Back to MCP Trust Indexm8ven
38
/ 100
1 month ago
glama

whatsapp-local-mcp

Enables Claude to read and search WhatsApp messages, transcribe voice notes, and analyze images locally through a read-only bridge.

→ AIBE13/whatsapp-local-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Tool descriptions don’t match what handlers do
6 tools describe read intent but their handlers mutate — list_chats (line 61: spawn(process.execPath, [bridgePath], {); get_recent_messages (line 61: spawn(process.execPath, [bridgePath], {); search_messages (line 61: spawn(process.execPath, [bridgePath], {)
🚨
Known vulnerabilities in dependencies: 1 critical, 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: OPENAI_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 critical2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

critical@whiskeysockets/baileys@6.7.9GHSA-qvv5-jq5g-4cgg

Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

high@modelcontextprotocol/sdk@1.0.4GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.0.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretOPENAI_API_KEY— (none) Used by Whisper. Falls back to api-key.txt in repo root.
configWHATSAPP_BRIDGE_PORT— 8765 Local HTTP port the bridge listens on
configWHATSAPP_HISTORY_DAYS— 30 Drop history-sync messages older than this many days
configWHATSAPP_STALE_MS— 180000 Force reconnect if no socket activity in this long
configWHATSAPP_TRANSCRIBE_HOURS
configWHATSAPP_VOICE_MAX_SECONDS— 300 Skip voice notes longer than this when transcribing
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/aibe13-whatsapp-local-mcp-11shya)](https://m8ven.ai/mcp/aibe13-whatsapp-local-mcp-11shya)
commit: 3b76a82f8ec911714c8392c7a617950f9f088904
code hash: 5d5c1d4509ea6d1f9d36c1c2c0bac8872e2a45ffa298c55257053e1d6fa0bbc4
verified: 6/30/2026, 9:49:31 AM
view raw JSON →