---
title: "WhatsApp MCP with Claude: number risks and when to use the official API"
description: "What WhatsApp MCP means, the risks of linking personal chats to Claude, and when a small business should use the official Cloud API for customer support."
author: "Carlos García"
published: 2026-10-28
updated: 2026-10-31
verified: 2026-10-31
language: en
human_url: "https://kiia.cloud/blog/whatsapp-mcp-claude-small-business/"
---

> **In 60 seconds:** a WhatsApp MCP lets Claude or another assistant use tools connected to WhatsApp. Some projects link your personal account through unofficial WhatsApp Web clients; they can read chats and, depending on the project, send messages. That connection can put your number at risk and copy other people's conversations into new systems. A personal read-only experiment requires accepting those limits. For orders, sales or customer support at a small business, choose the official Cloud API, a CRM-connected agent and human review. MCP describes the assistant's connection to its tools; it does not establish whether WhatsApp authorizes the access.

If you search for "Claude WhatsApp" to find a message someone sent weeks ago, you need to query a personal archive. If you want replies from the company number, you are designing a service customers depend on. Decide which job you need before connecting an account.

## What WhatsApp MCP means

[MCP, Model Context Protocol](https://modelcontextprotocol.io/docs/getting-started/intro), is an open standard for connecting AI applications to external tools and data. Its documentation, checked on October 31, 2026, explains that common interface. One server might give the assistant a message search tool; another might expose a send tool.

"WhatsApp MCP" is a description shared by different projects. Check who maintains the server, how it accesses WhatsApp and which permissions it exposes. Claude being able to call a tool does not make the project a Meta product. Meta also offers its own MCP for the business platform: the protocol and the transport into WhatsApp are separate choices.

## Meta also has an official MCP in beta

[WhatsApp Business Tools MCP](https://developers.facebook.com/documentation/mcp/whatsapp-business-tools-mcp) lets an assistant manage and debug a Cloud API integration. Meta's documentation, updated September 3, 2026 and reviewed in a printed copy on **October 31, 2026**, describes tools for managing accounts, registering numbers, managing templates, configuring webhooks and sending messages. It is in beta with a gradual rollout; availability and tools may change.

It uses Meta OAuth and requires admin access to both the business and a WhatsApp-enabled application linked to it. An administrator must accept the Cloud API terms to enable sending and number registration. The send tool asks for recipient confirmation; free-form text is delivered within the 24-hour customer service window, and approved templates are also supported.

This MCP acts on the business assets you administer. The documentation does not offer a search tool for the phone's personal chat history. It helps you work on the official integration; a support operation still needs the workflow, CRM and human oversight described below. Its existence does not authorize bridges that link personal accounts through unofficial clients.

## Two ways to connect the assistant

An unofficial bridge uses a library such as Baileys or whatsmeow to reproduce WhatsApp Web access as a linked device. Cloud API is Meta's business route, available directly or through a solution provider, also called a BSP.

| Aspect | Unofficial bridge: WhatsApp Web / linked device | Official Cloud API: direct or through a BSP |
| --- | --- | --- |
| Number type | The personal projects reviewed link a WhatsApp account; avoid the number your business depends on | Business number onboarded to the platform; check eligibility, migration and possible coexistence for your account |
| Reading and sending | Server-dependent: some only search and read; others also send | Receives business channel messages and events and supports sending under platform rules; it does not search the phone's personal chat archive |
| Ban risk | Possible restriction or loss of the number through unofficial access; read-only does not remove the risk | The official route still faces sanctions for policy violations |
| Terms | The repository's license is not permission from WhatsApp; linking a device does not grant that permission either | Platform terms, messaging policy and any BSP contract; review the specific AI use |
| Where data lives | Local copy or Cloudflare, depending on the project; queried results may reach the AI provider | Meta-hosted transport, then your webhooks, CRM, provider and AI according to the design and contracts |
| Cost, checked October 31, 2026 | finereli offers a free hosted beta with limits; self-hosting requires Workers Paid. Cloudflare publishes a USD 5/month minimum, plus applicable usage. Add AI and operations | Meta bills deliveries by category and market, with current allowances; add any BSP, infrastructure, CRM and AI costs |
| Customer-facing use | We rule it out for support, orders and sending from the company number | Our recommended route for business support, with consent, controls and human escalation |

