Which integrations are available for this server?

Governs and automates WhatsApp messaging for AI agents with security controls such as recipient allowlisting, secret scanning, file validation, rate limiting, confirmation gate, and audit logging.

How do I use guarded-whatsapp-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@guarded-whatsapp-mcp Send 'Meeting at 3pm' to the engineering team." That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

guarded-whatsapp-mcp

by peter-tnc-453

Overview Schema Related Servers Score Discussions

Python

Hybrid

guarded-whatsapp-mcp

Govern & automate WhatsApp safely for AI agents.

An MCP server that lets an AI agent (or any MCP client) send WhatsApp messages and files — but only through a security gate you control: a recipient allowlist, secret scanning, file validation, rate limiting, a confirmation gate, and an append-only audit log.

Most WhatsApp bridges send anything, anywhere, with no record. That is fine for a human clicking send. It is not fine for an autonomous agent. guarded-whatsapp-mcp is the governance layer that makes agent-driven WhatsApp safe enough to trust.

This is not a Slack replacement. No channels, no threads, no workspace UI. It makes the WhatsApp you already use safe to automate.

See it in action

Related MCP server: whatsapp-mcp-server

How it works

⚠️ Read this first — unofficial transport & WhatsApp Terms

This server governs access to a transport; by default that transport is the unofficial whatsmeow-based bridge (e.g. whatsapp-mcp), which speaks WhatsApp Web's private protocol.

An unofficial client violates WhatsApp's Terms of Service and can get a number banned. A reverse-engineered client cannot avoid this.
Use a secondary / non-critical number. Never your primary or business-critical one.
Not for production customer messaging — use the official WhatsApp Business Cloud API. An official Cloud-API backend is on the roadmap; the guard layer is built to front either transport.

The guardrails here reduce operational risk (wrong recipient, leaked secret, spam). They do not change the Terms-of-Service risk of the underlying bridge. We are loud about this on purpose so you can choose with eyes open.

Why teams use it

Without a guard	With guarded-whatsapp-mcp
Agent can message any number it generates	Fail-closed allowlist — strangers are refused
A leaked API key sails out in a message	Secret scan blocks it before it sends
A runaway loop spams the team 200×	Rate limit caps it
Files arrive as `Untitled`; paths unchecked	ASCII-safe filenames + type/size checks
No idea what the agent sent	Append-only audit log of every attempt
Accidental sends	Confirmation gate — risky sends must be previewed

Security controls

Control	What it does
Recipient allowlist	Fail-closed. With `allow_unlisted: false`, only people/groups in your config can be messaged — even a raw number is refused.
Secret / PII scan	Text + captions scanned for API keys, private keys, cloud/Slack/GitHub/OpenAI tokens, JWTs, credit cards (Luhn), national IDs. `block` or `warn`.
File validation	Extension allowlist + size cap. Filenames sanitized to ASCII (no `Untitled`, no path traversal); copied to a safe name before sending.
Rate limiting	Sliding window (per-minute + per-hour) stops runaway loops.
Confirmation gate	Risky sends (unlisted / files / all) need a `confirm_token` from `wa_preview` — proof the send was previewed, not accidental.
Audit log	Every attempt (sent / blocked / failed) appended to `~/.guarded-whatsapp-mcp/audit.jsonl`, with body stored as preview + hash only.

Tools

Tool	Gated?	Purpose
`wa_list_recipients`	read-only	Show the allowlist (numbers masked).
`wa_preview`	read-only	Dry-run a send: run every check, return a verdict + `confirm_token` if needed. Sends nothing.
`wa_send_message`	send	Send text to an allowlisted recipient through the full gate.
`wa_send_file`	send	Send a file (auto ASCII-safe name, type/size checked, caption scanned).
`wa_audit_tail`	read-only	Recent audit records.

Quickstart

git clone https://github.com/peter-tnc-453/guarded-whatsapp-mcp
cd guarded-whatsapp-mcp

uv venv --python 3.11 && source .venv/bin/activate   # Python 3.10+
uv pip install -e .

cp config/allowlist.example.yaml config/allowlist.yaml   # edit your allowlist (git-ignored)

# a WhatsApp bridge exposing POST /api/send must be running (the authenticated session).
# whatsmeow bridge: https://github.com/lharries/whatsapp-mcp  (first run = QR scan)

python -m wa_guard          # run the MCP server (stdio)

Register with Claude Code / any MCP client

{
  "mcpServers": {
    "guarded-whatsapp-mcp": {
      "command": "/ABSOLUTE/PATH/guarded-whatsapp-mcp/.venv/bin/python",
      "args": ["-m", "wa_guard"],
      "env": {
        "PYTHONPATH": "/ABSOLUTE/PATH/guarded-whatsapp-mcp/src",
        "WA_GUARD_CONFIG": "/ABSOLUTE/PATH/guarded-whatsapp-mcp/config/allowlist.yaml"
      }
    }
  }
}

Example — a safe agent flow

// 1) The agent previews first (read-only, sends nothing)
wa_preview(recipient="Alex", file_path="report.pdf")
// → { ok:false, needs_confirm:true, confirm_token:"a1b2c3d4e5",
//     display_filename:"report.pdf", recipient:{ name:"Alex", allowlisted:true } }

