A developer has released a small server that enables AI agents—such as those using Claude Desktop or Claude Code—to access and search a user's personal WhatsApp message history. The project, hosted on GitHub as `whatsapp-mcp`, functions as a read-only Model Context Protocol (MCP) server. By linking a phone to the server in a manner similar to WhatsApp Web, users can grant an AI agent the ability to perform tasks like summarizing missed messages in group chats or finding specific information across all conversations. The server is designed to be read-only, meaning it can retrieve and search data but cannot send messages on behalf of the user.
The technical implementation relies on Cloudflare Workers and Durable Objects to host the server and its database. The system uses the Baileys library, an open-source project that implements the WhatsApp Web protocol, to maintain a connection to the user's account. To ensure privacy and minimize resource usage, the server does not stay constantly connected; instead, it connects once a day (or when prompted by the agent) to collect queued messages, writes them to a local SQLite database within a Cloudflare Durable Object, and then disconnects. This architecture ensures that the user's messages remain within their own Cloudflare account rather than being transmitted to a third-party service.
The image represents the GitHub repository for the whatsapp-mcp project, which allows AI agents to search and read personal WhatsApp messages.
Despite its utility for personal organization, the project carries inherent risks and limitations. Because it uses the WhatsApp Web protocol rather than an official API, the tool technically violates WhatsApp's terms of service, which could lead to account suspension. Furthermore, the server only imports the message history that WhatsApp chooses to provide to a new linked device, which may not include the entire history. The project also faces hardware and software constraints: importing large histories requires a Cloudflare Workers Paid plan to bypass default CPU limits, and the system does not support media files like photos or voice notes, which appear only as text labels in the database. For users concerned about privacy, the project's read-only nature and self-hosted infrastructure offer a degree of control, though the data remains accessible to the AI agent being connected to the server.