WhatsApp MCP Server: why it is not safe to use

What we found

Our review did not find hidden instructions, hardcoded secrets, obfuscated code, or obvious privilege escalation behavior. The main concerns were about message sending and sensitive data handling.

The skill exposes a `send_message` tool that can send WhatsApp messages immediately, and we did not find a built-in confirmation step in the code before a message is sent. That increases the chance of unintended outbound messages if the tool is triggered carelessly.

We also found that the skill stores local WhatsApp authentication material in `auth_info` and syncs private message history into a local SQLite database. That means it can access and retain inherently sensitive private communications on the device where it runs.

In addition, during first-run login it opens a `quickchart.io` URL that contains the WhatsApp login QR payload so the QR code can be shown in a browser. This is a disclosed third-party network fetch outside WhatsApp and the AI client.

What to do instead

Use this skill only with clear human approval for every send action. Prefer tools that add an explicit confirmation step before outbound messaging. Run it only on a device you control, protect the local auth and database files, and avoid it if sending login QR data to a third-party service is not acceptable for your environment.