# Personal WhatsApp MCP for Claude, built directly on whatsmeow
**Category:** π¬ Communication
**Repository:** https://github.com/adelaidasofia/whatsapp-mcp
**Views:** 0
**Installs:** 0
**Upvotes:** 0
**Directory Page:** https://allmcps.com/mcp/personal-whatsapp-mcp-for-claude-built-directly-on-whatsmeow
## Description
Personal WhatsApp MCP for Claude, built directly on whatsmeow. Encrypted-at-rest storage, Whisperβ¦
## Claude Desktop Quick Installation
Heuristic fallback β verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low):
```json
"mcpServers": {
"personal-whatsapp-mcp-for-claude-built-directly-on-whatsmeow": {
"command": "npx",
"args": ["-y","personal-whatsapp-mcp-for-claude-built-directly-on-whatsmeow"]
}
}
```
## Documentation & README
# whatsapp-mcp
A WhatsApp MCP server for Claude, built directly on [whatsmeow](https://github.com/tulir/whatsmeow). Encrypted at rest, prompt-injection-scrubbed, draft-and-confirm on every send, full audit trail, daily CI security gates. Actively maintained.
## Why this one?
The most-starred WhatsApp MCP (`lharries/whatsapp-mcp`, 5.6K stars) is the architectural reference for this pattern, but has not shipped since July 2025 and leaves the [lethal-trifecta](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/) problem entirely to the user. This implementation closes the gaps:
| | Canonical | This implementation |
|---|---|---|
| Last shipped | July 2025 | Active |
| DB encryption | Plain SQLite | SQLCipher with key in the platform secret store (macOS Keychain / Windows Credential Manager / libsecret) |
| Prompt-injection scrubber | None | Every inbound message |
| Send safety | Fires immediately | Mandatory `confirm_send` between draft and delivery |
| Audit log | None | Every tool call, 30-day retention |
| Voice notes | Not transcribed | `whisper.cpp` local, Spanish-tuned default |
| LID alias resolution | Open issue cluster upstream | Shipped, with backfill migration for legacy threads |
| CI security | None | `govulncheck` + `pip-audit` + Dependabot, daily |
Not a fork. The Go bridge is built directly against `whatsmeow`; the Python MCP layer and SQLite schema are original. Other implementations (`lharries`, `LukasHaas`, `verygoodplugins`) were read as reference only.
## What this gives you
Claude can:
- Read your WhatsApp chats, messages, and contacts
- Search messages with accent-insensitive, typo-tolerant matching
- Transcribe voice notes locally via `whisper.cpp` (Spanish-tuned by default)
- Resolve LID (Linked IDentifier) names instead of numeric placeholders
- Send text messages, reactions, and reply-quotes, with a mandatory `confirm_send` step between draft and delivery
- Pull matching CRM context from your Obsidian vault when reading a chat
- See only prompt-injection-scrubbed message text, never raw adversarial input
Everything runs locally on your machine. No cloud sync. No telemetry. Optional OpenAI Whisper backend is opt-in, off by default.
## Architecture
Two components, both local:
- **`whatsapp-bridge/`** (Go). Binds to 127.0.0.1 only. Wraps `whatsmeow` for the WhatsApp Web multidevice protocol. Owns SQLite persistence with SQLCipher encryption. Handles QR and pairing-code auth (live-refreshing terminal QR with Windows-safe rendering, plus a headless auth API β `GET /api/auth/qr`, `POST /api/auth/pair-phone`, `POST /api/auth/reconnect` β so a GUI or supervisor can drive pairing without a terminal), media up/download, session recovery from `StreamReplaced` conflicts, call history capture. Exposes a REST API the Python MCP layer consumes.
- **`whatsapp-mcp-server/`** (Python, FastMCP). Consumes the Go bridge REST API. Exposes 11 MCP tools to Claude: full read surface (chats, messages, contacts), accent-insensitive search, presence (typing, online, mark-read), and text-send + reactions + reply-quotes with mandatory `confirm_send`. Runs via `uv` and stdio transport.
## Install
Open Claude Code, paste:
/plugin marketplace add adelaidasofia/whatsapp-mcp
/plugin install whatsapp-mcp@whatsapp-mcp
This installs the Python MCP server side. The Go bridge still needs the one-time QR pairing flow with your phone β see the legacy install block below for those steps.
