# ghl-mcp-proxy

A minimal multi-sub-account MCP proxy for GoHighLevel / LeadConnector.
Holds a Private Integration Token (PIT) + Location ID per sub-account and
exposes two tools to Claude:

- `list_accounts` — shows which sub-accounts are configured
- `ghl_api_request` — makes an authenticated call to the LeadConnector REST
  API on behalf of a chosen account

## 1. Configure your accounts

Copy `.env.example` to `.env` and fill in:

- `PROXY_SHARED_SECRET` — a long random string (`openssl rand -hex 32`).
  This is the "password" Cowork will send back to this server.
- `GHL_ACCOUNTS_JSON` — one entry per sub-account, keyed by a friendly name:

```json
{
  "acme_dental":   { "pit": "pit-xxxxxxxx", "locationId": "loc-xxxxxxxx" },
  "joes_plumbing": { "pit": "pit-yyyyyyyy", "locationId": "loc-yyyyyyyy" }
}
```

Keep this as valid JSON on one line in the real `.env` file.

## 2. Deploy on Hostinger

### Option A — Hostinger VPS (recommended, most control)

1. SSH into your VPS.
2. Install Node 20+ and git if not already present:
   ```bash
   curl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -
   sudo apt-get install -y nodejs git
   ```
3. Upload this project (via `git clone` from your own repo, or `scp`).
4. `cd ghl-mcp-proxy && cp .env.example .env` then edit `.env` with real values.
5. Install dependencies and run with a process manager so it survives reboots:
   ```bash
   npm install --omit=dev
   npm install -g pm2
   pm2 start src/server.js --name ghl-mcp-proxy
   pm2 save
   pm2 startup   # follow the printed instructions
   ```
6. Put Nginx in front of it for HTTPS (Hostinger VPS panel can issue a free
   Let's Encrypt cert). Point a subdomain, e.g. `mcp.yourdomain.com`, at the
   VPS, then reverse-proxy port 443 → `localhost:8080`.

   Minimal Nginx server block:
   ```nginx
   server {
       listen 443 ssl;
       server_name mcp.yourdomain.com;

       ssl_certificate     /etc/letsencrypt/live/mcp.yourdomain.com/fullchain.pem;
       ssl_certificate_key /etc/letsencrypt/live/mcp.yourdomain.com/privkey.pem;

       location / {
           proxy_pass http://localhost:8080;
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
       }
   }
   ```
7. Test: `curl https://mcp.yourdomain.com/health` should return
   `{"ok":true,"accounts":2}`.

### Option B — Hostinger Node.js App (hPanel, if on a plan that supports it)

1. In hPanel, create a new Node.js application, point it at this project
   (upload via File Manager or Git).
2. Set the entry point to `src/server.js`.
3. Add all variables from `.env.example` under the app's Environment
   Variables section (do not upload a real `.env` file to a shared host).
4. Set the app's port to match what Hostinger assigns via `process.env.PORT`
   (already handled in `server.js`).
5. Attach your domain/subdomain and enable SSL (Hostinger issues this
   automatically for most plans).
6. Restart the app, then test `https://your-subdomain/health`.

## 3. Add it as a custom connector in Cowork

1. In Claude/Cowork: **Customize → Connectors → "+"**.
2. Name: `GoHighLevel Proxy` (or anything).
3. URL: `https://mcp.yourdomain.com/mcp`
4. Advanced settings → set a custom header:
   `Authorization: Bearer <your PROXY_SHARED_SECRET>`
5. Click **Add**, then **Connect**.

## 4. Use it

Ask Claude something like:

> "List my connected GHL accounts, then for acme_dental find contacts
> tagged 'hot lead' and summarize what's happening with them."

Claude will call `list_accounts`, then `ghl_api_request` with
`account: "acme_dental"` and the right REST path.

## Adding more sub-accounts later

Just add another entry to `GHL_ACCOUNTS_JSON` and restart the app
(`pm2 restart ghl-mcp-proxy` on VPS, or restart via hPanel). No code changes
needed.

## Security notes

- This single server holds credentials for *all* your clients — treat the
  shared secret and `.env` file like a master password.
- Use the narrowest PIT scopes each workflow actually needs.
- Rotate PITs periodically from GHL Settings → Private Integrations.
- Never commit `.env` to git (already covered by `.gitignore`).