Skip to content

Green API WhatsApp

by green-api.com · remote · no sign-in to list tools · v0.1.2 · published by com.green-api

MCP gateway for WhatsApp via Green API: messaging, contacts, groups and instance management.

Deletes · 16Changes · 10
CompareRegistry entry

41 tools: 16 can delete or cancel things, 10 change things and 15 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http whatsapp https://mcp.green-api.com/mcp --header 'X-Instance-Id: <your-x-instance-id>' --header 'X-Api-Token: <your-x-api-token>'

Findings

Matches of fixed checks, with the text they matched.

2 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

41 tools

Deletes or cancels 16Claude Code: deny
  • whatsapp_delete_instanceDelete a WhatsApp instance via the GREEN-API Partner APIReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_delete_instance" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Delete a WhatsApp instance via the GREEN-API Partner API

    Annotations the server declares

    • title: Delete Partner Instance
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_delete_messageDelete a messageReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_delete_message" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Delete a message

    Annotations the server declares

    • title: Delete Message
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_delete_notificationDelete a notification from the queue (acknowledge receipt)Reads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_delete_notification" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Delete a notification from the queue (acknowledge receipt)

    Annotations the server declares

    • title: Delete Notification
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_edit_messageEdit a previously sent messageReads text others writeCan send data outNo findings

    Why it is in this group

    • The name "whatsapp_edit_message" says "edit": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "whatsapp_edit_message" says "edit" and "message": it writes something other people read.
    Description, as the server wrote it
    Edit a previously sent message

    Annotations the server declares

    • title: Edit Message
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_forward_messagesForward messages to another chatReads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Forward messages to another chat

    Annotations the server declares

    • title: Forward Messages
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_leave_groupLeave a WhatsApp groupReads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Leave a WhatsApp group

    Annotations the server declares

    • title: Leave Group
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_logoutLog out the WhatsApp instanceReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "log": a word for reading.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Log out the WhatsApp instance

    Annotations the server declares

    • title: Logout Instance
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_remove_group_adminRevoke admin rights from a group memberReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_remove_group_admin" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Revoke admin rights from a group member

    Annotations the server declares

    • title: Demote Group Admin
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_remove_group_participantRemove a participant from a WhatsApp groupReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_remove_group_participant" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Remove a participant from a WhatsApp group

    Annotations the server declares

    • title: Remove Group Participant
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_send_contactSend a contact card via WhatsAppReads text others writeCan send data outNo findings

    Why it is in this group

    • The name "whatsapp_send_contact" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "whatsapp_send_contact" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a contact card via WhatsApp

    Annotations the server declares

    • title: Send Contact
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_send_fileSend a file by URLReads text others writeCan send data outNo findings

    Why it is in this group

    • The name "whatsapp_send_file" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "whatsapp_send_file" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a file by URL

    Annotations the server declares

    • title: Send File by URL
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_send_file_by_uploadSend a file directly to a chat via multipart upload (no separate URL step)Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "whatsapp_send_file_by_upload" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "whatsapp_send_file_by_upload" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a file directly to a chat via multipart upload (no separate URL step)

    Annotations the server declares

    • title: Send File
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_send_locationSend a locationReads text others writeCan send data outNo findings

    Why it is in this group

    • The name "whatsapp_send_location" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "whatsapp_send_location" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a location

    Annotations the server declares

    • title: Send Location
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_send_messageSend a text message via WhatsAppReads text others writeCan send data outNo findings

    Why it is in this group

    • The name "whatsapp_send_message" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "whatsapp_send_message" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a text message via WhatsApp

    Annotations the server declares

    • title: Send Message
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_send_pollSend a poll via WhatsAppReads text others writeCan send data outNo findings

    Why it is in this group

    • The name "whatsapp_send_poll" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "whatsapp_send_poll" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a poll via WhatsApp

    Annotations the server declares

    • title: Send Poll
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_set_settingsUpdate instance settings (webhooks, proxy, etc.)Reads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_set_settings" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Update instance settings (webhooks, proxy, etc.)

    Annotations the server declares

    • title: Update Instance Settings
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
Changes things 10Claude Code: ask
  • whatsapp_add_group_participantAdd a participant to a WhatsApp groupReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_add_group_participant" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Add a participant to a WhatsApp group

    Annotations the server declares

    • title: Add Group Participant
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_check_whatsappCheck whether a phone number has a WhatsApp accountCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.phone_number): what the tool writes goes there.
    Description, as the server wrote it
    Check whether a phone number has a WhatsApp account

    Annotations the server declares

    • title: Check WhatsApp Number
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_connectConnect a WhatsApp instance.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...his before using other tools. Validates credentials via getStateInstance."

