Give Claude access to your WhatsApp messages via MCP
Connect ChatGPT, Claude or Grok to your WhatsApp. Task: Connect ChatGPT, Claude or Grok to your WhatsApp. It is a read-only MCP server over your own message history, stored encrypted, and open source. You link your phone once, the way you'd link WhatsApp Web, and from then on any MCP client can search and read your chats. It can't send anything. Built by @finereli. Questions and bug reports go in an issue here, or to me on X. There are two ways to use it: Use it at whatsapp.finereli.com. This is the quick way. Sign in with Google, scan the QR code with your phone, and add https://whatsapp.finereli.com/mcp to your agent. It's a free beta with a limited number of seats and a size limit per account. Your messages are encrypted at rest, but I run the login service, so in principle I could derive your key. "What it guarantees" below says exactly what that means. If you'd rather not trust me, run your own copy. Run your own copy in your Cloudflare account. This is what the setup guide below covers. Free apart from Cloudflare's few dollars a month, and the key comes from a password only you know. Anyone can also run it as a service for other people: see "Running it for other people". The easiest way to set up the hosted version is to let your agent do it. Paste this into Claude, ChatGPT or Grok: Set up WhatsApp for me via https://whatsapp.finereli.com. Read https://whatsapp.finereli.com/llms.txt and walk me through it. Ask your agent things like: "What did Dana say about the flights?" "Find every message where someone mentioned the lease, across all my chats." "Summarize what I missed in the family group this week." How it works Your phone stays the source of truth. The server is a linked device that your agent talks to. It doesn't stay connected to WhatsApp. When your agent asks for something, it connects, collects whatever WhatsApp queued for it since last time, writes that to its own database, and hangs up. Your phone keeps working normally and keeps getting notifications. Your messages live in a SQLite database inside a Durable Object in Cloudflare, one per person, sealed with a key that comes from that person's sign-in. What it guarantees, and what it doesn't It only reads. There are no tools that send, edit or delete anything in WhatsApp. Your messages are encrypted at rest. Whether the operator can read them depends on how it is run. Your own copy (OWNER_PASSWORD): the key comes from your password. There is no master key and no recovery key. Not Cloudflare, and not someone who copies the database, can read your stored messages without it. A hosted service (OPEN_SIGNUP): people sign in with Google through a login service (login.finereli.com) that hands the server a key for them, the same key every time. A leaked database, a stolen backup or a peek inside the hosting account shows noise. The login service's operator can derive that key, so the encryption is not a lock against them. They say so, the code is open source, and running your own copy removes the question. Each account has a random data key. It encrypts everything you own: message text, chat and contact names, the names your agent saves, and WhatsApp's session keys. The data key is stored only in a form locked by that password or login key (PBKDF2-SHA256, 600,000 rounds for a password, then AES-256-GCM). Someone who copies the database can't read your stored messages without it. Phone numbers and chat ids are replaced by keyed hashes in the database, so it can still sort and group without knowing who anyone is. Timestamps, message types and which side sent each message are left readable, and so is roughly how long each message is. Someone with the database could see how many chats you have, how active they are and when, but not who they were with or what they said. Signing in produces the data key for a while. It travels inside the OAuth token your agent holds and your browser session, each encrypted under that token. The server stores nothing that can open your data on its own. It is not end-to-end encryption, and you should know exactly where that stops. While you or your agent are making a request, the server has your key in memory and works with your messages in plain text. Whoever runs the server could deploy modified code that captures passwords as people type them, or reads the key as it arrives. The code is open source so that this can be checked, and you can run your own copy to remove the question. Whatever your agent reads goes to the company that runs the agent.; tools: Claude. Human role: The original post does not say how a person stayed involved.; limitations: Prerequisites include a Cloudflare Workers Paid plan ($5/month) for self-hosting or a limited seat in the hosted beta. Key constraints: the server is read-only; encryption keys are derived from user passwords (self-hosted) or a login service (hosted), meaning operators of the hosted service can theoretically derive keys. WhatsApp may restrict accounts using linked devices. Media is not downloaded, and search is exact-word based, not fuzzy..
Tools
Published on Agent Work Atlas:
Overview
Connect ChatGPT, Claude or Grok to your WhatsApp.
