# Wapiworld WhatsApp API

> Check your WhatsApp numbers, connection status and webhooks, and send a text when you confirm.

- name: com.wapiworld/wapiworld
- version: 0.1.1
- connection class: R0 (autonomous)
- trust: 83/100 flags: no-repository
- quality: 79/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/com.wapiworld%2Fwapiworld
- tools: https://api.protogrid.dev/v1/servers/com.wapiworld%2Fwapiworld/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "wapiworld": {
      "type": "http",
      "url": "https://mcp.wapiworld.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 55
- drivers: +dns-namespace +website +reachable +uptime-100% +updated-22d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 79/100 (good)

### protocol: 88 (weight 25)

- pass `protocol.modern`: supports 2026-07-28 (server/discover)
- pass `protocol.stateless`: answers without a session
- pass `protocol.transport`: streamable HTTP
- warn `protocol.list_ttl`: tools/list declares ttlMs 0, so clients re-fetch it on every use

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 8 of 8 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 1,680 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump

### stability: 25 (weight 15)

- warn `stability.changes`: 8 tool changes in 30 days
- fail `stability.rug_pull`: 8 tools kept their name but changed most of their description in 30 days; review before trusting them

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 8, about 1,680 tokens to load them all
- tool set hash: 2036f2295aa47a020980922b4eff006b
- tools last changed: 2026-10-05T13:56:59.428Z
- badge: [![protogrid quality](https://protogrid.dev/badge/com.wapiworld/wapiworld.svg)](https://protogrid.dev/servers/com.wapiworld/wapiworld)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

- 2026-10-05 `show_project_overview` changed (description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: Render a bounded operational overview for one tenant-scoped Wapiworld project, including WhatsApp instance health and safe phone metadata. QR pairing codes, instance credentials, API keys, proxy data, and arbitrary stored fields are excluded.
  - after: Use this when someone wants a quick overview or dashboard of one Wapiworld project's WhatsApp numbers. Returns an overview card with the project name, how many instances are ready, pairing, starting, offline or unknown (counting up to 100), and up to 20 instances with phone and status. Not for sending a message.
- 2026-10-05 `send_message` changed (description, inputSchema, outputSchema) **meaning changed**
  - before: Send one real external WhatsApp text message through a tenant-scoped Wapiworld instance. This destructive, open-world action is non-idempotent: show the exact sender instance, recipient and complete text, obtain explicit confirmation for one send, call once, and never retry automatically when the outcome is uncertain. Do not include restricted data. Existing Wapiworld recording settings may persist outbound content.
  - after: Use this when someone asks to send a WhatsApp message from one of their Wapiworld numbers. Returns only that Wapiworld accepted the send, not proof of delivery. The message goes out immediately, each call sends another copy, and recording settings may store its text. Not for broadcasts or bulk sends.
- 2026-10-05 `list_webhook_subscriptions` changed (title, description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: List a bounded page of the organization’s Wapiworld webhook subscriptions with their subscribed events and delivery health, so a stopped webhook can be diagnosed. An endpoint that fails 20 deliveries in a row is disabled automatically. Requires an operator OAuth session; API-key sessions cannot read this route. The signing secret is never returned, and only the scheme and host of the delivery URL are shown because hook paths often embed a credential.
  - after: Use this when someone asks whether their Wapiworld webhooks are working, failing or were switched off. Returns each subscription's endpoint scheme and host, events, active state, consecutive failures and an auto-disabled flag after 20 failures, 25 per page by default. Works only with an operator OAuth session, not an API key. Not for changing a webhook.
- 2026-10-05 `get_message_recording_policy` changed (title, description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: Inspect whether message-content persistence is enabled by default for one tenant-scoped Wapiworld instance and how long recorded rows are retained. This directory-safe diagnostic never reads message bodies, previews, sender names, contact identifiers, chat-level override keys, or WhatsApp message ids.
  - after: Use this when someone asks whether Wapiworld stores the text of WhatsApp messages for a number, or how long it keeps them. Returns whether recording is on for the instance, whether the default, project or instance decided it, any lock, and the project's retention in days. Not for reading recorded messages.
- 2026-10-05 `get_instance_status` changed (title, description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: Fetch the current safe connection health for one tenant-scoped Wapiworld instance without returning QR pairing codes or authentication data.
  - after: Use this when someone asks whether a WhatsApp number is connected, waiting for QR pairing, starting or offline. Returns the instance's name, raw status and a health value: ready, pairing, starting, offline or unknown (no QR codes or credentials). Not for whether a sent message was delivered.
- 2026-10-05 `get_instance` changed (title, description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: Fetch safe operational details for one tenant-scoped Wapiworld WhatsApp instance. QR pairing codes, instance secrets, API keys, proxy addresses, organization ids, and arbitrary stored metadata are never returned.
  - after: Use this when someone asks about one connected WhatsApp number, such as its phone number, account name or connection health. Returns the instance's name, account name, phone number, project, status and health, or not-found. Not for message history, which this connector does not read.
- 2026-10-05 `list_instances` changed (title, description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: List a bounded page of tenant-scoped Wapiworld WhatsApp instances, optionally filtered by project. Results include operational status and phone metadata but never QR pairing codes, instance secrets, API keys, proxy data, or arbitrary stored fields.
  - after: Use this when someone asks which WhatsApp numbers they have connected to Wapiworld, or which ones are offline. Returns each instance's id, name, WhatsApp account name, phone number, connection status and health, 25 per page by default, optionally for one project (no QR codes, secrets or API keys). Not for sending a message.
- 2026-10-05 `list_projects` changed (title, description, inputSchema, outputSchema, annotations) **meaning changed**
  - before: List a bounded page of Wapiworld projects available to the authenticated organization. API-key sessions remain pinned to their single project. Internal organization ids and project configuration are omitted.
  - after: Use this when someone asks which Wapiworld projects they have, or a project's id is needed. Returns each project's id, name and creation and edit times, 25 per page by default, with a cursor for more. Not for their WhatsApp numbers.