// 2) It sends, passing the token back to prove the preview happened
wa_send_file(recipient="Alex", file_path="report.pdf", confirm_token="a1b2c3d4e5")
// → { sent:true, ... }   (and one line is appended to the audit log)

// A blocked attempt is explicit and recorded:
wa_send_message(recipient="+66999999999", message="hi")
// → { sent:false, blocked_reason:"recipient is not allowlisted and allow_unlisted=false" }

Configuration

See config/allowlist.example.yaml. Key knobs: allow_unlisted (the fail-closed switch), require_confirm_for, rate_limit, files, secrets.on_detect, and the recipients allowlist. Edits hot-reload on each call.

Roadmap

Pluggable backend — same guard layer in front of the unofficial bridge or the official WhatsApp Business Cloud API (compliant path).
Inbound routing — surface incoming messages to agents (read · classify · route).
Scheduled / templated sends through the same gate.
Per-recipient policy (rate limits / confirm rules per contact or group).

Tests

uv pip install pytest && PYTHONPATH=src python -m pytest -q   # 19 passing

Contributing

PRs welcome — see CONTRIBUTING.md. The one rule: keep the fail-closed posture, and add a test for every new check.

License

MIT — see LICENSE. Security model & honest limitations in SECURITY.md.

Available Tools

5 tools

wa_audit_tailA

Return the most recent send-attempt audit records (allowed, blocked, or failed). Read-only. Message bodies are stored as a short preview + hash only.

ParametersJSON Schema

Name	Required	Description	Default
`limit`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

States 'Read-only' and explains that message bodies are stored as preview+hash only. With no annotations, description effectively discloses safety and data constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences. Front-loaded with purpose. No redundant or extraneous text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, read-only nature, and data storage. However, lacks explanation for the 'limit' parameter, which is significant given its optionality and default. Output schema exists but parameter semantics are left unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'limit' has no schema description (0% coverage). The description does not mention or clarify the parameter, leaving the agent to assume its function.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb 'Return' and specific resource 'send-attempt audit records' with filtering by allowed/blocked/failed. Distinguishes from sibling tools (sending or listing recipients).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage for audit records but does not provide explicit when-to-use or alternatives. No guidance on when not to use this tool in favor of siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wa_list_recipientsA

List the allowlisted WhatsApp recipients this engine is permitted to message. Read-only. Numbers are masked. Use the returned name as the recipient argument to wa_preview / wa_send_message / wa_send_file.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility. It discloses that the tool is read-only and numbers are masked, which are key behavioral traits. It does not mention pagination or limits, but for a simple list tool with no parameters, this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words. The purpose is front-loaded, followed by safety info and cross-tool guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (0 parameters, output schema exists), the description covers everything needed: what it does, safety, and how to use the results with other tools. It is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, and schema coverage is 100% trivially. The description adds no param info but does explain the output's role, which indirectly aids parameter understanding for sibling tools. Baseline is 4 for no parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'List the allowlisted WhatsApp recipients this engine is permitted to message.' It uses specific verbs and resources, and the tool is distinct from siblings like wa_send_message.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description advises using the returned `name` as the `recipient` argument to other tools, providing clear usage context. However, it does not explicitly mention when not to use this tool or alternatives, though the sibling tools imply the workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wa_previewA

Dry-run a send: run every security check and report exactly what WOULD happen, WITHOUT sending. Returns a verdict and, when the send needs confirmation, a confirm_token to pass back to the send tool. Use this before any send you are unsure about.

ParametersJSON Schema

Name	Required	Description	Default
`message`	No
`file_path`	No
`recipient`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility. It discloses that the tool is a dry-run, non-destructive, and returns a verdict and confirm_token. It lacks details on side effects or idempotency, but overall provides sufficient transparency for its safe nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with only two sentences, well-structured, and front-loaded with the key purpose and usage advice. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool and the presence of an output schema, the description covers the main behavioral aspects and usage context. It could mention authentication or idempotency, but it is largely complete for its scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, meaning the description does not explain any parameters. It implicitly references 'recipient' but does not clarify the roles of 'message' and 'file_path', nor their constraints like mutual exclusivity or optionality. This is a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a dry-run for sending, performing security checks and reporting what would happen without actual sending. It specifically contrasts with the send tool, distinguishing its purpose well from siblings like wa_send_message.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises "Use this before any send you are unsure about," which provides clear guidance on when to use the tool. However, it does not explicitly state when not to use it or mention alternatives besides the send tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wa_send_fileA

Send a file to an allowlisted recipient. The filename is auto-sanitized to an ASCII-safe name (so WhatsApp shows a real name, not 'Untitled', and no path traversal is possible), the type/size are validated, and the caption is secret-scanned. Sending files may require a confirm_token (see wa_preview).