      What this check looks for
    Description, as the server wrote it
    Connect a WhatsApp instance. Call this before using other tools. Validates credentials via getStateInstance.

    Annotations the server declares

    • title: Connect Instance
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • whatsapp_create_groupCreate a WhatsApp groupReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_create_group" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a WhatsApp group

    Annotations the server declares

    • title: Create Group
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_create_instanceCreate a new WhatsApp instance via the GREEN-API Partner APIReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_create_instance" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a new WhatsApp instance via the GREEN-API Partner API

    Annotations the server declares

    • title: Create Partner Instance
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_disconnectDisconnect a WhatsApp instance and remove credentials from the session1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...sconnect a WhatsApp instance and remove credentials from the session"

      What this check looks for
    Description, as the server wrote it
    Disconnect a WhatsApp instance and remove credentials from the session

    Annotations the server declares

    • title: Disconnect Instance
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • whatsapp_read_chatMark chat messages as readReads private dataReads text others writeCan send data outNo findings

    Why it is in this group

    • The name "whatsapp_read_chat" says "read": a word for reading.
    • The description's first verb is "mark": a word for a change.

    What it can reach

    • private-dataThe name "whatsapp_read_chat" says "read" and "chat": it reads messages.
    • private-dataThe description's first sentence says "chat": it reads messages.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "whatsapp_read_chat" says "read" and "chat": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "mark" and "chat": it reads messages, which other people can write.
    • outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
    Description, as the server wrote it
    Mark chat messages as read

    Annotations the server declares

    • title: Mark Chat as Read
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_rebootReboot the WhatsApp instanceReads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reboot the WhatsApp instance

    Annotations the server declares

    • title: Reboot Instance
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_set_group_adminPromote a group member to adminReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_set_group_admin" says "set": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Promote a group member to admin

    Annotations the server declares

    • title: Promote Group Admin
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • whatsapp_upload_fileUpload a file to GREEN-API storage and return its URL.Reads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_upload_file" says "upload": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Upload a file to GREEN-API storage and return its URL. Use the returned URL with whatsapp_send_file.

    Annotations the server declares

    • title: Upload File
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 15Claude Code: allow
  • whatsapp_get_authorization_codeGet an authorization code for sign-in by phone numberNo findings

    Why it is in this group

    • The name "whatsapp_get_authorization_code" says "get": a word for reading.
    Description, as the server wrote it
    Get an authorization code for sign-in by phone number

    Annotations the server declares

    • title: Get Authorization Code
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_chat_historyGet chat message history.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_get_chat_history" says "get": a word for reading.

    What it can reach

    • private-dataThe name "whatsapp_get_chat_history" says "get" and "chat": it reads messages.
    • private-dataThe description's first sentence says "get" and "chat": it reads messages.
    • untrusted-inputThe name "whatsapp_get_chat_history" says "get" and "chat": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "chat": it reads messages, which other people can write.
    Description, as the server wrote it
    Get chat message history. Use a small 'count' (default 50, max 100) to keep responses focused.

    Annotations the server declares

    • title: Get Chat History
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_contact_avatarGet the avatar of a contact or groupReads private dataNo findings

    Why it is in this group

    • The name "whatsapp_get_contact_avatar" says "get": a word for reading.

    What it can reach

    • private-dataThe name "whatsapp_get_contact_avatar" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    Get the avatar of a contact or group

    Annotations the server declares

    • title: Get Contact Avatar
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_contact_infoGet information about a contact or groupReads private dataNo findings

    Why it is in this group

    • The name "whatsapp_get_contact_info" says "get": a word for reading.

    What it can reach

    • private-dataThe name "whatsapp_get_contact_info" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    Get information about a contact or group

    Annotations the server declares

    • title: Get Contact Info
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_contactsGet the contact listReads private dataNo findings

    Why it is in this group

    • The name "whatsapp_get_contacts" says "get": a word for reading.

    What it can reach

    • private-dataThe name "whatsapp_get_contacts" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    Get the contact list

    Annotations the server declares

    • title: Get Contacts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_group_dataGet group data (members, name, invite link)No findings

    Why it is in this group

    • The name "whatsapp_get_group_data" says "get": a word for reading.
    Description, as the server wrote it
    Get group data (members, name, invite link)

    Annotations the server declares

    • title: Get Group Data
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_instancesList all partner instances via the GREEN-API Partner APINo findings

    Why it is in this group

    • The name "whatsapp_get_instances" says "get": a word for reading.
    Description, as the server wrote it
    List all partner instances via the GREEN-API Partner API

    Annotations the server declares

    • title: List Partner Instances
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_messageGet a message by IDReads private dataReads text others writeNo findings

    Why it is in this group

    • The name "whatsapp_get_message" says "get": a word for reading.

