Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

WhatsApp MCP server

by lharries/whatsapp-mcpMIT licenceAudited 21 Sep 2026 · source b3c2312ef81a

PyPI whatsapp-mcp-serverstdio★ 6,292
✓SAFEGrade B · 89/100 · 21 Sep 2026 · b3c2312
6,292GitHub stars
InstallView source on GitHub ↗

Is it safe? Yes — SAFE, grade B (89/100). It exposes 12 tools: 9 read, 3 write and 0 destructive. The audit recorded 2 findings (0 critical, 0 high, 0 medium, 1 low). Maintainer's description: WhatsApp MCP server

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “WhatsApp MCP server (lharries/whatsapp-mcp)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/lharries/whatsapp-3

5 MCP servers are called WhatsApp. You are viewing lharries/whatsapp-mcp. Compare all 5 →

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium1 low1 info

2 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemNone observedNothing seen in the source
  • NetworkDeclared5 observations
  • ShellNone observedNothing seen in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

LayerWhat we checkResult
L0 ProvenanceRepo owner, licence, archive status, activityPASS 1 finding
L1 Static sourceSecrets, path traversal, supply chainPASS
L2 InstructionsPrompt injection and authority framing in docs and tool descriptionsPASS 1 finding
L3 InventoryDeclared tools match the sourcePASS
L4 SandboxRun in isolation and watch behaviourSKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

  • Repository owner lharriesUser accountAccount type recorded when we read the repository.
  • PackagePublished on PyPIwhatsapp-mcp-server, no version recorded
  • LicenceMITFrom the repository, as read at the audited commit.
  • Last push14 months agoActivity of the repository when we read it.
  • Source commit readb3c2312ef81aThe audit covers exactly this commit, read on 21 Sep 2026.

Runtime

  • Sandbox runNot run yetThis audit read the source only; it did not execute the server.
  • Tool inventory12 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (2)

Sorted by severity

LOWSupply chainprompt.pipe_to_shell · README.md:24
F-08 Supply chainCWE-829 · CWE-1357Layer L2
- UV (Python package manager), install with `curl -LsSf https://astral.sh/uv/install.sh | sh`
Why
No further detail recorded for this rule.
Fix
—
INFOInventory / provenanceinv.oversize · example-use.png
F-13 Inventory / provenanceCWE-1104Layer L0
example-use.png
Why
3149200 bytes not read
Fix
—

Tools it exposes

12 declared in source · 0 destructive

9 read3 write0 destructive
ToolRiskWhat it does
send_audio_messagewriteSend any audio file as a WhatsApp audio message to the specified recipient. For group messages use the JID. If it errors due to ffmpeg not being installed, use send_file instead.
send_filewriteSend a file such as a picture, raw audio, video or document via WhatsApp to the specified recipient. For group messages use the JID.
send_messagewriteSend a WhatsApp message to a person or group. For group chats use the JID.
download_mediareadDownload media from a WhatsApp message and get the local file path.
get_chatreadGet WhatsApp chat metadata by JID.
get_contact_chatsreadGet all WhatsApp chats involving the contact.
get_direct_chat_by_contactreadGet WhatsApp chat metadata by sender phone number.
get_last_interactionreadGet most recent WhatsApp message involving the contact.
get_message_contextreadGet context around a specific WhatsApp message.
list_chatsreadGet WhatsApp chats matching specified criteria.
list_messagesreadGet WhatsApp messages matching specified criteria with optional context.
search_contactsreadSearch WhatsApp contacts by name or phone number.

Install

audited commit b3c2312

Add to CursorAdd to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it. The audit covers commit b3c2312 only.

claude mcp add whatsapp-mcp-server -- uvx whatsapp-mcp-server

The command does not pin a version; the audit covers commit b3c2312ef81a. Transport: stdio. No environment variables required.

Audit history

  1. ✓SAFE B 89 / 100

    Source changed, verdict held · b3c2312ef81a

README badge

For maintainers · updates on every re-audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B 
[![ModelsAtlas: SAFE B](https://modelsatlas.com/mcp/lharries/whatsapp-3/badge.svg)](https://modelsatlas.com/mcp/lharries/whatsapp-3/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about WhatsApp MCP server

What is the WhatsApp MCP server?
WhatsApp MCP server
What tools does WhatsApp expose?
12 in total: 9 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is WhatsApp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does WhatsApp need?
No credential environment variables were found in its source, so it appears to need none.
How does WhatsApp run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as whatsapp-mcp-server.
How current is this page?
The grade is for one exact copy of the source (b3c2312ef81a), read on 2026-09-21. The repository is watched and re-audited when it changes.
Which WhatsApp MCP server is the right one?
verygoodplugins/whatsapp-mcp. 5 servers share the name; see the side-by-side comparison.

Sources

  • lharries/whatsapp-mcp on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
  • ModelsAtlas trust audit — SAFE verdict for commit b3c2312ef81aObserved · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.