WhatsApp MCP

whatsapp-mcp

A WhatsApp MCP server for Claude, built directly on whatsmeow. Encrypted at rest, prompt-injection-scrubbed, draft-and-confirm on every send, full audit trail, daily CI security gates. Actively maintained.

Why this one?

The most-starred WhatsApp MCP (lharries/whatsapp-mcp, 5.6K stars) is the architectural reference for this pattern, but has not shipped since July 2025 and leaves the lethal-trifecta problem entirely to the user. This implementation closes the gaps:

Not a fork. The Go bridge is built directly against whatsmeow; the Python MCP layer and SQLite schema are original. Other implementations (lharries, LukasHaas, verygoodplugins) were read as reference only.

What this gives you

Claude can:

• Read your WhatsApp chats, messages, and contacts
• Search messages with accent-insensitive, typo-tolerant matching
• Transcribe voice notes locally via whisper.cpp (language detected per note). Off until you say yes; Claude offers it once, and python3 whatsapp-mcp-server/enable_transcription.py turns it on in one step
• Resolve LID (Linked IDentifier) names instead of numeric placeholders
• Send text messages, reactions, and reply-quotes, with a mandatory confirm_send step between draft and delivery
• Pull matching CRM context from your Obsidian vault when reading a chat
• See only prompt-injection-scrubbed message text, never raw adversarial input

Everything runs locally on your machine. No cloud sync. No telemetry. Optional OpenAI Whisper backend is opt-in, off by default.

Architecture

Two components, both local:

• `whatsapp-bridge/` (Go). Binds to 127.0.0.1 only. Wraps whatsmeow for the WhatsApp Web multidevice protocol. Owns SQLite persistence with SQLCipher encryption. Handles QR and pairing-code auth (live-refreshing terminal QR with Windows-safe rendering, plus a headless auth API — GET /api/auth/qr, POST /api/auth/pair-phone, POST /api/auth/reconnect — so a GUI or supervisor can drive pairing without a terminal), media up/download, session recovery from StreamReplaced conflicts, call history capture. Exposes a REST API the Python MCP layer consumes.
• `whatsapp-mcp-server/` (Python, FastMCP). Consumes the Go bridge REST API. Exposes 11 MCP tools to Claude: full read surface (chats, messages, contacts), accent-insensitive search, presence (typing, online, mark-read), and text-send + reactions + reply-quotes with mandatory confirm_send. Runs via uv and stdio transport.

Install

Open Claude Code, paste:

/plugin marketplace add adelaidasofia/whatsapp-mcp /plugin install whatsapp-mcp@whatsapp-mcp

This installs the Python MCP server side. The Go bridge still needs the one-time QR pairing flow with your phone — see the legacy install block below for those steps.

Manual install (full Go bridge + QR pairing)

See SETUP.md for step-by-step install per OS. In short:

1. Grab a prebuilt bridge binary from Releases (Windows/macOS/Linux — no compiler needed), or build from source (Go 1.26+ and a C toolchain)
2. Python 3.11+ and uv for the MCP server layer
3. Clone this repo; verify with scripts/check_prerequisites.sh (Windows: scripts\check_prerequisites.ps1)
4. Start the bridge: ./bin/whatsapp-bridge (Windows: .\bin\whatsapp-bridge.exe)
5. Scan the QR (it refreshes in place — always scan the one on screen), or pair by typed code with --pair-phone +15551234567
6. Register the MCP in your Claude Code .mcp.json
7. Restart Claude Code

FFmpeg and whisper.cpp are only needed if you enable voice-note transcription (off by default); enable_transcription.py configures them for you, and installs them with Homebrew on a Mac (SETUP.md step 4).

Configuration

All configurable via environment variables. See .env.example for the full list.

Key variables:

The DB key and WHATSAPP_DB_KEY

With WHATSAPP_ENCRYPT_DB=true (the default), the bridge encrypts the message store with a 256-bit SQLCipher key kept in the platform secret store. The key lifecycle is deliberately conservative, because a wrong key silently orphans every stored message:

• A fresh key is minted only when the secret store definitively answers "no such item" (macOS errSecItemNotFound, Windows ERROR_NOT_FOUND, libsecret clean miss) and no non-empty store database exists yet.
• Any other failed read — locked keychain, no D-Bus session, revoked access — makes the bridge exit with an error instead of minting: the key may still exist, and overwriting it would make the encrypted store permanently undecryptable. The error names the fix (e.g. security unlock-keychain).
• If the secret store has no key but a populated store database exists, the bridge also refuses to mint and asks you to supply the original key.

WHATSAPP_DB_KEY (64 hex chars = 32 bytes, e.g. openssl rand -hex 32) is the escape hatch for all of these: when set, it is used directly and the platform secret store is never touched. Use it for headless/CI machines, custom secret managers, restoring a store on a new machine, or booting while the platform store is unavailable.

Security

This MCP is the highest-trust component in your Claude stack because every WhatsApp message you receive flows through it. See SECURITY.md for the threat model, tool risk-tier classification, and the full list of hardening decisions.

Short version:

• Bridge binds to 127.0.0.1 only, never 0.0.0.0
• SQLite encrypted at rest with SQLCipher; key stored in the platform secret store (macOS Keychain / Windows Credential Manager / libsecret), with an explicit WHATSAPP_DB_KEY escape hatch
• Every tool call logged to audit.log with 30-day retention
• Send tools require an explicit confirm_send step between draft and delivery
• Incoming message text passes through a prompt-injection scrubber before Claude sees it
• whatsmeow pinned to a specific commit; upgrades require diff review
• No telemetry, no external API calls by default

Status

v0.1.0, actively maintained.

Shipped: live-refreshing QR (in-place redraw on rotation, Windows-safe rendering, auto fresh batch on expiry) + pairing-code auth (typed 8-char code, Android + iOS) + headless auth API for supervisors, full read surface (chats, messages, contacts), accent-insensitive NFD-normalized search, LID alias resolution with backfill migration for legacy threads, Baileys-store import for one-shot history migration, vault-format markdown export, local whisper.cpp voice transcription, presence (typing, online, mark-read), text-send with mandatory confirm_send, reactions, reply-quotes, prompt-injection scrubber, SQLCipher-encrypted persistence with macOS Keychain key handling, audit log, CI security gates.

Not yet shipped: media-send (image, document), audio-message-send (FFmpeg-Opus path), group broadcast helpers.

See CHANGELOG.md for full history.

MCP Registry

Published on the official MCP Registry under io.github.adelaidasofia/whatsapp-mcp. Two live channels:

• `.mcpb` bundle (canonical, recommended) — one-click install in Claude Desktop / Cursor / any MCPB-aware client. Published as a GitHub release artifact at releases/latest/download/whatsapp-mcp.mcpb. The release manifest carries the SHA256 for tamper detection.
• PyPI package (adelaidasofia-whatsapp-mcp) — historical; available via uvx adelaidasofia-whatsapp-mcp for stdio-installer flows. The unprefixed names (whatsapp-mcp, whatsapp-mcp-server) are taken by unrelated projects on PyPI, hence the username-prefixed namespace.

The verification marker mcp-name: io.github.adelaidasofia/whatsapp-mcp is embedded in this README (HTML comment near the top) so the registry can verify package-to-server