whatsapp-mcp: a read-only WhatsApp server for agents, on Cloudflare

whatsapp-mcp is an open-source server that lets an AI agent read and search one person's WhatsApp messages. Its author, posting as zoozla, introduced it as a Show HN on 18 October 2026; it had 115 points and 66 comments when fetched. The README describes a small Cloudflare Worker, deployed to the user's own account, that links to WhatsApp as an extra device and exposes the stored messages over the Model Context Protocol (MCP). The licence is MIT.

What it does and what it runs on

The README lists eight tools, among them list_chats, get_messages, search_messages and sync_now. It says the server cannot send anything. Messages are stored in a SQLite database inside a Cloudflare Durable Object, with a full-text index for search. The server does not hold a live connection: it connects when an agent asks, and once a day on a cron schedule, collects what WhatsApp queued, and disconnects. Sign-in to the MCP endpoint is by a password the owner sets.

Cost, per the README: the first import of a large history needs a higher CPU limit than the Workers free plan allows, so it recommends the Workers Paid plan, which it puts at a few dollars a month. The author says they have not tried the free plan. The README also says the project has only been exercised against one real account, that media is stored as labels such as [image] and is not downloaded, and that one deployment serves one person.

The risk the author states, and what commenters added

The README says plainly that this is not official: WhatsApp has no API for reading personal messages, and the project uses the WhatsApp Web protocol through the Baileys library, which it says is against WhatsApp's terms. It rates the practical risk for a read-only linked device as low but not zero.

• Account bans: taldo wrote that similar hacks have got them banned; lgleason said their personal account was flagged for a multi-device setup the official apps had allowed for years, and that access was cut until a reconsideration request was handled.
• Third parties: SchemaLoad argued that such projects expose the other side of every conversation to an AI company that never consented.
• Hosting trust: D2OQZG8l5BI1S06 asked why private messages should also pass through Cloudflare. The README's answer is that nothing leaves the user's own account.
• Alternatives: pizzafeelsright described an Android gateway that keeps everything local, and two other commenters linked their own competing tools.

What a team can take from it

Not the code, which is built for one person's account, but the pattern. A read-only tool surface, a store you own, and a pull instead of a standing connection are controls worth copying. What the README cannot settle is the part that matters at work: whether giving an agent a messaging account breaches the platform's terms, your retention rules or your colleagues' expectations. The thread suggests those questions arrive before any engineering one.