ParametersJSON Schema

Name	Required	Description	Default
`caption`	No
`file_path`	Yes
`recipient`	Yes
`confirm_token`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses key behaviors: auto-sanitization of filename, validation of type/size, secret scanning of caption, and potential need for confirm_token. These go beyond basic 'send file' but omit details like rate limits or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences with no redundancy. It front-loads the core action and adds key behavioral details efficiently, earning its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema (not shown) and no annotations, the description covers validation, sanitization, and token requirements. However, it lacks specifics on file size limits, supported types, or success/error outputs, leaving some context incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It indirectly explains file_path (auto-sanitized), caption (scanned), and confirm_token (from wa_preview), but does not clearly describe recipient format or confirm_token retrieval. Gaps remain for parameters like recipient and file_path expectations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Send a file to an allowlisted recipient', specifying the verb (send) and resource (file). The sibling tools (wa_send_message for text, wa_preview for preview, wa_list_recipients for listing, wa_audit_tail for audit) differentiate this tool's purpose of sending files, making it distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly guides usage by mentioning that a confirm_token may be required and referencing wa_preview, hinting at a workflow. However, it does not explicitly state when to use this tool over wa_send_message or provide exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

wa_send_messageA

Send a WhatsApp text message to an allowlisted recipient. Passes through the full security gate (allowlist, secret scan, rate limit, confirmation). If the result has needs_confirm=true, re-call with the returned confirm_token.

ParametersJSON Schema

Name	Required	Description	Default
`message`	Yes
`recipient`	Yes
`confirm_token`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

A4.3/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses the key behavioral aspects: passing through allowlist, secret scan, rate limit, and confirmation gates. It explains the conditional re-call pattern but omits details on error handling or specific rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The first sentence states the core action, the second adds critical workflow detail. Every word contributes to understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description adequately covers the main behavior but lacks details on the output schema's role (e.g., that it returns 'needs_confirm' and 'confirm_token'). It assumes knowledge of the security gate components without elaboration. For a tool with a confirmation workflow, more context would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It clarifies the 'confirm_token' parameter's role in the confirmation workflow. However, it does not specify the expected format for 'recipient' or any length constraints for 'message', leaving some ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific verb 'Send', the resource 'WhatsApp text message', and the constraint 'allowlisted recipient'. It effectively distinguishes from sibling tools like wa_send_file (sends files) and wa_preview (previews).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains the security gate and the two-step confirmation workflow involving 'needs_confirm' and 'confirm_token'. It lacks explicit alternatives for when not to use this tool, but the context is sufficient for appropriate selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.3/5.0

Disambiguation5/5

Each tool has a clearly distinct purpose: audit, list recipients, preview, send file, send message. No overlap or ambiguity.

Naming Consistency5/5

All tools follow a consistent 'wa_' prefix with verb_noun pattern in snake_case (e.g., wa_send_message, wa_list_recipients).

Tool Count5/5

Five tools is ideal for a focused WhatsApp messaging server, covering listing recipients, dry-run preview, sending text/files, and auditing.

Completeness5/5

The tool surface fully covers the core workflow: recipient management, security preview, dual send methods, and audit trail. No obvious gaps.

Maintenance

ActivityStale

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

kontato A
ai.kontato
Give your AI agents a real WhatsApp number to send and receive messages.
Communication Autonomous Agents
92
agentlock
io.github.Olum289
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Security Agent Orchestration
2
DripRaven WhatsApp campaigns
com.dripraven
Run WhatsApp Business campaigns from any AI assistant: contacts, segments, and broadcasts.
Communication Marketing
1
IdentArk Gateway
io.identark
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
Security Agent Orchestration
29

Related MCP Servers

WhatsApp Cloud API MCP Server
Communication App Automation Customer Support
mmarqueti
F
license
Not graded
quality
C
maintenance
Enables AI agents to send WhatsApp messages, templates, and retrieve media through the WhatsApp Cloud API. Provides webhook handling and seamless integration with Meta's WhatsApp Business platform.
Updated 2 months ago (2026-07-14 20:22 UTC)
23
whatsapp-mcp-server
Communication App Automation Customer Support
FredShred7
A
license
A
quality
D
maintenance
Connects AI assistants to the official Meta WhatsApp Cloud API for managing conversations and sending various message types through natural language. It provides tools for media management, template messages, and real-time webhook processing without the risk of account bans.
Updated 3 months ago (2026-06-07 00:59 UTC)
18
47
23
MIT
WhatsApp MCP Server
Communication Social Media
Malaccamaxgit
A
license
Not graded
quality
C
maintenance
Integrates WhatsApp with AI agents, enabling message sending, chat search, media sharing, approval workflows, and activity summaries via any MCP client.
Updated 23 days ago (2026-08-11 17:27 UTC)
1
Apache 2.0
Meta Business MCP
Communication Legal & Compliance
metabusiness-mcp
F
license
Not graded
quality
C
maintenance
Compliance intelligence layer for AI agents sending WhatsApp Business messages. Prevents account suspensions by validating Meta's rules (care windows, opt-outs, rate limits) in real-time before every send.
Updated 2 months ago (2026-07-01 07:31 UTC)
1

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/peter-tnc-453/guarded-whatsapp-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server