NotFairNotFair
Start now

GoHighLevel MCP · safety architecture

CRM writes are bounded. Calendar delete is not reversible here.

Workspace roles gate writes. Mutations cover contacts, opportunities, calendar appointments, tags, and contact tasks, with before/after receipts. deleteCalendarEvent is destructive and cannot be undone through NotFair.

Last verified · September 17, 2026 · NotFair product team

The NotFair HighLevel write contract

Read the location, mutate with a scope, keep the receipt

NotFair advertises 36 GoHighLevel tools. Official HighLevel documents a larger first-party catalog; this page describes NotFair’s counted surface only.

  1. 01

    Resolve locationId

    listLocations first. Agency connections pass locationId so the matching sub-account token is used.

  2. 02

    Read before writing

    listContacts, listPipelines, or listCalendars so create/update tools have real IDs.

  3. 03

    Check workspace role

    Write tools throw if the caller’s workspace role cannot write.

  4. 04

    Apply a scoped mutation

    contacts.write, opportunities.write, calendars/events.write, or locations/tags.write only.

  5. 05

    Return a receipt

    Supported mutations include before/after snapshots. That is provenance, not Google Ads undo.

  6. 06

    Label destructive deletes

    deleteCalendarEvent cannot be undone through NotFair.

Evidence table

What each control prevents

ControlWhat it protects againstWhat the operator sees
Workspace roleViewer identities mutating CRM recordsA read-only error instead of a write
Scope allowlistlocations.write / users.writeThose scopes are not requested
GET-only requestGeneric mutating escape hatchesrequest is read-only by construction
Destructive annotationAssuming calendar delete can be restoredCannot be undone through NotFair

Limits and honest boundaries

  • deleteCalendarEvent cannot be undone through NotFair.
  • NotFair does not copy HighLevel’s 625-operation Claude catalog as its own tool count.
  • Missing HighLevel scopes require a Marketplace reauthorize; repeating the tool call will not grant permission.
  • NotFair does not request locations.write or users.write. Generic request is GET-only. This is not a Google Ads impact/undo product.

Frequently asked questions

Can Claude edit HighLevel contacts without asking?

Writes require a workspace role that can write plus the matching HighLevel scope. Reads can inspect CRM records without that gate.

Can deleteCalendarEvent be undone?

No. It is labeled destructive and cannot be undone through NotFair. Other mutations return before/after receipts.

Does NotFair request locations.write?

No. locations.write and users.write are not requested. The generic request tool is GET-only.

Is this Google Ads undo?

No. GoHighLevel receipts are not Google Ads impact snapshots.

Continue evaluating

Related evidence

GoHighLevel MCP benchmark

Compare NotFair with official HighLevel MCP and sourced open-source servers.

Read more

Hosted OAuth, no PIT in the client

NotFair hosts HighLevel Marketplace OAuth. You authorize Company or Location access without pasting a Private Integration Token into the AI client.

Read more

Claude + GoHighLevel

First-class Claude landing for HighLevel CRM.

Read more