Wechat ServerSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
基于 MCP(Model Context Protocol)的微信机器人服务器,让任何 AI Agent 都能收发微信消息。
功能
- 6 个 MCP 工具:登录、消息轮询、文本发送、打字状态
- 扫码登录:生成终端文本二维码、PNG 图片、URL 链接三种方式
- 长轮询监听:阻塞等待新消息,最长可等待 7 天
- 打字状态:Agent 处理消息时自动显示"对方正在输入..."
- 状态持久化:重启不丢失登录凭证和消息游标
- 独立运行:无需 OpenClaw 框架,开箱即用
快速开始
Claude Desktop
在 claude_desktop_config.json 中添加:
{
"mcpServers": {
"wechat": {
"command": "bunx",
"args": ["mcp-wechat-server"]
}
}
}OpenCode
在 opencode.json 中添加:
{
"mcp": {
"wechat": {
"type": "local",
"command": ["bunx", "mcp-wechat-server"],
"enabled": true
}
}
}Cursor / 其他 MCP 客户端
{
"command": "bunx",
"args": ["mcp-wechat-server"]
}bunx 会自动从 npm 下载并运行,无需手动安装。环境要求
- Bun >= 1.0.0
使用方法
1. 扫码登录
AI Agent 调用 login_qrcode 生成二维码,你可以通过以下方式扫码:
- 在终端运行
cat ~/.mcp-wechat-server/qrcode.txt查看二维码 - 打开图片文件
~/.mcp-wechat-server/qrcode.png - 将链接复制到微信中打开
提示:如果手机扫码后页面一直加载,请切换到移动数据网络(关闭 WiFi)。
2. 确认登录
Agent 调用 check_qrcode_status 确认登录状态。
3. 开始聊天
登录成功后,Agent 会自动执行以下流程:
- 调用
get_messages轮询新消息 - 收到消息后调用
send_typing显示"正在输入..." - 处理完成后调用
send_text_message回复 - 回复完毕后调用
send_typing取消打字状态
工具列表
数据存储
所有数据保存在 ~/.mcp-wechat-server/ 目录下:
afbdcd56cb7eOBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-wechat-server -- npx -y [email protected]
{
"mcpServers": {
"mcp-wechat-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (6)
3 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
check_qrcode_status | read | Check if the QR code (from login_qrcode) has been scanned and confirmed. Call this repeatedly until status is |
get_messages | read | |
login_qrcode | read | Get a WeChat login QR code. Scan it with WeChat to connect the bot. Returns the QR code URL. Call check_qrcode_status afterwards to verify. |
logout | destructive | Log out the current WeChat bot session and clear all saved credentials. |
send_text_message | write | Send a text message to a WeChat user. The |
send_typing | write | Send or cancel a typing indicator to a WeChat user. The |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- UNDECLARED (1 observation(s))
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (3)
logout
@modelcontextprotocol/sdk, qrcode, zod
Gates applied: no_behavioural_pass, no_license.
afbdcd56cb7efull audit observations/trust-audit/mcp-server/howardzhangdqs__wechat-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | afbdcd56cb7e | SAFE | B | 89 | first audit |
Questions
What tools does Wechat Server expose?
6 in total: 3 read-only, 2 that write, and 1 that can delete or overwrite (logout). Every one is listed on this page with its risk.
Is Wechat Server safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Wechat Server need?
No credential environment variables were found in its source, so it appears to need none.
How does Wechat Server run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-wechat-server at 1.0.1.
How current is this page?
The grade is for one exact copy of the source (afbdcd56cb7e), read on 2026-10-07. The repository is watched and re-audited when it changes.