    What it can reach

    • private-dataThe name "whatsapp_get_message" says "get" and "message": it reads messages.
    • private-dataThe description's first sentence says "get" and "message": it reads messages.
    • untrusted-inputThe name "whatsapp_get_message" says "get" and "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Get a message by ID

    Annotations the server declares

    • title: Get Message
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_qrGet the QR code for instance authorization.No findings

    Why it is in this group

    • The name "whatsapp_get_qr" says "get": a word for reading.
    Description, as the server wrote it
    Get the QR code for instance authorization. The result contains the QR as an image and a qrLink URL to an official GREEN-API page with a full-size auto-refreshing QR code. Always include the qrLink in your response as a clickable markdown link so the user can open it in the browser and scan comfortably.

    Annotations the server declares

    • title: Get QR Code
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_settingsGet instance settingsNo findings

    Why it is in this group

    • The name "whatsapp_get_settings" says "get": a word for reading.
    Description, as the server wrote it
    Get instance settings

    Annotations the server declares

    • title: Get Instance Settings
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_stateGet instance state (authorized, notAuthorized, blocked, sleepMode)No findings

    Why it is in this group

    • The name "whatsapp_get_state" says "get": a word for reading.
    Description, as the server wrote it
    Get instance state (authorized, notAuthorized, blocked, sleepMode)

    Annotations the server declares

    • title: Get Instance State
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_get_wa_settingsGet WhatsApp account settings (name, description, etc.)No findings

    Why it is in this group

    • The name "whatsapp_get_wa_settings" says "get": a word for reading.
    Description, as the server wrote it
    Get WhatsApp account settings (name, description, etc.)

    Annotations the server declares

    • title: Get WhatsApp Account Settings
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_last_incoming_messagesGet recent incoming messages from the last N minutes (default 60, max 1440 = 24 hours).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • private-dataThe name "whatsapp_last_incoming_messages" says "message": it reads messages.
    • private-dataThe description's first sentence says "get" and "message": it reads messages.
    • untrusted-inputThe name "whatsapp_last_incoming_messages" says "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Get recent incoming messages from the last N minutes (default 60, max 1440 = 24 hours).

    Annotations the server declares

    • title: Get Recent Incoming Messages
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_last_outgoing_messagesGet recent outgoing messages from the last N minutes (default 60, max 1440 = 24 hours).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • private-dataThe name "whatsapp_last_outgoing_messages" says "message": it reads messages.
    • private-dataThe description's first sentence says "get" and "message": it reads messages.
    • untrusted-inputThe name "whatsapp_last_outgoing_messages" says "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Get recent outgoing messages from the last N minutes (default 60, max 1440 = 24 hours).

    Annotations the server declares

    • title: Get Recent Outgoing Messages
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • whatsapp_receive_notificationGet one notification from the queue (manual polling)No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get one notification from the queue (manual polling)

    Annotations the server declares

    • title: Receive Notification
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

1944 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 8 private-data tools breaks every one.

Reads private data8
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write27
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out9
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__whatsapp__whatsapp_get_chat_history",
      "mcp__whatsapp__whatsapp_get_contact_avatar",
      "mcp__whatsapp__whatsapp_get_contact_info",
      "mcp__whatsapp__whatsapp_get_contacts",
      "mcp__whatsapp__whatsapp_get_message",
      "mcp__whatsapp__whatsapp_last_incoming_messages",
      "mcp__whatsapp__whatsapp_last_outgoing_messages",
      "mcp__whatsapp__whatsapp_read_chat"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:33 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
26
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://mcp.green-api.com/.well-known/oauth-protected-resource
Authorization servers
https://mcp.green-api.com
Legacy HTTP+SSE transport
yes
Dynamic client registration
yes
Client ID metadata documents
no
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 26 tools that change things (16 destructive, 10 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mcp.green-api.com/mcp: tools/list returned 41 tools to an anonymous client, including whatsapp_delete_instance (destructive), whatsapp_delete_message (destructive), whatsapp_delete_notification (destructive), whatsapp_edit_message (destructive), whatsapp_forward_messages (destructive) and 21 more

