whatsapp-llm-bot (madacol/whatsapp-llm-bot) is an MCP server listed on the M8ven Trust Index. M8ven has not graded it yet. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
C
Caution
62/100

whatsapp-llm-bot

→ madacol/whatsapp-llm-bot· listed on github_code

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

madacol

Source: github_code

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 7 credentials: API_TRANSPORT_TOKEN, BRAVE_API_KEY, FAL_KEY, GEMINI_API_KEY, LLM_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies3 high8 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@earendil-works/pi-coding-agent@0.75.5GHSA-jfgx-wxx8-mp94

Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts

highnodemailer@8.0.1GHSA-p6gq-j5cr-w38f

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

highsharp@0.34.5GHSA-f88m-g3jw-g9cj

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

low@earendil-works/pi-coding-agent@0.75.5GHSA-7v5m-pr3q-6453

Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

low@earendil-works/pi-coding-agent@0.75.5GHSA-mqxh-6gq7-558m

Pi Agent: Pi loads project-local extensions without approval

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configALERT_EMAIL
configAPI_TRANSPORT_HOST
configAPI_TRANSPORT_PORT
🔐 secretAPI_TRANSPORT_TOKENIt is disabled by default. Set to enable it:
configAUDIO_TO_TEXT_MODEL
configBASE_URL
🔐 secretBRAVE_API_KEY
configCHAT_DIR
configCODING_MODEL
configDEFAULT_HARNESS
configEMBEDDING_MODEL
🔐 secretFAL_KEY
configFAST_MODEL
🔐 secretGEMINI_API_KEY
configIMAGE_TO_TEXT_MODEL
configINVOCATION_ID
🔐 secretLLM_API_KEY
configLOG_LEVEL
configMADABOT_AGENT_WORKER_UNIT_NAME
configMADABOT_DEFAULT_HARNESS
configMADABOT_DIAGNOSTICS_CAPTURE_DIR
configMADABOT_DIAGNOSTICS_CONFIG_PATH
configMADABOT_OUTBOUND_QUEUE_PERSIST_DELAY_MS
configMADABOT_OUTBOUND_QUEUE_REPLAY_DELAY_MS
configMASTER_ID
configMEDIA_TO_TEXT_MODEL
configMEMORY_THRESHOLD
configMODEL
🔐 secretOPENAI_API_KEY
🔐 secretOPENROUTER_API_KEY
configPI_ACP_MCP_CONFIG_FD
configRUNTIME_DIRECTORY
configSMART_MODEL
configSYSTEM_PROMPT
configTESTING
configVIDEO_MODEL
configVIDEO_TO_TEXT_MODEL
configWEB_AUDIO_API_TARGET
configWEB_AUDIO_HOST
configWEB_AUDIO_PORT
configWHATSAPP_LLM_BOT_TEST_MEDIA_ROOT
configWHATSAPP_LLM_BOT_TEST_TEMP_ROOT
configWORKBENCH_API_TARGET
configWORKBENCH_HOST
configWORKBENCH_PORT
configWORKSPACES_DIR
configXDG_STATE_HOME
configCAPTURE_CUE_DEVICE
configWAKE_CUE_DEVICE
configGEMINI_MODEL
configAPI_TRANSPORT_TIMEOUT
configTTS_INSTRUCTIONS
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
deploySMTP_HOST
deploySMTP_PASS
deploySMTP_PORT
deploySMTP_USER
// quality suggestions

Secrets not logged

2 secret values sent to print

Redact or omit secret values from log output.

Production dependencies are patched

0 critical, 3 high severity in production deps — @earendil-works/pi-coding-agent@0.75.5 (high), nodemailer@8.0.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/madacol/whatsapp-llm-bot?variant=verified)](https://m8ven.ai/mcp/madacol/whatsapp-llm-bot)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: cb8e8d6bf22263958639f3d82709a8748a42b6a3
code hash: 718e93057e0b6ee1b44d9b79fcac32f1249455ba6ac5dc459b23cf07e1e712cc
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client