Maheidem/waha-mcp-server

Tool annotations match behaviour

1 read-only tool performs write/delete/exec — whatsapp_download_media (line 103: fs.mkdirSync(MEDIA_DIR, { recursive: true }))

Either remove the readOnlyHint:true annotation, or remove the write/delete call from the tool handler.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — whatsapp_download_media (line 103: fs.mkdirSync(MEDIA_DIR, { recursive: true }))

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

18/22 tool handlers declare input schemas (82%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

17/22 tools referenced in tests (77%)

Write tests that reference each tool by name so every tool has at least one test.

Tests pass

npm test failed — tests do not pass

Make sure npm test runs cleanly. Common cause: missing build step or missing env vars.

Production dependencies are patched

0 critical, 14 high severity in production deps — axios@1.7.9 (high), axios@1.7.9 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Domain consistency

npm scope @marcos-heidemann doesn't match GitHub owner maheidem

Use the same org name across GitHub, npm, and your homepage so users can verify the publisher.

Tool description accuracy

whatsapp_download_media: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.