Whatsapp (kahflane) MCP Server
@kahflane/whatsapp-mcp
npm
v0.2.3
Published by @kahflane — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
WhatsApp MCP server built on the innovatorssoft Baileys fork + the Anthropic Model Context Protocol SDK. Runs on Node or Bun.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 2
high Shell/command execution in server code (dist/index.js)MTC-SRC-002
In the server's implementation (`dist/index.js:34`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: return stmt; }, exec(sql) { raw.exec(sql); }, close() { raw.close(); } }; } // src/st
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/index.js
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([wa_download_media, wa_fetch_history, wa_group_info_by_code, wa_groups_list, wa_get_privacy, wa_get_status, wa_get_picture_url, wa_get_business_profile, wa_broadcast_info]) co-exist with external-action tools ([wa_forward_message]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [wa_download_media, wa_fetch_history, wa_group_info_by_code, wa_groups_list, wa_get_privacy, wa_get_status, wa_get_picture_url, wa_get_business_profil
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow wa_download_media → wa_forward_message
Tools 87
Each tool and what it can reach — statically extracted from the published source.
wa_broadcast_infoingests untrusted inputwa_download_mediaingests untrusted inputwa_fetch_historyingests untrusted inputwa_forward_messagenetwork egresswa_get_business_profileingests untrusted inputwa_get_picture_urlingests untrusted inputwa_get_privacyingests untrusted inputwa_get_statusingests untrusted inputwa_group_info_by_codeingests untrusted inputwa_groups_listingests untrusted input
Show 77 more tools ↓
wa_archive_chatno sensitive capabilitywa_autoreply_add_ruleno sensitive capabilitywa_autoreply_list_rulesno sensitive capabilitywa_autoreply_remove_ruleno sensitive capabilitywa_autoreply_setno sensitive capabilitywa_blockno sensitive capabilitywa_blocklistno sensitive capabilitywa_cancel_scheduledno sensitive capabilitywa_check_numberno sensitive capabilitywa_create_groupno sensitive capabilitywa_create_templateno sensitive capabilitywa_default_disappearingno sensitive capabilitywa_delete_chatno sensitive capabilitywa_delete_messageno sensitive capabilitywa_delete_message_for_meno sensitive capabilitywa_disappearing_chatno sensitive capabilitywa_edit_messageno sensitive capabilitywa_get_group_membersno sensitive capabilitywa_get_login_qrno sensitive capabilitywa_get_messagesno sensitive capabilitywa_get_pairing_codeno sensitive capabilitywa_get_poll_votesno sensitive capabilitywa_get_unreadno sensitive capabilitywa_group_add_modeno sensitive capabilitywa_group_ephemeralno sensitive capabilitywa_group_invite_codeno sensitive capabilitywa_group_joinno sensitive capabilitywa_group_join_decisionno sensitive capabilitywa_group_join_requestsno sensitive capabilitywa_group_leaveno sensitive capabilitywa_group_member_labelno sensitive capabilitywa_group_metadatano sensitive capabilitywa_group_participantsno sensitive capabilitywa_group_settingno sensitive capabilitywa_group_update_descriptionno sensitive capabilitywa_group_update_subjectno sensitive capabilitywa_history_statusno sensitive capabilitywa_list_chatsno sensitive capabilitywa_list_contactsno sensitive capabilitywa_list_scheduledno sensitive capabilitywa_list_templatesno sensitive capabilitywa_logoutno sensitive capabilitywa_mark_chat_readno sensitive capabilitywa_mark_readno sensitive capabilitywa_mute_chatno sensitive capabilitywa_pin_chatno sensitive capabilitywa_pin_messageno sensitive capabilitywa_post_statusno sensitive capabilitywa_post_status_tono sensitive capabilitywa_reactno sensitive capabilitywa_reject_callno sensitive capabilitywa_remove_pictureno sensitive capabilitywa_render_templateno sensitive capabilitywa_resolve_nameno sensitive capabilitywa_restrict_sendingno sensitive capabilitywa_schedule_messageno sensitive capabilitywa_search_messagesno sensitive capabilitywa_send_broadcastno sensitive capabilitywa_send_buttonsno sensitive capabilitywa_send_contactno sensitive capabilitywa_send_eventno sensitive capabilitywa_send_listno sensitive capabilitywa_send_locationno sensitive capabilitywa_send_mediano sensitive capabilitywa_send_orderno sensitive capabilitywa_send_pollno sensitive capabilitywa_send_presenceno sensitive capabilitywa_send_productno sensitive capabilitywa_send_templateno sensitive capabilitywa_send_textno sensitive capabilitywa_set_nameno sensitive capabilitywa_set_pictureno sensitive capabilitywa_set_privacyno sensitive capabilitywa_set_statusno sensitive capabilitywa_star_messageno sensitive capabilitywa_statusno sensitive capabilitywa_subscribe_presenceno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (87 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.2.3 latest |
A 93/100 | 2 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @kahflane/whatsapp-mcp --onlineOther implementations of Whatsapp 11
Independent packages implementing the same tool, scanned with the same engine. Compare all 12 side by side →
WhatsApp MCP Server: Human-in-the-loop for AI agents via WhatsApp for confirmations, notifications, and interactive questions.
Least-privilege, send-only MCP server for WhatsApp. Exposes two send tools (text + approved template) backed by Meta's official WhatsApp Cloud API. No reading, listing, contacts, media, or inbound handling.
MCP server for whatsapp API integration
WhatsApp MCP Server
MCP server for WhatsApp integration
Security-hardened WhatsApp MCP server built with Baileys
More in Marketing & Social
Official Abyssfall game info, newsletter double opt-in, and merch reservation tools.
AdCritter ads platform: docs, API reference, app scaffolding, and white-label integration.
Google AdSense MCP Server - Monitor earnings, reports, and account health via Claude/AI
Operational empathy for technical founders + PE/VC operators navigating high-stakes B2B interactions. 28 MCP tools + CLI: ICP scoring, persona simulation, battlecards, deal classification, prospect discovery, investor matching, founder wellness, plus mark
MCP server for Bing Webmaster Tools — SEO site management, URL submission, sitemaps, stats, keywords
MCP (Model Context Protocol) server that helps AI agents use Primer Brand (@primer/react-brand) correctly when building GitHub marketing and landing pages.