Workflow
Connect ChatGPT, Claude or Grok to your WhatsApp. It is a read-only MCP server over your own message history, stored encrypted, and open source. You link your phone once, the way you'd link WhatsApp Web, and from then on any MCP client can search and read your chats. It can't send anything. Built by @finereli. Questions and bug reports go in an issue here, or to me on X. There are two ways to use it: Use it at whatsapp.finereli.com. This is the quick way. Sign in with Google, scan the QR code with your phone, and add https://whatsapp.finereli.com/mcp to your agent. It's a free beta with a limited number of seats and a size limit per account. Your messages are encrypted at rest, but I run the login service, so in principle I could derive your key. "What it guarantees" below says exactly what that means. If you'd rather not trust me, run your own copy. Run your own copy in your Cloudflare account. This is what the setup guide below covers. Free apart from Cloudflare's few dollars a month, and the key comes from a password only you know. Anyone can also run it as a service for other people: see "Running it for other people". The easiest way to set up the hosted version is to let your agent do it. Paste this into Claude, ChatGPT or Grok: Set up WhatsApp for me via https://whatsapp.finereli.com. Read https://whatsapp.finereli.com/llms.txt and walk me through it. Ask your agent things like: "What did Dana say about the flights?" "Find every message where someone mentioned the lease, across all my chats." "Summarize what I missed in the family group this week." How it works Your phone stays the source of truth. The server is a linked device that your agent talks to. It doesn't stay connected to WhatsApp. When your agent asks for something, it connects, collects whatever WhatsApp queued for it since last time, writes that to its own database, and hangs up. Your phone keeps working normally and keeps getting notifications. Your messages live in a SQLite database inside a Durable Object in Cloudflare, one per person, sealed with a key that comes from that person's sign-in. What it guarantees, and what it doesn't It only reads. There are no tools that send, edit or delete anything in WhatsApp. Your messages are encrypted at rest. Whether the operator can read them depends on how it is run. Your own copy (OWNER_PASSWORD): the key comes from your password. There is no master key and no recovery key. Not Cloudflare, and not someone who copies the database, can read your stored messages without it. A hosted service (OPEN_SIGNUP): people sign in with Google through a login service (login.finereli.com) that hands the server a key for them, the same key every time. A leaked database, a stolen backup or a peek inside the hosting account shows noise. The login service's operator can derive that key, so the encryption is not a lock against them. They say so, the code is open source, and running your own copy removes the question. Each account has a random data key. It encrypts everything you own: message text, chat and contact names, the names your agent saves, and WhatsApp's session keys. The data key is stored only in a form locked by that password or login key (PBKDF2-SHA256, 600,000 rounds for a password, then AES-256-GCM). Someone who copies the database can't read your stored messages without it. Phone numbers and chat ids are replaced by keyed hashes in the database, so it can still sort and group without knowing who anyone is. Timestamps, message types and which side sent each message are left readable, and so is roughly how long each message is. Someone with the database could see how many chats you have, how active they are and when, but not who they were with or what they said. Signing in produces the data key for a while. It travels inside the OAuth token your agent holds and your browser session, each encrypted under that token. The server stores nothing that can open your data on its own. It is not end-to-end encryption, and you should know exactly where that stops. While you or your agent are making a request, the server has your key in memory and works with your messages in plain text. Whoever runs the server could deploy modified code that captures passwords as people type them, or reads the key as it arrives. The code is open source so that this can be checked, and you can run your own copy to remove the question. Whatever your agent reads goes to the company that runs the agent.
Reported result
The source does not report specific business outcomes, efficiency gains, or failure rates for this tool. It describes the technical capability to retrieve chat history and search for keywords across conversations. A measurable acceptance check would be verifying that the agent successfully returns specific message content from a test chat without triggering any send actions or data loss.
Human role
The original post does not say how a person stayed involved.
Limitations
Prerequisites include a Cloudflare Workers Paid plan ($5/month) for self-hosting or a limited seat in the hosted beta. Key constraints: the server is read-only; encryption keys are derived from user passwords (self-hosted) or a login service (hosted), meaning operators of the hosted service can theoretically derive keys. WhatsApp may restrict accounts using linked devices. Media is not downloaded, and search is exact-word based, not fuzzy.
Try it
I want to set up a read-only WhatsApp MCP server to allow my AI agent to search my chat history. Please guide me through deploying the 'whatsapp-mcp' project to my Cloudflare account. Steps: 1. Clone the repository from https://github.com/finereli/whatsapp-mcp. 2. Install dependencies using npm. 3. Create a Cloudflare KV namespace for OAuth tokens. 4. Set the OWNER_PASSWORD secret (12+ characters) to encrypt my data. 5. Deploy the worker using wrangler. 6. Open the provided URL, sign in with the password, and scan the QR code with my WhatsApp app to link the device. 7. Once linked, configure my Claude agent to connect to the MCP endpoint at [my-worker-url]/mcp. Constraints: - Ensure the server is strictly read-only; do not enable any send capabilities. - Verify that the first import of history completes successfully. - Ask me for confirmation before proceeding to each major step (deployment, linking, agent connection). - If the import fails due to CPU limits, advise on checking the Workers Paid plan status. Deliverable: A working MCP connection where I can ask the agent to 'search for messages about [topic]' and receive results.
Source reports are not independently verified. Publication date is the catalog publication date, not the original article date.