Full history: https://api.protogrid.dev/v1/servers/com.wapiworld%2Fwapiworld/changes

## Remotes

- https://mcp.wapiworld.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (8)

- `get_instance`: Use this when someone asks about one connected WhatsApp number, such as its phone number, account name or connection health. Returns the instance's name, account name, phone number, project, status and health, or not-found. Not for message history, which this connector does not read.
- `get_instance_status`: Use this when someone asks whether a WhatsApp number is connected, waiting for QR pairing, starting or offline. Returns the instance's name, raw status and a health value: ready, pairing, starting, offline or unknown (no QR codes or credentials). Not for whether a sent message was delivered.
- `get_message_recording_policy`: Use this when someone asks whether Wapiworld stores the text of WhatsApp messages for a number, or how long it keeps them. Returns whether recording is on for the instance, whether the default, project or instance decided it, any lock, and the project's retention in days. Not for reading recorded messages.
- `list_instances`: Use this when someone asks which WhatsApp numbers they have connected to Wapiworld, or which ones are offline. Returns each instance's id, name, WhatsApp account name, phone number, connection status and health, 25 per page by default, optionally for one project (no QR codes, secrets or API keys). Not for sending a message.
- `list_projects`: Use this when someone asks which Wapiworld projects they have, or a project's id is needed. Returns each project's id, name and creation and edit times, 25 per page by default, with a cursor for more. Not for their WhatsApp numbers.
- `list_webhook_subscriptions`: Use this when someone asks whether their Wapiworld webhooks are working, failing or were switched off. Returns each subscription's endpoint scheme and host, events, active state, consecutive failures and an auto-disabled flag after 20 failures, 25 per page by default. Works only with an operator OAuth session, not an API key. Not for changing a webhook.
- `send_message`: Use this when someone asks to send a WhatsApp message from one of their Wapiworld numbers. Returns only that Wapiworld accepted the send, not proof of delivery. The message goes out immediately, each call sends another copy, and recording settings may store its text. Not for broadcasts or bulk sends.
- `show_project_overview`: Use this when someone wants a quick overview or dashboard of one Wapiworld project's WhatsApp numbers. Returns an overview card with the project name, how many instances are ready, pairing, starting, offline or unknown (counting up to 100), and up to 20 instances with phone and status. Not for sending a message.