  • Unlimited Health Audits
  • 25 Guided Write Runs / Mo
  • Broken Merge-Tag & Phone Audit
  • Domain, SSL & Branded Mail Check
SOLO BUILDERS & AGENCIES

Builder Pro

$22/MO*

$29/mo ($22/mo w/ code PARTNER25 or $199/yr)

  • Unlimited Sub-Accounts & Edits
  • 5-Min Funnel & Checkout Restyler
  • 60-Second Domain, DNS & SSL Setup
  • 1-Prompt Robocall Spam-Shield IVR
TIER MATRIX · OFFER SPECIFICATION & COMPETITOR COMPARISONS

Hybrid Offer & Competitor Comparison Matrix

Compare our diagnostic wedge, modular packs, and 55-tool native Rust MCP subscriptions—plus explore side-by-side head-to-head teardowns on ghlagencymcp.com:

Head-to-Head Comparisons: vs. LeadSpine (ghlmcp.io $75/mo) · vs. HighLevel Built-In Ask AI · vs. Official HighLevel MCP · vs. Zapier, Make & n8n

Feature / Capability Starter (Free Forever) Builder Pro ($29/mo · $22 w/ PARTNER25) Agency Unlimited ($79/mo · $59 w/ PARTNER25 or $0 Affiliate)
Sub-Account Capacity 1 sub-account Unlimited sub-accounts Unlimited sub-accounts + multi-tenant fleet ops
Sub-Account Health Scorecard (doctor) Unlimited read-only audits Automated CLI & MCP doctor engine Fleet-wide fleet-audit across all locations
Funnels, Websites & Workflows 25 guided write runs / mo Unlimited funnel/website edits + workflow DAGs Unlimited + Snapshot CI/CD (SnapOps)
DTMF Call-Screening IVR & Voice AI Included (guided write runs) 1-command CLI & MCP: workflows create-ivr Fleet provisioning + Voice AI / KB sync
Apple Branded Mail, BIMI & RFC 1035 DNS Live UDP DNS verifier Automated Cloudflare & Porkbun DNS onboarding White-label agency + sub-account domain fleet
AI Coding Agent MCP Tools 55 native Rust tools 55 native Rust tools (unlimited runs) 55 native Rust tools + SaaS rebilling & PIT rotation
Snapshot Drift Detection (diff-location) None Single-location preview Full Snapshot CI/CD & live location drift diffing
Price & Affiliate VIP Unlock $0 / mo (Free Forever) $29 / mo ($22/mo w/ PARTNER25 or $199/yr) $79 / mo ($59/mo w/ PARTNER25) or $0/mo Free w/ GHL Affiliate Referral
SECTION 04 · OPERATOR ARCHITECTURE

The 5-Binary Rust CLI & MCP Suite

Instead of mixing credentials or relying on brittle browser automation, ghl-tools separates agency, sub-account CRM, domain onboarding, Marketplace administration, and email deliverability into dedicated native binaries and bounded MCP servers:

SUB-ACCOUNT & BUILDER OPS ghl-crm

ghl-crm + CRM MCP

Direct inspection and verified updates for sub-account resources that public REST endpoints cannot reach.

  • Funnel & Website Layout Engine: Read, diff, and publish layout JSON, CSS styles, copy, and SEO meta tags with SHA-256 layout hash guards.
  • Workflows & Spam-Shield IVR: Inspect full workflow graphs and provision 1-step DTMF call-screening IVRs (workflows create-ivr) to stop Google Business robocalls from burning Voice AI minutes.
  • Knowledge Bases & Forms: Manage 20–80 FAQ Receptionist Knowledge Bases, intake forms, custom fields, and saved views.
MULTI-TENANT & VOICE AI ghl-agency

ghl-agency + Agency MCP

Agency-level control across sub-accounts, snapshots, Private Integration Tokens, and v3 AI resources.

