# io.github.codespar/mcp-whatsapp-cloud (npm · @codespar/mcp-whatsapp-cloud)

MCP server for WhatsApp Cloud API (Meta) — messages, media, and templates via Graph API

- Trust score: 69/100 (medium)
- Change this week: +23
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- npm · `@codespar/mcp-whatsapp-cloud`: 69/100 (this document), [markdown](https://verifymcp.io/servers/codespar-mcp-whatsapp-cloud/codespar-mcp-whatsapp-cloud.md), [page](https://verifymcp.io/servers/codespar-mcp-whatsapp-cloud/codespar-mcp-whatsapp-cloud)

## Channel facts

- Registry: `npm`
- Package: `@codespar/mcp-whatsapp-cloud`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 86/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 42 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1955 tokens (~88/item across 22 items; 22 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add codespar-mcp-whatsapp-cloud -- npx -y @codespar/mcp-whatsapp-cloud
```

### Codex

```bash
codex mcp add codespar-mcp-whatsapp-cloud -- npx -y @codespar/mcp-whatsapp-cloud
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "codespar-mcp-whatsapp-cloud": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@codespar/mcp-whatsapp-cloud"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add codespar-mcp-whatsapp-cloud --command npx --arg -y --arg @codespar/mcp-whatsapp-cloud
```

### Hermes

```yaml
mcp_servers:
  codespar-mcp-whatsapp-cloud:
    command: "npx"
    args: ["-y", "@codespar/mcp-whatsapp-cloud"]
```

### Other

```json
{
  "mcpServers": {
    "codespar-mcp-whatsapp-cloud": {
      "command": "npx",
      "args": [
        "-y",
        "@codespar/mcp-whatsapp-cloud"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-03 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 67, +47)

- [security regression] Provenance: unverified → fail
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-08-01 (score 20, −1)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-31 (score 21, −25)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (22)

### `send_text_message` (~100 tokens)

Send a plain text message. For business-initiated conversations outside the 24h customer-service window, use send_template_message instead.

Input parameters:

- `body` (string, required): Message text (UTF-8, up to 4096 chars)
- `preview_url` (boolean): Enable URL preview for links in body (default false)
- `to` (string, required): Recipient phone number in E.164 without + (e.g. 5511999999999)

### `send_template_message` (~113 tokens)

Send an approved message template. Required for business-initiated conversations. Templates must be pre-approved by Meta via create_template.

Input parameters:

- `components` (array): Template component parameters (header, body, button). See Cloud API docs for shape.
- `language_code` (string, required): BCP-47 language tag (e.g. en_US, pt_BR, es_MX)
- `template_name` (string, required): Exact name of the approved template
- `to` (string, required): Recipient phone number in E.164 without +

### `send_media_message` (~130 tokens)

Send an image, video, document, or audio. Supply either `link` (public URL) or `id` (media_id from upload_media).

Input parameters:

- `caption` (string): Optional caption (image, video, document only)
- `filename` (string): Optional filename (document only)
- `id` (string): Uploaded media_id from upload_media. Use this OR link.
- `link` (string): Public HTTPS URL of the media. Use this OR id.
- `media_type` (string, required): Kind of media
- `to` (string, required): Recipient phone number in E.164 without +

### `send_interactive_message` (~103 tokens)

Send an interactive message (reply buttons or list). Supply a fully-formed `interactive` object per Cloud API spec.

Input parameters:

- `interactive` (object, required): Interactive payload. For buttons: { type: 'button', body: { text }, action: { buttons: [...] } }. For list: { type: 'list', body: { text }, action: { button, sections } }.
- `to` (string, required): Recipient phone number in E.164 without +

### `send_interactive_cta_url` (~122 tokens)

Send an interactive message with a single CTA URL button. Opens the URL when the recipient taps it. Available without template approval inside the 24h window.

Input parameters:

- `body_text` (string, required): Main body text
- `button_text` (string, required): Label shown on the CTA button (max 20 chars)
- `footer_text` (string): Optional footer text
- `header_text` (string): Optional header text
- `to` (string, required): Recipient phone number in E.164 without +
- `url` (string, required): HTTPS URL the button opens

### `send_interactive_flow` (~190 tokens)

Send a WhatsApp Flow message. Flows are Meta's structured UI experiences (forms, appointment booking, etc.) rendered inside WhatsApp.

Input parameters:

- `body_text` (string, required): Body text above the CTA
- `flow_action` (string): Flow action type (default navigate)
- `flow_action_payload` (object): Optional action payload: { screen, data }. Required for navigate.
- `flow_cta` (string, required): Label on the button that opens the flow (max 20 chars)
- `flow_id` (string, required): ID of the approved Flow
- `flow_token` (string, required): Opaque token your server correlates with this send
- `footer_text` (string): Optional footer text
- `header_text` (string): Optional header text
- `mode` (string): Flow mode. Use draft while testing.
- `to` (string, required): Recipient phone number in E.164 without +

### `send_location_message` (~73 tokens)

Send a location pin with latitude/longitude and optional name/address.

Input parameters:

- `address` (string): Optional location address
- `latitude` (number, required): Latitude
- `longitude` (number, required): Longitude
- `name` (string): Optional location name
- `to` (string, required): Recipient phone number in E.164 without +

### `send_contacts_message` (~84 tokens)

Send one or more contact cards (vCard-like). Each contact includes name and at least one of phones, emails, addresses, urls, or org.

