Changelog

Notable changes to this documentation site, newest first. For code-level changes to the MCP server itself, see the implementation status in the repo. Anything before the first entry below lives in the git history.

2026-08-19

Fixed

• Funnel tools no longer 401 on sites with funnels. ghl_get_funnel_stats and ghl_compute_opt_in_rate used to call GoHighLevel’s funnels/page/analytics route, which has no IAM scope and rejects every Private Integration token — so they broke on every sub-account that actually has funnels. They now use only officially scoped routes (funnels/funnel.readonly + funnels/page.readonly), return the real funnel + page structure, and report per-page views/opt-ins as null (never fabricating zeros). ghl_compute_opt_in_rate now fills overall.total_opt_ins with the real form-submission count (from /forms/submissions meta.total); views and opt-in rate stay null because GoHighLevel does not expose page views to Private Integration tokens.

2026-08-16

Changed

• Two-factor authentication is now optional per account (previously mandatory). A user without 2FA logs straight in; a user can turn 2FA on or off themselves at the new /admin/security page (Sidebar “Security”), and a super-admin can still reset it from /admin/users. The Account security and Users & RBAC pages were updated to match.

Added

• forms_get-submissions — a GoHighLevel tool that returns the correct lead count (form submissions) for a site over a window, reading the API’s meta.total. It replaces counting contacts_*, which overcounts leads 30–200×. See All MCP tools.

Fixed

• GoHighLevel location leak. A site with no GoHighLevel location no longer silently falls back to another client’s location; it returns E_GOHIGHLEVEL_SITE_NOT_LINKED, and every GoHighLevel response now carries the resolved location_id.
• Pipeline-funnel inflation. ghl_compute_pipeline_funnel now paginates opportunities with both cursors and dedupes by id, so counts are real instead of inflated by re-served pages.

2026-08-04

Added

• Account security — new page documenting the login-security upgrade: mandatory TOTP 2FA (with QR enrolment + backup codes), brute-force lockout, PBKDF2 600k hashing, CSRF protection, session revocation (“log out everywhere”), idle timeout, and individual super-admins. The Users & RBAC page links to it and its PBKDF2 / first-login notes were updated to match.

2026-08-03

Added

• Team playbooks — a new role-based section (in the sidebar under Getting started) with a page per team: SEO, Content, CRM, Marketing, and IT / Admin, plus an overview. Each page lists what the role can do, the tools behind it, copy-paste prompts, and the gotchas. Available in English and Vietnamese.