MCP server · Org-owned · Audited from source

WAHA MCP server

by devlikeapro/wahaApache-2.0 licenceAudited 28 Oct 2026 · source 9637a47f3e5d

npm waha 0.0.1streamable-http★ 7,702

✕BLOCKGrade F · 41/100 · 28 Oct 2026 · 9637a47

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (41/100). It exposes 1 tool: 1 read, 0 write and 0 destructive. The audit recorded 52 findings (0 critical, 13 high, 10 medium, 23 low). Maintainer's description: WAHA - WhatsApp HTTP API (REST API) that you can configure in a click! Multiple engines: WEBJS (browser based), NOWEB (websocket nodejs), GOWS (websocket go), WPP (browser)

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “WAHA MCP server (devlikeapro/waha)”. Retrieved 28 Oct 2026. https://modelsatlas.com/mcp/devlikeapro/waha-2

Why this is BLOCK. The audit found 0 critical and 13 high findings; the most severe is Code injection at src/core/engines/gows/grpc/gows_pb.js:21. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 28 Oct 2026

Trust score41/100✕BLOCK F

0 critical13 high10 medium23 low6 info

52 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared11 observations
NetworkDeclared7 observations
ShellDeclared8 observations
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (52)

Sorted by severity · the 25 most severe of 52 are listed

HIGHCode injectioncode.eval_exec · src/core/engines/gows/grpc/gows_pb.js:21

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

return Function('return this')();

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · src/core/engines/webjs/_lodash.js:691

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

var root = freeGlobal || freeSelf || Function('return this')();

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · src/core/engines/webjs/_lodash.js:15979

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

'function(' +

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHFilesystem / pathfs.credential_store · Makefile:25

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

ssh-add ~/.ssh/id_rsa && \

Why: touches a credential store
Fix: —

HIGHNetwork egressnet.tls_off · src/core/storage/psql/PsqlConnectionConfig.ts:27

F-04 Network egressCWE-200 · CWE-319Layer L1

? { rejectUnauthorized: false }

Why: certificate verification is disabled
Fix: leave verification on

HIGHNetwork egressnet.tls_off · src/modules/waha-webhook/WebhookPlugin.sender.ts:46

F-04 Network egressCWE-200 · CWE-319Layer L1

https: new HttpsAgent({ rejectUnauthorized: false }),

Why: certificate verification is disabled
Fix: leave verification on

HIGHNetwork egressnet.tls_off · src/utils/fetch.ts:7

F-04 Network egressCWE-200 · CWE-319Layer L1

rejectUnauthorized: false,

Why: certificate verification is disabled
Fix: leave verification on

HIGHObfuscation / stealthobf.rtl_override · src/nestjs/validation/IsGroupMemberTag.ts:4

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const FORBIDDEN_CHARS = /[·@#$%/~\\\p{Cc}---]/u;

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · .env.example:107

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · .env.example:113

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · .env.example:116

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · Makefile:109

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · docker-compose/chatwoot/.waha.env:89

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · docker-compose/chatwoot/.chatwoot.env:16

F-04 Network egressCWE-200 · CWE-319Layer L1

# HELPCENTER_URL=http://0.0.0.0:3000

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · src/structures/files.dto.ts:47

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

'/9j/4AAQSkZJRgABAQAAAQABAAD//gAfQ29tcHJlc3NlZCBieSBqcGVnLXJlY29tcHJlc3P/2wCEAAQEBAQEBAQEBAQGBgUGBggHBwcHCAwJCQkJCQwTDA4MDA4MExEUEA8QFBEeFxUVFx4iHRsdIiolJSo0MjRERFwBBAQEBAQEBAQEBAYGBQYGCAcHBwcIDAkJCQk

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · src/structures/files.dto.ts:66

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

'SUQzBAAAAAAAI1RTU0UAAAAPAAADTGF2ZjU4Ljc2LjEwMAAAAAAAAAAAAAAA//NkxAAW0D4AVN4YAAYAKqTsSE2Z0IlkQMKANEGBUWH7a99t8eFgGQqfrfJxAsocfid8uizPyg535NQgTSs/z6xwJlJc/XKOE8uQtJsTP7ym4u/ky78nQzJw+t+4TvEiw/UftU4TymU

