Best WhatsApp MCP Server to Read Inbox Messages: GitHub and Kondo
Published On October 15, 2026
Summary
- A WhatsApp MCP server connects an inbox to an AI assistant, enabling it to query, search and organise conversations without the operator switching between applications.
- Nearly every self-hosted server relies on the linked-device method, which WhatsApp actively detects: developers report accounts blocked within days, in one documented case after serving only seven users.
- Kondo is a managed alternative that operates the session already open on the machine, under a draft, never send policy: the AI reads the inbox and composes replies, while the operator presses Send.
Connecting an AI assistant to WhatsApp is a workflow problem that businesses encounter routinely. Teams managing sales pipelines, recruiters tracking candidates and professionals handling client communications all require the ability to query an inbox without switching context. The Model Context Protocol (MCP) makes this technically possible: a WhatsApp MCP server exposes the inbox as callable tools, which an AI assistant such as Claude can invoke directly.
The practical obstacle is account safety. Nearly every self-hosted implementation carries a documented account-restriction risk. That single constraint governs every choice in this comparison.
The risk of getting banned
Most open-source WhatsApp MCP servers are built on libraries such as Baileys or whatsmeow. Both operate by attaching to a personal WhatsApp account as a second linked device and pulling down message history. WhatsApp's systems actively detect this pattern.
The Hacker News discussion around WhatsApp MCP tooling confirms that this is not a gray area. Developers with direct experience report that Baileys-based agents were blocked within days, in one documented case after serving only seven users. These are not edge cases caused by misconfiguration. The linked-device mechanism itself is the trigger.
The only route that sits fully inside WhatsApp's approved developer platform is the official WhatsApp Business API. It avoids the linked-device exposure, but it is consistently described as costly and time-consuming to set up, which places it out of reach for most individual users and small teams.
That leaves two realistic options for most operators: the most prominent open-source project, lharries/whatsapp-mcp, and a managed desktop alternative, Kondo. Both implement a whatsapp mcp server, but with fundamentally different approaches to the session: the self-hosted server attaches to the account as a second linked device, while Kondo operates the session already open on the machine and never automates sending.
lharries/whatsapp-mcp: capabilities and critical limitations
lharries/whatsapp-mcp is a self-hosted server written in Go and Python, using the whatsmeow library to bridge WhatsApp and an MCP-compatible AI client. It exposes several tools relevant to inbox reading:
list_chats: returns a list of active conversationsget_messages_by_contact/get_messages_by_chat: retrieves thread historysearch_contacts: finds contacts by name or numbersend_messageandsend_file: enable programmatic outbound sending that an AI client can invoke
The read tools are functional. The send tools introduce a further consideration: an AI client with send access can message from the account without a human reviewing each action, which compounds the account-restriction exposure.
Project health is the more immediate problem. As of late 2026, the repository carries 94 open issues and 161 open pull requests, with no recent maintainer activity. The project was flagged as likely abandonware as early as January 2026, and no fork has emerged as a clearly maintained alternative.
On privacy, messages are stored locally but are not encrypted at rest in the default configuration. A fork, adelaidasofia/whatsapp-mcp, adds local encryption but introduces a separate concern noted in the Hacker News thread: it transmits data to an external server.
One previously circulated option, ftaricano/mcp-whatsapp, is no longer available.
Kondo: a managed WhatsApp MCP server with a safety-first architecture
Kondo is a desktop application that runs a local MCP server on the user's machine. Installation consists of downloading the application and setting up your MCP connection in Claude, ChatGPT or any AI Agents you use.
Kondo reads and drafts through the WhatsApp session already open on the machine, and the agent never receives WhatsApp credentials. The design decision that distinguishes it from self-hosted alternatives is its draft, never send policy. An AI agent can use compose a reply, but it cannot transmit the message. That removes the autonomous-send exposure and keeps every outbound message under human review.
The inbox reading tools available through Kondo cover the core use cases:
list_chats: supports search by contact name or keyword within message contentread_chat: retrieves the full thread history for a conversationset_chat_label: applies labels such as Leads or Clients to organise conversationsset_reminder: creates a follow-up prompt for a specific threadarchive_chat: removes a conversation from the active inbox view
Messages remain on the user's computer. Kondo runs a local MCP server on the machine, and message content is never transmitted to Kondo's servers: the only outside service that sees it is the AI provider the user has chosen to connect. Kondo itself stores only organisational metadata and never conversation content.
