CommunityAbandoned· 11mo★ 4.3by Luke Harries

WhatsApp MCP

Searches personal WhatsApp messages and contacts and sends messages to individuals or groups via a local Go bridge.

View repo

Safety & Trust

Delv Safety Grade: C

Score 58/100 · assessed 2026-04-28

Maintainer45

Permissions35

Supply chain35

Transparency65

Incidents100

WhatsApp MCP is a community project by solo developer Luke Harries that bridges your personal WhatsApp account to Claude via a local Go server. It grants read access to your entire message history and contacts, plus the ability to send messages to any individual or group. The maintainer appears legitimate but this is a one-person effort with typical solo-dev bus factor risks. The permissions are quite broad: full read access to private communications spanning potentially years, plus unrestricted write capability to send messages on your behalf. Supply chain is weak—clone-and-build only, no package distribution, custom Go binary you compile locally. The code is open source which aids transparency, but there's no formal security review, no signed releases, and you're trusting a local bridge with your WhatsApp session. No known incidents, but the attack surface is significant: compromised bridge could exfiltrate all messages or send malicious content.

Lethal Trifecta (prompt-injection exposure)

TRIFECTA RISK

All three axes present. This server can read private data, ingest attacker-controlled content, and send data outbound. A poisoned input (a GitHub issue, an email, a webpage) can exfiltrate secrets via this chain. Only install with auditing; avoid on shared or cloud agents.

Private dataYes

Reads secrets, credentials, private files

Untrusted inputYes

Ingests web pages, PRs, issues, emails

External commsYes

Can send data outbound

Identical shape to imessage. Group chats and unknown-number messages compound the untrusted-input axis.

Green flags

Open source code available for inspection on GitHub
Runs locally rather than sending data to third-party servers
No known security incidents or malicious behaviour
Clear use case for personal message search and automation

Red flags

Full read access to all personal WhatsApp messages and contacts
Can send messages to anyone on your behalf without confirmation
Solo maintainer with single point of failure
Clone-and-build only, no package distribution or signed releases
Local Go bridge holds session credentials for your WhatsApp account

Permissions requested

Read messagesSend messagesIdentity readOutbound network

Assessed by Delv Editorial using public metadata. Grades are advisory and update as the ecosystem changes. They do not replace your own review of permissions and code before granting an agent access to sensitive systems.

Install

git clone https://github.com/lharries/whatsapp-mcp.git

Review

WhatsApp MCP turns your personal WhatsApp into a queryable database and outbound messaging API, all running through a local Go bridge. You clone the repo, spin up the Go server, and suddenly Claude can search your message history, pull up contacts, and send messages to individuals or groups without you opening the app. It's genuinely useful if you've got years of WhatsApp threads and need to surface old conversations or automate replies without context-switching. I'd reach for this when triaging a backlog of group chats or digging up a half-remembered conversation from months ago. The search is fast, and because it's local, your messages never leave your machine. The outbound messaging is handy for scripted replies or batch notifications, though you'll want to be careful not to spam your contacts. One specific workflow: asking Claude to summarise unread messages from a particular group, then drafting a reply based on context it pulls from older threads. It's the kind of thing that feels like magic the first time it works. The quirks are real. You need to run a Go server locally, which means keeping it alive in the background. The setup isn't plug-and-play; you're cloning a repo and wiring it into your host config manually. There's no npm package, no one-liner install. If you're not comfortable with that, this isn't for you. Also, WhatsApp's terms of service are murky around automation, so use this for personal workflows, not anything commercial or high-volume. Who shouldn't bother: anyone expecting a polished, zero-config experience. This is a developer tool for people who want programmatic access to their own WhatsApp data and are willing to run a local bridge to get it. If you don't have a specific use case in mind, the setup overhead isn't worth it. But if you're drowning in WhatsApp threads or want to automate personal messaging without third-party services, it's a solid, privacy-respecting option.

Verdict

Install this if you need programmatic access to your WhatsApp history and are comfortable running a local Go server. Skip it if you're looking for a quick, polished setup or don't have a clear automation use case. It's a power tool for personal workflows, not a casual add-on.

Good at

Runs entirely locally, so your WhatsApp data never leaves your machine.
Fast search across years of message history, useful for surfacing old conversations.
Supports both read (search, contacts) and write (send messages) operations.
Works with groups and individuals, making it flexible for different messaging workflows.

Watch out

Requires running a local Go server, which adds setup complexity and a background process to manage.
No packaged install; you're cloning a repo and configuring manually.
WhatsApp's terms around automation are unclear, so stick to personal, low-volume use.
Server stability depends on WhatsApp Web staying connected; disconnects require manual restarts.

Use cases

personal message triage
group chat summaries
conversation search
outbound messaging

Getting started

1. Clone the repo with `git clone https://github.com/lharries/whatsapp-mcp.git` and follow the README to build and start the Go bridge server. 2. Add the MCP server to your Claude Desktop config, pointing to the local server endpoint (details in the repo's config examples). 3. Restart Claude Desktop and test by asking it to search your WhatsApp messages or list recent contacts. 4. Watch out for the Go server crashing if WhatsApp Web disconnects; you'll need to restart it manually. 5. Start small with read-only queries before automating outbound messages to avoid accidental spam.

Works with

Claude DesktopClaude CodeCursor