    What this check looks for

Install

Pinned to version 0.1.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http whatsapp https://mcp.green-api.com/mcp --header 'X-Instance-Id: <your-x-instance-id>' --header 'X-Api-Token: <your-x-api-token>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__whatsapp__whatsapp_get_authorization_code",
      "mcp__whatsapp__whatsapp_get_chat_history",
      "mcp__whatsapp__whatsapp_get_contact_avatar",
      "mcp__whatsapp__whatsapp_get_contact_info",
      "mcp__whatsapp__whatsapp_get_contacts",
      "mcp__whatsapp__whatsapp_get_group_data",
      "mcp__whatsapp__whatsapp_get_instances",
      "mcp__whatsapp__whatsapp_get_message",
      "mcp__whatsapp__whatsapp_get_qr",
      "mcp__whatsapp__whatsapp_get_settings",
      "mcp__whatsapp__whatsapp_get_state",
      "mcp__whatsapp__whatsapp_get_wa_settings",
      "mcp__whatsapp__whatsapp_last_incoming_messages",
      "mcp__whatsapp__whatsapp_last_outgoing_messages",
      "mcp__whatsapp__whatsapp_receive_notification"
    ],
    "ask": [
      "mcp__whatsapp__whatsapp_add_group_participant",
      "mcp__whatsapp__whatsapp_check_whatsapp",
      "mcp__whatsapp__whatsapp_connect",
      "mcp__whatsapp__whatsapp_create_group",
      "mcp__whatsapp__whatsapp_create_instance",
      "mcp__whatsapp__whatsapp_disconnect",
      "mcp__whatsapp__whatsapp_read_chat",
      "mcp__whatsapp__whatsapp_reboot",
      "mcp__whatsapp__whatsapp_set_group_admin",
      "mcp__whatsapp__whatsapp_upload_file"
    ],
    "deny": [
      "mcp__whatsapp__whatsapp_delete_instance",
      "mcp__whatsapp__whatsapp_delete_message",
      "mcp__whatsapp__whatsapp_delete_notification",
      "mcp__whatsapp__whatsapp_edit_message",
      "mcp__whatsapp__whatsapp_forward_messages",
      "mcp__whatsapp__whatsapp_leave_group",
      "mcp__whatsapp__whatsapp_logout",
      "mcp__whatsapp__whatsapp_remove_group_admin",
      "mcp__whatsapp__whatsapp_remove_group_participant",
      "mcp__whatsapp__whatsapp_send_contact",
      "mcp__whatsapp__whatsapp_send_file",
      "mcp__whatsapp__whatsapp_send_file_by_upload",
      "mcp__whatsapp__whatsapp_send_location",
      "mcp__whatsapp__whatsapp_send_message",
      "mcp__whatsapp__whatsapp_send_poll",
      "mcp__whatsapp__whatsapp_set_settings"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as whatsapp. Review it before you use it.

Capability tags behind 31 rules
  • mcp__whatsapp__whatsapp_add_group_participant untrusted-input
  • mcp__whatsapp__whatsapp_check_whatsapp outbound
  • mcp__whatsapp__whatsapp_create_group untrusted-input
  • mcp__whatsapp__whatsapp_create_instance untrusted-input
  • mcp__whatsapp__whatsapp_delete_instance untrusted-input
  • mcp__whatsapp__whatsapp_delete_message untrusted-input
  • mcp__whatsapp__whatsapp_delete_notification untrusted-input
  • mcp__whatsapp__whatsapp_edit_message untrusted-input, outbound
  • mcp__whatsapp__whatsapp_forward_messages untrusted-input
  • mcp__whatsapp__whatsapp_get_chat_history private-data, untrusted-input
  • mcp__whatsapp__whatsapp_get_contact_avatar private-data
  • mcp__whatsapp__whatsapp_get_contact_info private-data
  • mcp__whatsapp__whatsapp_get_contacts private-data
  • mcp__whatsapp__whatsapp_get_message private-data, untrusted-input
  • mcp__whatsapp__whatsapp_last_incoming_messages private-data, untrusted-input
  • mcp__whatsapp__whatsapp_last_outgoing_messages private-data, untrusted-input
  • mcp__whatsapp__whatsapp_leave_group untrusted-input
  • mcp__whatsapp__whatsapp_logout untrusted-input
  • mcp__whatsapp__whatsapp_read_chat private-data, untrusted-input, outbound
  • mcp__whatsapp__whatsapp_reboot untrusted-input
  • mcp__whatsapp__whatsapp_remove_group_admin untrusted-input
  • mcp__whatsapp__whatsapp_remove_group_participant untrusted-input
  • mcp__whatsapp__whatsapp_send_contact untrusted-input, outbound
  • mcp__whatsapp__whatsapp_send_file untrusted-input, outbound
  • mcp__whatsapp__whatsapp_send_file_by_upload untrusted-input, outbound
  • mcp__whatsapp__whatsapp_send_location untrusted-input, outbound
  • mcp__whatsapp__whatsapp_send_message untrusted-input, outbound
  • mcp__whatsapp__whatsapp_send_poll untrusted-input, outbound
  • mcp__whatsapp__whatsapp_set_group_admin untrusted-input
  • mcp__whatsapp__whatsapp_set_settings untrusted-input
  • mcp__whatsapp__whatsapp_upload_file untrusted-input