0
grade F
10 days ago
glama
WhatsApp MCP Stream
An MCP server that enables interaction with WhatsApp using the Baileys library and Streamable HTTP transport. It supports managing contacts, chats, and messages, while providing a web admin UI for QR code authentication and media handling.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
// key findings
🚨
Known vulnerabilities in dependencies: 2 critical, 11 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 2 credentials: REQUIRE_UPLOAD_TOKEN, UPLOAD_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from
process.env. You'll be asked to provide them before it can run.config
AUTO_DOWNLOAD_MAX_MBconfig
AUTO_DOWNLOAD_MEDIAconfig
AUTO_SELECT_CONTACTconfig
BAILEYS_LOG_LEVELconfig
DB_PATH— SESSION_DIR>/store.sqlite SQLite database path for chats/messages persistence.config
FFMPEG_PATHconfig
LOG_LEVELconfig
MCP_BASE_URLconfig
MCP_HTTP_ENABLE_JSON_RESPONSE— 1 Use direct JSON responses for Streamable HTTP POST requests by default. Set to 0 to force the older SSE-style POST response handling.config
MEDIA_DIR— Settings can be edited in the admin UI and are persisted to SETTINGS_PATH (defaults to /settings.json).config
MEDIA_PUBLIC_BASE_URLconfig
PUBLIC_BASE_URL🔐 secret
REQUIRE_UPLOAD_TOKENconfig
SESSION_DIR— DB_PATH <>/store.sqlite SQLite database path for chats/messages persistence.config
SETTINGS_PATH— Settings can be edited in the admin UI and are persisted to (defaults to MEDIA_DIR/settings.json).config
TRANSPORTconfig
UPLOAD_ENABLEDconfig
UPLOAD_MAX_FILESconfig
UPLOAD_MAX_MB🔐 secret
UPLOAD_TOKENconfig
WA_DISCONNECT_RECOVERY_DELAY_MS— 30000 How long to wait after a socket close before the disconnect watchdog forces reconnect/restart.config
WA_DISCONNECT_RECOVERY_RESTART_CODES— 428 Comma-separated disconnect status codes that should escalate straight to an internal restart watchdog.config
WA_EVENT_LOG— 0 Enable detailed WhatsApp event logs.config
WA_EVENT_STREAM— 0 Write raw Baileys event stream to a file for deep debugging.config
WA_EVENT_STREAM_PATH— /app/logs/wa-events.log File path for the event stream log.config
WA_IDEMPOTENCY_TTL_MS— 86400000 How long completed send_message idempotency records are retained in SQLite for safe retries.config
WA_MESSAGE_INDEX_MAX— 20000 Max in-memory entries for message index (jid:id -> raw message).config
WA_MESSAGE_KEY_INDEX_MAX— 20000 Max in-memory entries for message key index (id -> raw message).config
WA_READINESS_GRACE_MS— 180000 Grace period during recovery/disconnect before /healthz turns unhealthy.config
WA_RESYNC_RECONNECT— 1 Enable reconnect safety net after force resync.config
WA_RESYNC_RECONNECT_DELAY_MS— 15000 Delay before reconnect after force resync (ms).config
WA_SEND_DEDUP_WINDOW_MS— 45000 Suppress exact duplicate send_message requests to the same JID within this window.config
WA_SYNC_RECOVERY_COOLDOWN_MS— 300000 Minimum delay between automatic app-state recoveries.config
WA_SYNC_RECOVERY_WINDOW_MS— 900000 Time window used to count repeated app-state corruption failures.config
WA_SYNC_SOFT_RECOVERY_LIMIT— 2 Number of soft recoveries before escalating to an internal restart.// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[](https://m8ven.ai/mcp/loglux-whatsapp-mcp-stream-0ltxck)commit: 474c78830df9709ce399d2e1ccb73264bbda5163
code hash: b7deb431298af512d7d01bc80096d0c11eb08f8a27d123d541c5e93b7e0ca476
verified: 4/11/2026, 3:04:10 PM