Input parameters:

- `contacts` (array, required): Array of contact objects per Cloud API spec (name, phones, emails, addresses, org, urls, birthday).
- `to` (string, required): Recipient phone number in E.164 without +

### `send_reaction_message` (~81 tokens)

Send an emoji reaction on a previously received/sent message. Pass empty string for `emoji` to clear a reaction.

Input parameters:

- `emoji` (string, required): Single unicode emoji. Empty string clears the reaction.
- `message_id` (string, required): wamid of the message being reacted to
- `to` (string, required): Recipient phone number in E.164 without +

### `send_typing_indicator` (~58 tokens)

Show a typing indicator on a received message. Also marks the message as read. Indicator auto-clears after ~25s or when you reply.

Input parameters:

- `message_id` (string, required): wamid of the inbound message to show the indicator on

### `mark_message_as_read` (~55 tokens)

Mark an incoming message as read so the sender sees the blue double-check. Uses the wamid from the inbound webhook.

Input parameters:

- `message_id` (string, required): Inbound message id (wamid.XXX) from the webhook

### `upload_media` (~93 tokens)

Upload a media file and get back a media_id reusable in send_media_message. Multipart POST to /{phone_number_id}/media.

Input parameters:

- `file_base64` (string, required): File contents, base64-encoded
- `filename` (string, required): Filename (used for display and extension inference)
- `mime_type` (string, required): MIME type (e.g. image/jpeg, video/mp4, application/pdf, audio/ogg)

### `retrieve_media_url` (~51 tokens)

Resolve a media_id to a short-lived downloadable URL. The URL itself still requires the Bearer token to fetch.

Input parameters:

- `media_id` (string, required): Media id returned by upload_media or received in a webhook

### `delete_media` (~28 tokens)

Delete an uploaded media asset by id.

Input parameters:

- `media_id` (string, required): Media id to delete

### `list_templates` (~79 tokens)

List message templates on the WhatsApp Business Account. Supports optional paging and name filter.

Input parameters:

- `limit` (number): Max templates per page (default 25)
- `name` (string): Filter by exact template name
- `status` (string): Filter by status (APPROVED, PENDING, REJECTED, PAUSED, DISABLED)

### `create_template` (~125 tokens)

Submit a new template for Meta review. Templates become usable only after approval (usually minutes to hours).

Input parameters:

- `allow_category_change` (boolean): Let Meta re-categorize if needed (default true recommended)
- `category` (string, required): Template category
- `components` (array, required): Array of components: HEADER, BODY, FOOTER, BUTTONS. See Cloud API template docs.
- `language` (string, required): BCP-47 language tag (e.g. en_US, pt_BR)
- `name` (string, required): Template name (lowercase, underscores, unique on WABA)

### `delete_template` (~71 tokens)

Delete a message template from the WABA by name. Optionally scope by hsm_id when two templates share a name across languages.

Input parameters:

- `hsm_id` (string): Optional template id (when multiple languages share a name and only one should be deleted)
- `name` (string, required): Template name to delete

### `get_business_profile` (~63 tokens)

Read the WhatsApp business profile (about, description, email, websites, vertical, address) for the configured phone number.

Input parameters:

- `fields` (string): Comma-separated field list. Default: about,address,description,email,profile_picture_url,websites,vertical

### `update_business_profile` (~104 tokens)

Update the business profile on the configured phone number. Supply only the fields you want to change.

Input parameters:

- `about` (string): About text (max 139 chars)
- `address` (string): Physical address
- `description` (string): Business description
- `email` (string): Contact email
- `vertical` (string): Business vertical (e.g. RETAIL, EDU, HEALTH, FINANCE, OTHER)
- `websites` (array): Up to two URLs

### `list_phone_numbers` (~47 tokens)

List all phone numbers registered under the WhatsApp Business Account, including display name, quality rating, and verification status.

Input parameters:

- `limit` (number): Max results per page (default 25)

### `request_verification_code` (~74 tokens)

Request Meta to send a verification code to the configured phone number via SMS or voice. Use before verify_code.

Input parameters:

- `code_method` (string, required): Delivery method for the verification code
- `language` (string, required): BCP-47 language tag for the voice/SMS copy (e.g. en_US, pt_BR)

### `verify_code` (~44 tokens)

Submit the verification code received via SMS/voice after request_verification_code. Completes registration.

Input parameters:

- `code` (string, required): Verification code received (digits only, strip dashes)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/codespar-mcp-whatsapp-cloud/codespar-mcp-whatsapp-cloud#diagnostics

## Score history

- 2026-08-04: 69
- 2026-08-03: 68
- 2026-08-02: 67
- 2026-08-01: 20
- 2026-07-31: 21
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@codespar/mcp-whatsapp-cloud
- Socket report: https://socket.dev/npm/package/@codespar/mcp-whatsapp-cloud
- Repository: https://github.com/codespar/mcp-dev-latam
- Changelog RSS feed: https://verifymcp.io/servers/codespar-mcp-whatsapp-cloud/codespar-mcp-whatsapp-cloud/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/codespar-mcp-whatsapp-cloud/codespar-mcp-whatsapp-cloud/changelog.json
- HTML version of this page: https://verifymcp.io/servers/codespar-mcp-whatsapp-cloud/codespar-mcp-whatsapp-cloud