Manual install (full Go bridge + QR pairing)
See [SETUP.md](SETUP.md) for step-by-step install per OS. In short:
1. Grab a prebuilt bridge binary from [Releases](../../releases/latest) (Windows/macOS/Linux β no compiler needed), or build from source (Go 1.24+ and a C toolchain)
2. Python 3.11+ and `uv` for the MCP server layer
3. Clone this repo; verify with `scripts/check_prerequisites.sh` (Windows: `scripts\check_prerequisites.ps1`)
4. Start the bridge: `./bin/whatsapp-bridge` (Windows: `.\bin\whatsapp-bridge.exe`)
5. Scan the QR (it refreshes in place β always scan the one on screen), or pair by typed code with `--pair-phone +15551234567`
6. Register the MCP in your Claude Code `.mcp.json`
7. Restart Claude Code
FFmpeg and whisper.cpp are only needed if you enable voice-note transcription (off by default).
## Configuration
All configurable via environment variables. See [.env.example](.env.example) for the full list.
Key variables:
| Variable | Default | Purpose |
|---|---|---|
| `WHATSAPP_BRIDGE_PORT` | `8080` | Go bridge REST API port |
| `WHATSAPP_DB_PATH` | `$HOME/.claude/whatsapp-mcp/store/messages.db` | Encrypted SQLite database |
| `WHATSAPP_MEDIA_PATH` | `$HOME/.claude/whatsapp-mcp/media/` | Media file storage |
| `WHATSAPP_VAULT_CRM_PATH` | empty | Absolute path to your vault CRM folder for auto-injection (e.g., Obsidian `π€ CRM/`). When unset, CRM injection is disabled. |
| `WHATSAPP_WHISPER_BACKEND` | `off` | `off` (zero-config boot), `local-cpp` (private, needs a whisper model), or `openai-api` (opt-in) |
| `WHATSAPP_WHISPER_API_KEY` | empty | Required only when backend is `openai-api` |
| `WHATSAPP_WHISPER_MODEL` | `large-v3` | whisper.cpp model name |
| `WHATSAPP_SCRUB_PROMPT_INJECTION` | `true` | Strip known prompt-injection patterns from incoming messages before Claude sees them |
| `WHATSAPP_AUDIT_LOG` | `true` | Log every tool call to `audit.log` |
| `WHATSAPP_ENCRYPT_DB` | `true` | Enable SQLCipher DB encryption; key in the platform secret store (macOS Keychain / Windows Credential Manager / libsecret) |
| `WHATSAPP_DB_KEY` | empty | Explicit 64-hex-char SQLCipher key override (skips the platform store). Escape hatch for headless/CI/custom secret managers, and the recovery path when the secret store cannot be read β see below |
### The DB key and `WHATSAPP_DB_KEY`
With `WHATSAPP_ENCRYPT_DB=true` (the default), the bridge encrypts the message
store with a 256-bit SQLCipher key kept in the platform secret store. The key
lifecycle is deliberately conservative, because a wrong key silently orphans
every stored message:
- A fresh key is minted **only** when the secret store definitively answers
"no such item" (macOS `errSecItemNotFound`, Windows `ERROR_NOT_FOUND`,
libsecret clean miss) **and** no non-empty store database exists yet.
- Any other failed read β locked keychain, no D-Bus session, revoked access β
makes the bridge exit with an error instead of minting: the key may still
exist, and overwriting it would make the encrypted store permanently
undecryptable. The error names the fix (e.g. `security unlock-keychain`).
- If the secret store has no key but a populated store database exists, the
bridge also refuses to mint and asks you to supply the original key.
`WHATSAPP_DB_KEY` (64 hex chars = 32 bytes, e.g. `openssl rand -hex 32`) is
the escape hatch for all of these: when set, it is used directly and the
platform secret store is never touched. Use it for headless/CI machines,
custom secret managers, restoring a store on a new machine, or booting while
the platform store is unavailable.
## Security
This MCP is the highest-trust component in your Claude stack because every WhatsApp message you receive flows through it. See [SECURITY.md](SECURITY.md) for the threat model, tool risk-tier classification, and the full list of hardening decisions.
Short version:
- Bridge binds to `127.0.0.1` only, never `0.0.0.0`
- SQLite encrypted at rest with SQLCipher; key stored in the platform secret store (macOS Keychain / Windows Credential Manager / libsecret), with an explicit `WHATSAPP_DB_KEY` escape hatch
- Every tool call logged to `audit.log` with 30-day retention
- Send tools require an explicit `confirm_send` step between draft and delivery
- Incoming message text passes through a prompt-injection scrubber before Claude sees it
- `whatsmeow` pinned to a specific commit; upgrades require diff review
- No telemetry, no external API calls by default
## Status
v0.1.0, actively maintained.