Sources checked on **October 31, 2026**: [finereli README](https://github.com/finereli/whatsapp-mcp), [lharries README](https://github.com/lharries/whatsapp-mcp), [Workers pricing](https://developers.cloudflare.com/workers/platform/pricing/), [official WhatsApp Business FAQ](https://whatsappbusiness.com/resources/faq/) and [messaging policy](https://whatsappbusiness.com/policy/). The customer-facing recommendation is our operational judgment, not an availability guarantee from Meta.

For provider selection on the official route, see [Meta direct, Twilio or 360dialog](/blog/whatsapp-api-meta-vs-twilio-vs-360dialog/). The decision here is which access to give the assistant.

## What the circulating projects actually do

Repositories change. This review is dated **October 31, 2026** and describes their authors' documentation, without installing or auditing the bridges:

- [finereli/whatsapp-mcp](https://github.com/finereli/whatsapp-mcp) searches and reads without sending. It uses Baileys. It offers a free hosted beta with seat and size limits, plus a copy in your Cloudflare account whose README requires Workers Paid for history imports. The beta's author acknowledges that its login service can derive the data key. Encryption at rest has that trust boundary.
- [lharries/whatsapp-mcp](https://github.com/lharries/whatsapp-mcp) uses whatsmeow, stores messages in local SQLite and supports reading and sending. Its README warns about instruction injection and potential data exfiltration.
- [felipeadeildo/whatsapp-mcp](https://github.com/felipeadeildo/whatsapp-mcp) documents reading, searching and sending from a Cloudflare account. It is a separate implementation; review its permissions and costs separately.

Claims such as "free," "no Baileys" or "no server" need context. finereli's free beta is a hosted offer with limits; self-hosting has expenses. [Workers Paid starts at USD 5 per month](https://developers.cloudflare.com/workers/platform/pricing/), checked October 31, 2026, which is not a quote for the full cost. We do not extend one repository's pricing or permissions to the others.

## When to accept a personal experiment and when to rule it out

A read-only experiment may make sense if you are searching your own messages, can lose the number and have reviewed which conversations will be copied and who can read them. Losing it also affects people who already know you by that number. A personal experiment does not create an exception to the terms.

We rule it out when the number receives orders, supports customers or appears in company campaigns. The same applies when you need to send messages: a wrong search can expose data; a wrong send can also commit a sale or disclose information to another person. Separating [one number per business line](/blog/one-whatsapp-number-per-business-line/) helps define responsibilities but does not authorize unofficial clients.

WhatsApp's [Help Center guidance on responsible use](https://faq.whatsapp.com/361005896189245/?eea=0&locale=en_US), checked October 31, 2026, warns of bans for unauthorized automated or bulk messaging and information extraction for unpermitted purposes. There is no verified ban probability for these projects. An author's description of the risk level is not an independent measurement.

## The risks also involve data and tools

Chats contain messages from third parties who did not choose your AI provider. Identify what an archive contains and limit its scope before importing it. Review storage, backups, retention, operator access and how the assistant handles results. Self-hosting changes who operates the server; you still need to examine every data destination.

A conversation can also contain malicious instructions. Someone could write a message asking the assistant to search other chats and send their contents to an external address. Treating that text as an instruction creates a prompt injection risk. Even if the bridge only reads, other tools connected to the same assistant could allow data to leave. The [lharries warning](https://github.com/lharries/whatsapp-mcp), reviewed October 31, 2026, points to that combination of private access, untrusted content and communication capability.

Separate chat searches from tools that can send or modify records. Limit permissions and require approval before sharing information. Protect session credentials and server secrets as account access; keep them out of prompts, screenshots and logs. Plan how to revoke access and delete the imported copy. These are containment measures, not certification of a bridge.

## For customer support: Cloud API, a CRM and a responsible person

A small business can start with a narrow flow: a question arrives through the official channel, the agent checks the authorized order status in the CRM and drafts a reply. Missing information or a request for a commercial exception sends the case to a person. The [CRM remains the source of truth](/blog/crm-source-of-truth-whatsapp-inbound-follow-up/); chat history supplies context.

