wecom-msg-audit-mcp

Item: wecom-msg-audit-mcp
Rating: 69
Author: M8ven

Enables AI agents to securely access and search enterprise WeChat (WeCom) chat records with full decryption and auditing, supporting message retrieval, decryption, local storage, and querying via MCP tools.

→ deadmau5v/wecom-msg-audit-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 4 credentials: R2_S3_KEY, MSGAUDIT_SECRET, EXTERNAL_CONTACT_SECRET, PROXY_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configMCP_TRANSPORT— http MCP_PORT=8331 uv run python mcp_server.py

configMCP_HOST— / MCP_PORT ⬜ HTTP 模式监听地址，默认 127.0.0.1:8331

configMCP_PORT— MCP_TRANSPORT=http =8331 uv run python mcp_server.py

configR2_ENDPOINT— ⬜ Cloudflare R2 端点，例：https://xxx.r2.cloudflarestorage.com/<bucket>

configR2_BUCKET— ⬜ R2 存储桶（若已包含在 endpoint 路径中可省略）

configR2_CUSTOM_DOMAIN— ⬜ 自定义访问域名（用于预签名 URL 替换）

configR2_S3_ID— / R2_S3_KEY ⬜ R2 S3 兼容 AccessKey

🔐 secretR2_S3_KEY— R2_S3_ID / ⬜ R2 S3 兼容 AccessKey

configCORP_ID— ✅ 企业 ID（我的企业 → 企业信息）

🔐 secretMSGAUDIT_SECRET— ✅ 会话内容存档 Secret（不是普通应用 Secret）

🔐 secretEXTERNAL_CONTACT_SECRET— ⬜ 客户联系可调用应用 Secret（用于外部客户群）

configSDK_LIB_PATH— 将官方 SDK 文件 libWeWorkFinanceSdk_C.so 放置到项目根目录（或在 .env 中自定义）。

configPRIVATE_KEY_PATH— ⬜ RSA 私钥路径，默认 ./private_key.pem

configSEQ_FILE— ⬜ seq 进度文件，默认 ./wecom_msg_seq.txt

configOUTPUT_JSONL— ⬜ 解密消息输出文件，默认 ./wecom_messages.jsonl

configFETCH_LIMIT— ⬜ 单次拉取条数，1-1000，默认 100

configSDK_TIMEOUT— ⬜ SDK 请求超时（秒），默认 30

configPROXY— / PROXY_PASSWORD ⬜ 代理与代理密码（按需）

🔐 secretPROXY_PASSWORD— PROXY / ⬜ 代理与代理密码（按需）

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/deadmau5v-wecom-msg-audit-mcp-1am8at)](https://m8ven.ai/mcp/deadmau5v-wecom-msg-audit-mcp-1am8at)

commit: 4624f4b87412ad46922131bfaa58d006bde915e3

code hash: 914d98e7df5ab9e7c5ebe7474115c734bd698ca516684bc43dffcf72cd043041

verified: 6/30/2026, 9:50:40 AM

view raw JSON →