GoHighLevel MCP · safety architecture
CRM writes are bounded. Calendar delete is not reversible here.
Workspace roles gate writes. Mutations cover contacts, opportunities, calendar appointments, tags, and contact tasks, with before/after receipts. deleteCalendarEvent is destructive and cannot be undone through NotFair.
Last verified · September 17, 2026 · NotFair product team
The NotFair HighLevel write contract
Read the location, mutate with a scope, keep the receipt
NotFair advertises 36 GoHighLevel tools. Official HighLevel documents a larger first-party catalog; this page describes NotFair’s counted surface only.
- 01
Resolve locationId
listLocations first. Agency connections pass locationId so the matching sub-account token is used.
- 02
Read before writing
listContacts, listPipelines, or listCalendars so create/update tools have real IDs.
- 03
Check workspace role
Write tools throw if the caller’s workspace role cannot write.
- 04
Apply a scoped mutation
contacts.write, opportunities.write, calendars/events.write, or locations/tags.write only.
- 05
Return a receipt
Supported mutations include before/after snapshots. That is provenance, not Google Ads undo.
- 06
Label destructive deletes
deleteCalendarEvent cannot be undone through NotFair.
Evidence table
What each control prevents
| Control | What it protects against | What the operator sees |
|---|---|---|
| Workspace role | Viewer identities mutating CRM records | A read-only error instead of a write |
| Scope allowlist | locations.write / users.write | Those scopes are not requested |
| GET-only request | Generic mutating escape hatches | request is read-only by construction |
| Destructive annotation | Assuming calendar delete can be restored | Cannot be undone through NotFair |
Limits and honest boundaries
- deleteCalendarEvent cannot be undone through NotFair.
- NotFair does not copy HighLevel’s 625-operation Claude catalog as its own tool count.
- Missing HighLevel scopes require a Marketplace reauthorize; repeating the tool call will not grant permission.
- NotFair does not request locations.write or users.write. Generic request is GET-only. This is not a Google Ads impact/undo product.
Frequently asked questions
Writes require a workspace role that can write plus the matching HighLevel scope. Reads can inspect CRM records without that gate.
No. It is labeled destructive and cannot be undone through NotFair. Other mutations return before/after receipts.
No. locations.write and users.write are not requested. The generic request tool is GET-only.
No. GoHighLevel receipts are not Google Ads impact snapshots.
Continue evaluating
Related evidence
GoHighLevel MCP benchmark
Compare NotFair with official HighLevel MCP and sourced open-source servers.
Read moreHosted OAuth, no PIT in the client
NotFair hosts HighLevel Marketplace OAuth. You authorize Company or Location access without pasting a Private Integration Token into the AI client.
Read moreClaude + GoHighLevel
First-class Claude landing for HighLevel CRM.
Read more