Skip to content
Call wiki

Can an AI assistant read and draft your WhatsApp messages?

Last updated 2026-08-17 · Confidence: documented — the bridge projects’ READMEs, Anthropic’s connector docs, and WhatsApp’s terms; the ban precedent is reported (2015), and WhatsApp’s stance on personal bridges specifically is stated nowhere.

Yes, but only through a community bridge that joins your account as a linked device — no official connector exists, the bridge needs a coding agent (or the desktop app) to host it, and it sits outside WhatsApp’s terms of service.

No official connector, and the official API doesn’t help

Section titled “No official connector, and the official API doesn’t help”

Anthropic’s connector directory lists no WhatsApp. Meta’s official WhatsApp Cloud API is for businesses messaging customers from a dedicated business number; it cannot read a personal account’s chats.

Community bridges join as a linked device

Section titled “Community bridges join as a linked device”

The most-cited route, whatsapp-mcp, runs a Go bridge built on whatsmeow — the WhatsApp Web multi-device API, the same channel as WhatsApp Web. You pair it by scanning a QR code (re-pair roughly every 20 days); messages land in a local SQLite database, and MCP tools let the agent “search and read your personal WhatsApp messages” and send to individuals or groups. Setup needs Go, Python, and the uv package manager.

Why it’s easier with Codex or Claude Code

Section titled “Why it’s easier with Codex or Claude Code”

The bridge is a local process, and claude.ai and Cowork custom connectors accept only a remote MCP server URL — a local bridge can’t attach there. Claude Code (claude mcp add <name> -- <command>), Codex CLI (codex mcp add or config.toml), and Claude Desktop (claude_desktop_config.json) all run local stdio servers — and a shell-equipped agent can perform the install itself and, MCP aside, query the bridge’s SQLite store directly.

The risks

Section titled “The risks”

WhatsApp’s terms prohibit using the service “in impermissible or unauthorized manners” and building unauthorized equivalents; in 2015 it temporarily banned users of third-party clients. And an agent holding your full message history plus a send tool is the classic prompt-injection setup the project’s own README flags — keep sending behind approvals, and see Agent safeguards.

Zero-setup fallback for reading only: WhatsApp’s per-chat export produces a text file any AI can ingest.

Sources

Section titled “Sources”