For teams running outreach or client communication workflows, Kondo also covers LinkedIn DMs alongside WhatsApp within the same product. CRM integrations are supported for HubSpot, Salesforce, Notion, and Clay, and the company publishes a guide to syncing those conversations to Salesforce and HubSpot. Kondo is in active use by teams at lemlist, Superhuman, Mercury, and Khosla Ventures, which indicates the product has been tested against professional-grade messaging volumes.
Side-by-side comparison
Feature | lharries/whatsapp-mcp | Kondo
Ban risk | Elevated. The linked-device method operates outside WhatsApp's approved developer platform. Programmatic send capability increases exposure. | Lower. The session runs on the user's own machine, and the draft-only policy keeps every send manual.
Setup | High. Go/Python build from source. CLI required. macOS and Linux only. | Low. Install the app, paste one URL. All major operating systems.
Maintenance | Unmaintained. 94+ open issues, 161+ open PRs, no recent updates. | Actively maintained commercial product.
Inbox read tools | list_chats, get_messages_by_contact, search_contacts | list_chats (with keyword search), read_chat, set_chat_label, set_reminder, archive_chat
Send capability | Programmatic sending via send_message and send_file | Drafts only. Human must approve before sending.
Privacy | Local server. Messages are not encrypted at rest by default. | Local server. Messages remain on the user's computer; the only outside service that sees message content is the AI provider the user connects.
Platform coverage | WhatsApp only | WhatsApp and LinkedIn DMs
Cost | Free (open-source) | Paid subscription
Which server fits your situation
The choice follows from a single consideration: the consequence of a WhatsApp account ban.
For developers and hobbyists running experiments on a secondary number, accepting the documented risk and requiring full source access to a self-hosted whatsapp mcp server implementation, lharries/whatsapp-mcp is a working starting point. Treat it as an educational tool, account for the build complexity, and do not run it against an account you cannot afford to lose. The project's maintenance state also means any dependency break requires manual intervention with no guarantee of an upstream fix.
For professional users, sales teams and recruiting operations where WhatsApp is a primary communication channel an account ban is a material business disruption. Kondo's draft, never send architecture removes the autonomous-send path, the local server keeps messages on the user's own machine, and the managed application removes the ongoing maintenance burden that an unmaintained open-source project cannot. The addition of LinkedIn DMs within the same product further reduces the tooling surface for teams running multi-channel outreach.
The most capable whatsapp mcp server on paper is not necessarily the most useful one in practice. A server that reads an inbox reliably and never acts without human approval is more valuable, for teams that do business in their inbox, than one that can do more but carries a higher account-restriction risk.
WhatsApp MCP server: frequently asked questions
What is a WhatsApp MCP server?
A WhatsApp MCP server connects a WhatsApp inbox to an AI assistant through the Model Context Protocol, exposing tools such as list_chats and read_chat. The AI can then query, search and organise conversations directly, without the operator switching between applications.
Will connecting WhatsApp to an AI get my account banned?
Possibly. Most servers use the linked-device method, which operates outside WhatsApp's approved developer platform and is actively detected: accounts have been blocked within days. Only the official WhatsApp Business API sits fully inside that platform. Draft-only tools such as Kondo lower the risk.
Can an AI send WhatsApp messages on my behalf?
Some servers can, using tools such as send_message. However, programmatic sending increases account-restriction risk and removes human oversight. Kondo follows a draft, never send policy: the AI composes the reply, and the operator presses send.
Does WhatsApp MCP work on Windows?
lharries/whatsapp-mcp does not run on Windows — the build fails due to a GCC dependency. Kondo works across all major operating systems, including Windows, macOS, and Linux.
Which WhatsApp MCP server should I choose?
It depends on ban risk. Use lharries/whatsapp-mcp only for experiments on a number you can afford to lose. For business-critical WhatsApp, choose Kondo: the session runs on the user's own machine, every reply stays a draft until the operator sends it, and the product is actively maintained.