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · src/structures/files.dto.ts:99

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

'AAAAGGZ0eXBtcDQyAAAAAGlzb21tcDQyAAAHEW1vb3YAAABsbXZoZAAAAADgAUTa4AFE2gAAdTAAAHe6AAEAAAEAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAANzdHJhawA

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · src/structures/files.dto.ts:147

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

'/9j/4AAQSkZJRgABAQAAAQABAAD//gAfQ29tcHJlc3NlZCBieSBqcGVnLXJlY29tcHJlc3P/2wCEAAQEBAQEBAQEBAQGBgUGBggHBwcHCAwJCQkJCQwTDA4MDA4MExEUEA8QFBEeFxUVFx4iHRsdIiolJSo0MjRERFwBBAQEBAQEBAQEBAYGBQYGCAcHBwcIDAkJCQk

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · src/apps/chatwoot/i18n/locales/fa-IR.yaml:6

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

# WAHA از آن برای نمایش اعداد، ارز و تاریخ/زمان استفاده میکند

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · src/apps/chatwoot/i18n/locales/fa-IR.yaml:12

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

# گزینههای "options" از date.toLocaleString

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · src/apps/chatwoot/i18n/locales/fa-IR.yaml:49

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

✅ **موفقیتآمیز**

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · src/apps/chatwoot/i18n/locales/fa-IR.yaml:53

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

whatsapp.message.sending.error: ارسال پیام در واتساپ امکانپذیر نبود.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.zero_width · src/apps/chatwoot/i18n/locales/fa-IR.yaml:54

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

whatsapp.message.receiving.error: دریافت پیام از واتساپ امکانپذیر نبود

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.binary · examples/dev.likeapro.opus

F-13 Inventory / provenanceCWE-1104Layer L0

dev.likeapro.opus

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

LOWInventory / provenanceinv.binary · examples/excel.xlsx

F-13 Inventory / provenanceCWE-1104Layer L0

excel.xlsx

Why: a compiled or binary member cannot be reviewed from source
Fix: ship source, or explain the binary in the README

Tools it exposes

1 declared in source · 0 destructive

1 read0 write0 destructive

Tool	What it does	Risk
`id`	Channel id or invite code	read

Safer alternatives

All chat & email servers →

WhatsApp✓SAFE

lharries/whatsapp-mcp

WhatsApp MCP server

3 writeGrade B

Whatsapp✓SAFE

jlucaso1/whatsapp-mcp-ts

WhatsApp MCP Server (TypeScript/Baileys)

1 writeGrade B

WWeb✓SAFE

pnizer/wweb-mcp

WhatsApp Web MCP Server

5 writeGrade B

Audit history

2026-10-28
✕BLOCK F 41 / 100
First audit · 9637a47f3e5d

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about WAHA MCP server

What is the WAHA MCP server?

WAHA - WhatsApp HTTP API (REST API) that you can configure in a click! Multiple engines: WEBJS (browser based), NOWEB (websocket nodejs), GOWS (websocket go), WPP (browser)

What tools does WAHA expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is WAHA safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (41/100) and found 13 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does WAHA need?

It reads WAHA_API_KEY, WAHA_DASHBOARD_NO_PASSWORD, WAHA_HTTPS_PATH_KEY, WAHA_NO_API_KEY, WHATSAPP_API_KEY and WHATSAPP_SWAGGER_NO_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does WAHA run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as waha at 0.0.1.

How current is this page?

The grade is for one exact copy of the source (9637a47f3e5d), read on 2026-10-28. The repository is watched and re-audited when it changes.

I already installed WAHA. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

devlikeapro/waha on GitHub — the source we read, its licence, stars and activityObserved · 28 Oct 2026
ModelsAtlas trust audit — BLOCK verdict for commit 9637a47f3e5dObserved · 28 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the WAHA MCP server?
GChatGPT CClaude PPerplexity
What tools does WAHA expose?
GChatGPT CClaude PPerplexity
Is WAHA safe to connect to an agent?
GChatGPT CClaude PPerplexity