  • Context Isolation: Explicit account routing (--context moosh-growth vs. marketplace-sandbox) with hard guardrails on protected client locations.
  • Voice AI & Conversation AI: Inspect and configure speech-to-speech Voice AI agents, spoken prompts, calendar actions, and kill-switch tags.
  • Zero-Downtime PIT Lifecycle: Programmatic minting, scoping, rotation (pit rotate), and audit of Private Integration Tokens.
ZERO-TOUCH DNS & SSL ghl-onboard-mcp

ghl-onboard & ghl-onboard-mcp

Desired-state planning, execution, and RFC 1035 DNS verification for HighLevel white-label and branded-link domains.

  • Declarative Manifests: Define location and domain intent in ops/ghl-location.json.
  • Short-Lived Plan IDs: ghl-onboard plan generates a read-only diff; apply requires the exact reviewed plan ID and aborts if live DNS or sub-account state drifted.
  • Stdio & HTTP MCP: Runs over stdio or authenticated loopback HTTP (:27192) for AI agent orchestration.
MARKETPLACE & DELIVERABILITY ghl-mkt + mail

ghl-mkt & apple-branded-mail

Developer portal governance and pure-Rust RFC 1035 email authentication audits.

  • Marketplace MCP (ghl-mkt): Manage Marketplace app listings, versions, OAuth scopes, webhook routing, billing, and release-check portal read-backs.
  • Apple Branded Mail & BIMI: Pure Rust RFC 1035 UDP DNS verification for DMARC (p=quarantine/p=reject), DKIM, SPF, and 1024×1024 SVG BIMI brand logos.
SECTION 05 · PRE-FLIGHT SAFETY CONTRACT

The 5 Non-Negotiable Safety Guards

Giving an LLM raw write access to a live client CRM without state checks is a recipe for overwritten funnels and broken automations. Every write operation in ghl-tools enforces five non-negotiable engineering guards:

  1. Mandatory --dry-run Plan / --yes Apply Split: Every mutation first computes a read-only execution plan showing the exact fields, layout nodes, or DNS records that will change.
  2. Stale-Plan SHA-256 Fingerprinting: Plans embed a cryptographic hash of the current live state. If a client or teammate edits a funnel or workflow in the browser before apply runs, execution fails closed instead of clobbering their work.
  3. Post-Write Live Read-Back Verification: No command reports success from an HTTP 200 OK response alone. Every write immediately fetches the live resource back from HighLevel (or queries authoritative RFC 1035 DNS servers) to prove persistence.
  4. Strict Tenant & Context Isolation: Credentials live in isolated 0600 local directories per context and vault lane. Production client sub-accounts cannot be mutated without explicit location targeting.
  5. Zero-Knowledge Local Execution & Automatic Redaction: All HighLevel API, session, and DNS calls execute directly from your machine. Bearer tokens, PITs, cookies, and keys are automatically stripped from terminal output, logs, and JSON receipts.

Headless Secret Injection with 1Password Service Accounts (OP_SERVICE_ACCOUNT_TOKEN)

Never store HighLevel Private Integration Tokens (GHL_LOCATION_PIT), agency session keys, or Cloudflare DNS tokens in plaintext repository .env files. We pair ghl-tools with 1Password Service Accounts (/go/1password) so CLI runs and MCP servers resolve credentials headlessly from isolated Operator Vaults without triggering interactive desktop Touch ID prompts:

# Resolve scoped sub-account PIT headlessly via 1Password Service Account (zero GUI prompts) $ export OP_SERVICE_ACCOUNT_TOKEN="$(cat ~/.local/op-service-account.token)" $ op vault list --format json # Verify narrow Operator Vault grants before mutation $ GHL_LOCATION_PIT="$(op item get 'Operator Key — HighLevel Location PIT' --vault 'Moosh Works Operator' --fields label=credential --reveal)" \ ghl-onboard-mcp serve --stdio

Explore 1Password Service Accounts (/go/1password) See Full Agency Operations & Secrets Stack (/tools)