get_users_by_location

What get_users_by_location does on GoHighLevel MCP Server

AI agents call get_users_by_location to retrieve information from GoHighLevel MCP Server without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_users_by_location is rated Low

This tool retrieves a list of users filtered by location from the GoHighLevel CRM. It performs a query operation that returns existing data without creating, modifying, deleting, or executing external actions. The blast radius of misuse is minimal—an attacker could enumerate users but cannot alter data or trigger operations. Classification: Read/low severity.

From the tool's definition Tool name contains 'get' and description states 'List all users' — both indicate data retrieval with no modification or side effects.

Risk signalsBulk/mass operation — affects multiple targets

The rule that runs get_users_by_location safely

PolicyLayer is an MCP gateway: it sits between your AI agents and GoHighLevel MCP Server, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_users_by_location, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_users_by_location": {}
  }
}

Questions about get_users_by_location