wacli.meSecurity
This service reads your private messages. That deserves a straight description of how it is built and where the sharp edges are, not a page of badges.
How it is built
One store per account
Every linked account gets its own directory and its own SQLite database. The gateway resolves your bearer token to exactly one store and constructs the tools against it per request. There is no shared query path where one account could see another's rows.
Token authentication
Every MCP request carries Authorization: Bearer …. Tokens are 32 random bytes, compared in constant time, and never logged. An unauthenticated request gets a 401 before any code touches a store.
Read-only by default
Reads invoke the CLI with its --read-only flag, which refuses anything that would write to WhatsApp or the local store. The four write tools are not merely disabled for accounts without write access — they are never registered, so a client cannot see them or call them.
The write switch covers more than sending. Reacting to a message, marking a chat read and checking whether a number is on WhatsApp all reach outside your own store: two of them change what someone else sees, and the third asks WhatsApp about a stranger. Anything with an effect beyond your own device sits behind the same switch.
Transport
The service listens on loopback only and is published through a TLS-terminating tunnel. The port is never exposed directly to the internet.
Encryption, honestly stated
WhatsApp is end-to-end encrypted between devices. Your linked device decrypts messages in order to show them to you — and that is what this is. The synced history sits on disk in a database the host can read. Full-disk encryption protects a stolen machine, not a compromised one.
Risks we will not talk you out of
A token is your inbox. Anyone holding it can read everything the account has synced. Treat it like a password; ask for a rotation the moment it leaks.
Automation can get an account banned. WhatsApp's terms are aimed at humans using clients. Bulk or bot-like sending risks your number — keep sending conversational.
Your client sees what it reads. Messages you pull go to whichever assistant you connected, under that vendor's policy. Choose the client with that in mind.
Other people did not opt in. A chat has a second party. Reading your own history is yours to decide; forwarding someone's message into a tool is a judgement call you own.
Your controls
- Unlink from the phone. WhatsApp → Linked devices → remove. Access stops immediately, independent of us.
- Rotate the token. One request; the old token stops working at once.
- Delete the store. Ask, and the account's directory and database are removed — with the synced history in them.
- Leave entirely. Export the SQLite store, move it to your own host, tell us to delete ours.
Alpha means alpha. No external audit has been done, there is no uptime commitment, and tokens may be rotated for operational reasons. Do not put an account through this that you cannot afford to have interrupted.
Reporting a vulnerability
Mail [email protected] with enough detail to reproduce. We will confirm within a few days, keep you posted while it is fixed, and credit you if you want the credit. Please do not test against accounts that are not yours.