Skip to content
anlyon.devby Anlyon

Le Confidant

ai.leconfidant/le-confidantleconfidant.aistreamable-httpv0.4.0Scanned

Statistics from your own WhatsApp chat analysis as numbers only, plus free WhatsApp text tools.

7 tools: 1 can delete or cancel things, 3 change things and 3 only read.

Tools: 1 delete, 0 irreversible, 3 write, 3 read.
  • Reads private data · 2
  • Reads text others write · 2
  • Can send data out · 1
  • 3 findings

Anlyon alternative

4 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

7 tools

Deletes or cancels 1Claude Code: deny
  • disconnect_conversationUse only when the user explicitly asks to disconnect or revoke this connection.1 finding

    Why it is in this group

    • The description says "cannot be restored".
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...nt OAuth grant immediately; the revoked credential cannot be restored. Fresh explicit cons..."

      What this check looks for
    Description, as the server wrote it
    Use only when the user explicitly asks to disconnect or revoke this connection. Permanently revoke its current OAuth grant immediately; the revoked credential cannot be restored. Fresh explicit consent creates a new grant while the original session is eligible. Stops future reads without deleting the source session or results already in this conversation. Other connections can be revoked on the website. This tool changes access and is destructive access revocation; it does not retrieve statistics or answer period comparisons.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • title: Disconnect your selected conversation
Changes things 3Claude Code: ask
  • format_whatsapp_textConvert the user's Markdown source to text ready to paste into WhatsApp.1 finding

    Why it is in this group

    • The description's first verb is "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "format_whatsapp_text" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert the user's Markdown source to text ready to paste into WhatsApp. Before calling, copy the supplied source unchanged into text: do not Markdown-escape it or pre-convert it. Example: source **Meeting tomorrow** must be passed as **Meeting tomorrow**; the tool returns *Meeting tomorrow*. Preserve backslashes the user actually supplied, but never insert extra ones. After calling, display structuredContent.formattedText verbatim in a plain-text fenced code block, without escaping or reformatting it. Supports # headings, bold, italics, strikethrough, lists and links. Preserves URL destinations, literal text and fenced/inline code. Unsupported blocks remain literal; does not render HTML, summarize or translate. Inputs are processed by this server to return the result; this tool does not store or log phone numbers or text. It does not access an account or send messages.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Format text for WhatsApp
  • style_whatsapp_textRewrite the user's text in one decorative Unicode style to paste into WhatsApp.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Rewrite the user's text in one decorative Unicode style to paste into WhatsApp. Styles: bold, italic, monospace, bubble, gothic, double (double-struck), strikethrough, upside-down. Call it once the user has picked a style from this list. These are lookalike characters, not real fonts: accented letters and digits usually stay plain, and screen readers can read the result badly. After calling, display structuredContent.styledText verbatim in a plain-text fenced code block. Inputs are processed by this server to return the result; this tool does not store or log phone numbers or text. It does not access an account or send messages.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Restyle text with decorative letters
Only reads 3Show 3 read-only tools
  • demo_whatsapp_wrappedShow a synthetic WhatsApp recap without an account, upload or private conversation access.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "show": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "show" and "conversation": it reads messages.
    • untrusted-inputThe description's first sentence says "show" and "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    Show a synthetic WhatsApp recap without an account, upload or private conversation access. Use only for a demo or example, never to answer questions about the user's real conversation. All numbers are fictional and fixed; no relationship diagnosis. Returns a text and structured recap, without image export.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Show a fictional WhatsApp Wrapped recap
  • get_conversation_snapshotUse only to retrieve or explain WHOLE-SESSION numerical statistics from the user's explicitly authorized WhatsApp export analysis.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_conversation_snapshot" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_conversation_snapshot" says "get" and "conversation": it reads messages.
    • untrusted-inputThe name "get_conversation_snapshot" says "get" and "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    Use only to retrieve or explain WHOLE-SESSION numerical statistics from the user's explicitly authorized WhatsApp export analysis. DO NOT call for date-window, month-to-month, trend or period-comparison requests, even to check available data. For example, 'Compare September and November in my own connected WhatsApp analysis' needs NO tool call: explain that period comparison is unavailable. This tool returns only stored whole-session totals and cannot answer that request. For supported requests, returns neutral A/B labels, counts/shares, starts, reply timing/sample sizes, mean message length, definitions, limitations and expiry from the OAuth-selected session. No raw messages, names, excerpts, paid insights or new analysis. Set locale to the user's supported language.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Read whole-session statistics
  • normalize_whatsapp_numbersValidate up to 100 phone numbers and return E.164 numbers and wa.me links with per-row status and duplicate positions.No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate up to 100 phone numbers and return E.164 numbers and wa.me links with per-row status and duplicate positions. National numbers require defaultCountry. Never guess a country from language. Does not check WhatsApp registration or contact people. Inputs are processed by this server to return the result; this tool does not store or log phone numbers or text. It does not access an account or send messages.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • title: Normalize phone numbers for WhatsApp

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

4 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__le-confidant__generate_whatsapp_link"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn1 info
  • Warngenerate_whatsapp_link

    The server marks "generate_whatsapp_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_whatsapp_link" says "generate": a word for a change.

    What this check looks for
  • Warnformat_whatsapp_text

    The server marks "format_whatsapp_text" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.

    What this check looks for
  • Infodisconnect_conversation

    The description mentions "credential".

    Matched text

    description: "...nt OAuth grant immediately; the revoked credential cannot be restored. Fresh explicit cons..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.4.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http le-confidant https://leconfidant.ai/api/mcp
claude mcp add --transport http le-confidant https://leconfidant.ai/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__le-confidant__normalize_whatsapp_numbers",
      "mcp__le-confidant__demo_whatsapp_wrapped",
      "mcp__le-confidant__get_conversation_snapshot"
    ],
    "ask": [
      "mcp__le-confidant__generate_whatsapp_link",
      "mcp__le-confidant__format_whatsapp_text",
      "mcp__le-confidant__style_whatsapp_text"
    ],
    "deny": [
      "mcp__le-confidant__disconnect_conversation"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as le-confidant. Review it before you use it.

Capability tags behind 3 rules
  • mcp__le-confidant__generate_whatsapp_link outbound
  • mcp__le-confidant__demo_whatsapp_wrapped private-data, untrusted-input
  • mcp__le-confidant__get_conversation_snapshot private-data, untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ai.leconfidant/le-confidant/verify?hash=1ef0f5379607f75984a309a8c3f58459f3c6384a27e829850670308c7ac2c761" | jq -e '.changed == false'

Pinned hash 1ef0f5379607, from Nov 1, 2026, 14:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ai.leconfidant/le-confidant/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for ai.leconfidant/le-confidant
[![anlyon.dev](https://anlyon.dev/badge/ai.leconfidant/le-confidant.svg)](https://anlyon.dev/servers/ai.leconfidant/le-confidant)

Source: MCP Registry. Synced Nov 1, 2026, 14:17 UTC.