Shipped: live-refreshing QR (in-place redraw on rotation, Windows-safe rendering, auto fresh batch on expiry) + pairing-code auth (typed 8-char code, Android + iOS) + headless auth API for supervisors, full read surface (chats, messages, contacts), accent-insensitive NFD-normalized search, LID alias resolution with backfill migration for legacy threads, Baileys-store import for one-shot history migration, vault-format markdown export, local `whisper.cpp` voice transcription, presence (typing, online, mark-read), text-send with mandatory `confirm_send`, reactions, reply-quotes, prompt-injection scrubber, SQLCipher-encrypted persistence with macOS Keychain key handling, audit log, CI security gates.
Not yet shipped: media-send (image, document), audio-message-send (FFmpeg-Opus path), group broadcast helpers.
See [CHANGELOG.md](CHANGELOG.md) for full history.
## MCP Registry
Published on the [official MCP Registry](https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.adelaidasofia/whatsapp-mcp) under `io.github.adelaidasofia/whatsapp-mcp`. Two live channels:
- **`.mcpb` bundle** (canonical, recommended) β one-click install in Claude Desktop / Cursor / any [MCPB](https://github.com/modelcontextprotocol/mcpb)-aware client. Published as a GitHub release artifact at [releases/latest/download/whatsapp-mcp.mcpb](../../releases/latest/download/whatsapp-mcp.mcpb). The release manifest carries the SHA256 for tamper detection.
- **PyPI package** (`adelaidasofia-whatsapp-mcp`) β historical; available via `uvx adelaidasofia-whatsapp-mcp` for stdio-installer flows. The unprefixed names (`whatsapp-mcp`, `whatsapp-mcp-server`) are taken by unrelated projects on PyPI, hence the username-prefixed namespace.
The verification marker `mcp-name: io.github.adelaidasofia/whatsapp-mcp` is embedded in this README (HTML comment near the top) so the registry can verify package-to-server ownership at publish time.
**Publishing pipeline:** built and shipped via the Mycelium MCP publishing pipeline (two-phase: `.mcpb` bundle build, then `gh release` + `mcp-publisher publish`). The same pipeline produced all 16 sibling MCPs in this family.
## Related MCPs
Same author, same architecture pattern (FastMCP, draft+confirm on writes where applicable, vault auto-export, MIT):
- [slack-mcp](https://github.com/adelaidasofia/slack-mcp) β multi-workspace Slack
- [imessage-mcp](https://github.com/adelaidasofia/imessage-mcp) β macOS iMessage
- [google-workspace-mcp](https://github.com/adelaidasofia/google-workspace-mcp) β Gmail / Calendar / Drive / Docs / Sheets
- [apollo-mcp](https://github.com/adelaidasofia/apollo-mcp) β Apollo.io CRM + sequences
- [substack-mcp](https://github.com/adelaidasofia/substack-mcp) β Substack writing + analytics
- [luma-mcp](https://github.com/adelaidasofia/luma-mcp) β lu.ma events
- [parse-mcp](https://github.com/adelaidasofia/parse-mcp) β markitdown / Docling / LlamaParse router
- [rescuetime-mcp](https://github.com/adelaidasofia/rescuetime-mcp) β RescueTime productivity data
- [graph-query-mcp](https://github.com/adelaidasofia/graph-query-mcp) β vault knowledge graph queries
- [graph-autotagger-mcp](https://github.com/adelaidasofia/graph-autotagger-mcp) β wikilink suggestions from the graph
- [investor-relations-mcp](https://github.com/adelaidasofia/investor-relations-mcp) β seed-raise pipeline tracker
- [vault-sync-mcp](https://github.com/adelaidasofia/vault-sync-mcp) β bidirectional vault sync
## Telemetry
This plugin sends a single anonymous install signal to `myceliumai.co` the first time it loads in a Claude Code session on a given machine.
**What is sent:**
- Plugin name (e.g. `slack-mcp`)
- Plugin version (e.g. `0.1.0`)
**What is NOT sent:**
- No user identifiers, names, emails, tokens, or API keys
- No file paths, message content, or anything from your work
- No IP address is stored after dedup processing
**Why:** Helps the maintainer know which plugins people actually install, so attention goes to the ones that get used.
**Opt out:** Set the environment variable `MYCELIUM_NO_PING=1` before launching Claude Code. The hook will skip the network call entirely. Already-pinged installs leave a sentinel at `~/.mycelium/onboarded-` β delete it if you want to reset state.
## License
MIT. See [LICENSE](LICENSE).
## Not affiliated with WhatsApp or Meta
WhatsApp is a trademark of Meta Platforms, Inc. This project is an independent open-source tool that uses WhatsApp's public web-multidevice protocol. Use of this tool may violate WhatsApp's Terms of Service. Use at your own risk. The authors provide no warranty and accept no liability for account suspension, data loss, or other consequences.
---
Built by Mycelium AI. MIT license.