WeChat-MCP: why it is not safe to use
WeChat-MCP passed most checks, but it can take real actions in WeChat without an added confirmation step for replies or friend requests.
What we found
Our review did not find hidden instructions, hardcoded secrets, credential harvesting, obfuscated code, or undisclosed data exfiltration. The code appears to automate the local WeChat macOS app through Accessibility permissions and uses the active local WeChat session.
The main concern is action safety. This skill can send WeChat replies, send friend requests, and create Moments posts directly. In the reviewed flows, friend requests are submitted by automatically clicking OK, and reply and add-contact actions do not add their own explicit confirmation step before the action is carried out. Moments includes a draft-only option, but that safeguard is not applied consistently across the other outbound actions.
What to do instead
Use this skill only where direct message sending and contact actions are acceptable and expected. Prefer setups that require a user confirmation step before replies, friend requests, or other outbound actions are sent. If you need lower-risk automation, choose tools that support draft mode or review-before-send behavior for all message and contact flows, not just some of them. Also review and limit which apps have macOS Accessibility access, since this skill depends on that permission to control WeChat.
Source: https://github.com/BiboyQG/WeChat-MCP
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.