wacli.me alpha

Changelog

Every release and every incident, dated. The project is young — this list starts where the project starts, and it is not padded.

0.3.0 — plans, and self-hosting in two commands current

  • Paid plans exist. Free stays a real tier — 50 tool calls a month, dormant chats pruned after 30 days, and a store deleted after 14 days with no request. Pro lifts all three. See Pricing.
  • Only tool calls count against the allowance. Connecting, and a client listing the available tools, do not — some clients do that on every start.
  • account_status reports the plan, how much of the month's allowance is left and when it resets, so a client can pace itself instead of discovering the limit at an error.
  • A Dockerfile. Self-hosting was: install Go, build the CLI with exactly the right tag, install Node, wire it together. It is now docker build and docker run, with the build tag baked in so the most common setup mistake cannot happen. Images are published to ghcr.io.
  • Fonts are served from this domain instead of Google Fonts. The site now makes no third-party requests at all.
  • Provider details are real, sub-processors are named, and there is an Article 28 processing agreement you can accept while linking.

0.2.1 — the source goes public

  • The gateway is on GitHub under MIT: github.com/wacli-me/wacli-me — server, linking flow, OAuth, deploy scripts and this website's sources.
  • Fixed: a malformed percent-encoded path such as /% raised a decoding error out of the request handler and ended the process. It now answers 400, and no exception can take the server down with it.
  • Hardened dynamic client registration: redirect URIs are capped per client, script-executing schemes are rejected, and the number of stored registrations is bounded.

0.2.0 — link it yourself

  • Self-service linking at /connect: scan a QR code, get an endpoint. No operator in the loop.
  • The QR is streamed live with a visible countdown and replaced automatically when WhatsApp expires it.
  • OAuth 2.1 with dynamic client registration and PKCE — add the server in a client, authorize in the browser, done. Nothing to copy.
  • Unauthenticated requests now answer with WWW-Authenticate pointing at the resource metadata, so clients find the authorization server themselves.
  • Sending is chosen at link time instead of being requested afterwards.

0.1.0 — first running alpha

  • MCP gateway over Streamable HTTP, stateless, one server instance per request.
  • Bearer-token authentication; one isolated wacli store per token, constant-time comparison.
  • Five read tools: account_status, list_chats, list_messages, search_messages, search_contacts.
  • send_message implemented but registered only for accounts with explicit write access.
  • Reads invoke the CLI with its read-only guard, so a tool call cannot mutate a store.
  • Pinned to wacli 0.18.2, built from source with the sqlite_fts5 tag.
  • Website, documentation, tool reference and self-hosting guide published.

Fixed: JSON envelope leaked into tool results

  • The CLI wraps responses in {success, data, error}. Tools returned that wrapper verbatim, so clients had to unwrap it and a failed call still looked successful.
  • The gateway now unwraps the envelope and turns success: false into a real tool error.

Fixed: stale pages behind the edge cache

  • HTML was served with a five-minute cache lifetime, so updates did not appear.
  • HTML is now no-cache; static assets keep their cache lifetime.

In progress

  • Per-account sync daemons managed by the service instead of by hand.
  • Publishing the gateway repository under MIT.
  • Token rotation and revocation from a page instead of by email.

Dates are the day a change went live, not the day it was written. Incidents are listed with the same weight as features — see status for what is running right now.