The [WhatsApp messaging policy](https://whatsappbusiness.com/policy/), checked October 31, 2026 and dated September 23, 2026, allows automated replies within the 24-hour customer service window and requires clear, direct escalation paths. It also governs consent, opt-outs and templates. The window for replying without a template and the price of a message are separate rules.

On cost, the [official FAQ](https://whatsappbusiness.com/resources/faq/), checked October 31, 2026, says that since October 1, 2026 each business phone number receives 1,000 free service messages a month; charging starts at the 1,001st. The [commercial pricing page](https://whatsappbusiness.com/products/platform-pricing/) still describes service as free. For budgeting, check the [current developer rate card](https://developers.facebook.com/documentation/business-messaging/whatsapp/pricing) and its exemptions, alongside your provider's contract. We do not promise a universal per-message cost.

## What the terms say about AI

Section 4.7 of the [Meta Terms for WhatsApp Business Platform](https://www.facebook.com/legal/Meta-Terms-for-WhatsApp-Business-Platform), updated **September 23, 2026** and reviewed in a printed copy on **October 31, 2026**, restricts AI Providers' access when they offer those technologies as the primary functionality. Meta determines what constitutes that primary function. The clause provides exceptions for certain countries and points to its [AI Providers documentation](https://developers.facebook.com/documentation/business-messaging/whatsapp/pricing/ai-providers). Do not extend an exception to all of LATAM: check the country and conditions before offering a general-purpose assistant.

The same section allows a business to engage an AI Provider as a solution provider. It prohibits using platform data, including anonymous or derived forms, to create, train or improve AI models; it allows fine-tuning a model for the business's exclusive use provided this does not help create or improve other models. Review what data your provider keeps and how it uses it.

An agent that checks your order status has a different scope from distributing a general-purpose assistant through WhatsApp. Define that scope in the contracted service and apply messaging policies, data limits and human escalation. Permission to engage an AI Provider does not authorize every use of the platform.

## Where n8n fits

In n8n, the built-in [WhatsApp Business Cloud](https://docs.n8n.io/integrations/builtin/app-nodes/n8n-nodes-base.whatsapp/) and [WhatsApp Trigger](https://docs.n8n.io/integrations/builtin/trigger-nodes/n8n-nodes-base.whatsapptrigger/) nodes, verified October 31, 2026, cover sending and events for the official integration. They can coordinate the CRM and human review. n8n does not make every community node you connect official. For workflow logic, read [n8n or a WhatsApp agent](/blog/n8n-or-whatsapp-agent-crm/); for implementation planning, see [building a CRM-connected sales agent](/blog/how-to-build-a-sales-agent-whatsapp-crm/).

## When to wait

If you cannot yet say who handles an exception, where the correct order status lives or which data each person may access, start there. Keep support manual and test with fictional cases while you define the process. An MCP adds access that somebody will have to operate and review.

Before granting send permissions, define [guardrails against unauthorized quotes](/blog/whatsapp-sales-agent-messaging-guardrails/) and [test the agent before production](/blog/test-whatsapp-ai-agent-before-production/). If your customers do not yet require WhatsApp, compare [WhatsApp, Telegram and web chat](/blog/whatsapp-vs-telegram-vs-web-chat-ai-agent/) before committing a number.

## Frequently asked questions

### Can my number be banned for using WhatsApp MCP?

Yes. If the connection uses an unofficial client, your account may be restricted or closed. Read-only access does not guarantee an exception to the terms. There is no verified ban probability for your case. The official API can also face sanctions for policy violations.

### Can Claude connected to WhatsApp handle customer support?

For business support, use the official Cloud API with an agent scoped to the process, controlled CRM access and a clear path to a human. A server that searches personal chats, especially a read-only one, is not a support inbox or a production integration. Review the terms applicable to your AI use before committing.

### What do I need to use the official API?

Business onboarding on Meta's platform, an eligible number, permissions and credentials, an event receiver, and an application or provider that manages replies. Add consent, templates where required, a CRM, human oversight and a budget for messaging and infrastructure. Check onboarding and migration requirements for your account.