Skip to content

Add MCP server for the public API#355

Merged
ArnasDon merged 1 commit into
mainfrom
feature/mcp-server
Jul 8, 2026
Merged

Add MCP server for the public API#355
ArnasDon merged 1 commit into
mainfrom
feature/mcp-server

Conversation

@ArnasDon

@ArnasDon ArnasDon commented Jul 8, 2026

Copy link
Copy Markdown
Owner

What

Adds mcp-server/ — a stdio Model Context Protocol server that wraps the existing /api/v1 public API, so MCP clients (Claude Desktop, Claude Code, Cursor, …) can drive a self-hosted wacrm instance in natural language.

It's a thin adapter: all auth, scoping, and rate limiting stay server-side in the CRM. No new backend surface.

Tools

  • Reads (always on): whoami, list_contacts, get_contact, list_conversations, get_conversation, list_messages, get_broadcast.
  • Writes (opt-in via WACRM_ENABLE_WRITES): send_message, create_contact, update_contact.
  • Broadcasts (opt-in via WACRM_ENABLE_BROADCASTS): send_broadcast.

Safety model (three layers)

Sending WhatsApp through an LLM is a real side effect, so:

  1. Read-only by default — write/broadcast tools aren't even registered unless their env guard is set, so the model can't see them.
  2. API-key scopes are still enforced server-side (missing scope → clean forbidden). A read-only key + read-only config physically cannot send.
  3. send_broadcast requires confirm: true and is marked destructive.

Registry-ready

  • server.json manifest + package.json mcpName (io.github.arnasdon/wacrm-mcp) linked for official MCP-registry validation.
  • glama.json for Glama discovery.

Docs

  • docs/mcp.md (product) + README bullet + mcp-server/README.md (client config, tool table, safety model).

Verification

  • npm run build / typecheck clean (SDK 1.29.0).
  • Live stdio JSON-RPC handshake: 7 tools read-only → 10 with writes → 11 with broadcasts; annotations correct.
  • Tool calls against a mock instance: successful envelope unwrap, forbidden rendered cleanly, broadcast confirm-guard blocks confirm:false.

🤖 Generated with Claude Code

Introduce mcp-server/ — a stdio Model Context Protocol server that
wraps the /api/v1 public API so MCP clients (Claude, Cursor, etc.) can
drive a self-hosted wacrm instance in natural language.

- Thin wrapper over the existing REST API; all auth, scoping, and rate
  limiting stay server-side. No new backend surface.
- Read-only by default: write and broadcast tools are only registered
  when WACRM_ENABLE_WRITES / WACRM_ENABLE_BROADCASTS are set, layered
  on top of the API key's own scopes. send_broadcast also requires an
  explicit confirm and is marked destructive.
- Registry-ready: server.json manifest, package.json mcpName linked to
  it (io.github.arnasdon/wacrm-mcp), and glama.json for discovery.
- Docs: docs/mcp.md + README bullet + mcp-server/README.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@supabase

supabase Bot commented Jul 8, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project crxylxakpapcfziradbb because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

@ArnasDon ArnasDon merged commit 9441533 into main Jul 8, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant