whatsapp-mcp

The system consists of a Go-based WhatsApp bridge and a Python-based MCP server. The Go bridge, which handles direct WhatsApp communication, binds its REST API to `localhost:8080`. This local binding limits direct external network exposure. Session data and message history are stored in local SQLite databases (`store/whatsapp.db`, `store/messages.db`). While convenient, these local databases are not explicitly encrypted in the provided code, meaning if the host system itself is compromised, chat history could be accessed. Input validation for messages sent via the API is basic, relying on the underlying `whatsmeow` library and WhatsApp API to handle message content safely. No 'eval' or other obvious malicious patterns or hardcoded secrets were found.