ghl-mcp-proxy

A minimal multi-sub-account MCP proxy for GoHighLevel / LeadConnector. Holds a Private Integration Token (PIT) + Location ID per sub-account and exposes two tools to Claude:

• list_accounts — shows which sub-accounts are configured
• ghl_api_request — makes an authenticated call to the LeadConnector REST API on behalf of a chosen account

1. Configure your accounts

Copy .env.example to .env and fill in:

• PROXY_SHARED_SECRET — a long random string (openssl rand -hex 32). This is the "password" Cowork will send back to this server.
• GHL_ACCOUNTS_JSON — one entry per sub-account, keyed by a friendly name:

{
  "acme_dental":   { "pit": "pit-xxxxxxxx", "locationId": "loc-xxxxxxxx" },
  "joes_plumbing": { "pit": "pit-yyyyyyyy", "locationId": "loc-yyyyyyyy" }
}

Keep this as valid JSON on one line in the real .env file.

2. Deploy on Hostinger

Option A — Hostinger VPS (recommended, most control)

1. SSH into your VPS.

2. Install Node 20+ and git if not already present:

   curl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -
   sudo apt-get install -y nodejs git
   

3. Upload this project (via git clone from your own repo, or scp).

4. cd ghl-mcp-proxy && cp .env.example .env then edit .env with real values.

5. Install dependencies and run with a process manager so it survives reboots:

   npm install --omit=dev
   npm install -g pm2
   pm2 start src/server.js --name ghl-mcp-proxy
   pm2 save
   pm2 startup   # follow the printed instructions
   

6. Put Nginx in front of it for HTTPS (Hostinger VPS panel can issue a free Let's Encrypt cert). Point a subdomain, e.g. mcp.yourdomain.com, at the VPS, then reverse-proxy port 443 → localhost:8080.

   Minimal Nginx server block:

   server {
       listen 443 ssl;
       server_name mcp.yourdomain.com;
   
       ssl_certificate     /etc/letsencrypt/live/mcp.yourdomain.com/fullchain.pem;
       ssl_certificate_key /etc/letsencrypt/live/mcp.yourdomain.com/privkey.pem;
   
       location / {
           proxy_pass http://localhost:8080;
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
       }
   }
   

7. Test: curl https://mcp.yourdomain.com/health should return {"ok":true,"accounts":2}.

Option B — Hostinger Node.js App (hPanel, if on a plan that supports it)

1. In hPanel, create a new Node.js application, point it at this project (upload via File Manager or Git).
2. Set the entry point to src/server.js.
3. Add all variables from .env.example under the app's Environment Variables section (do not upload a real .env file to a shared host).
4. Set the app's port to match what Hostinger assigns via process.env.PORT (already handled in server.js).
5. Attach your domain/subdomain and enable SSL (Hostinger issues this automatically for most plans).
6. Restart the app, then test https://your-subdomain/health.

3. Add it as a custom connector in Cowork

1. In Claude/Cowork: Customize → Connectors → "+".
2. Name: GoHighLevel Proxy (or anything).
3. URL: https://mcp.yourdomain.com/mcp
4. Advanced settings → set a custom header: Authorization: Bearer <your PROXY_SHARED_SECRET>
5. Click Add, then Connect.

4. Use it

Ask Claude something like:

"List my connected GHL accounts, then for acme_dental find contacts tagged 'hot lead' and summarize what's happening with them."

Claude will call list_accounts, then ghl_api_request with account: "acme_dental" and the right REST path.

Adding more sub-accounts later

Just add another entry to GHL_ACCOUNTS_JSON and restart the app (pm2 restart ghl-mcp-proxy on VPS, or restart via hPanel). No code changes needed.

Security notes

• This single server holds credentials for all your clients — treat the shared secret and .env file like a master password.
• Use the narrowest PIT scopes each workflow actually needs.
• Rotate PITs periodically from GHL Settings → Private Integrations.
• Never commit .env to git (already covered by .gitignore).