whatsrust exposes 22 WhatsApp bridge tools with generally consistent naming patterns (verb_noun format: send, reply, react, edit, revoke, etc.). All tools have descriptions present, though many are brief (30-80 chars). Input schemas are well-formed with proper JSON Schema types and required fields. However, parameter descriptions are inconsistent, some parameters lack explanations ('from_me' in whatsrust_react has no description; 'vcard' in whatsrust_contact is undocumented). Output schemas are not documented anywhere in the provided code. Error handling appears minimal, no recovery guidance, no error classification, and no examples of validation feedback. The tool set covers a broad WhatsApp API surface but lacks composition safeguards (e.g., no idempotency markers, no confirmation patterns for destructive operations like whatsrust_revoke). Security considerations are present (tool risks are labeled READ_ONLY, WRITE, DESTRUCTIVE) but not enforced at the MCP layer.

• Add full parameter descriptions to whatsrust_react ('from_me': whether the target message was sent by the bridge user, defaults to true), whatsrust_image ('mime': MIME type, defaults to image/jpeg), whatsrust_location (all location fields with GPS format hints), whatsrust_contact ('vcard': vCard format string per RFC 6350), and whatsrust_poll ('selectable_count': max options per vote).
• Document return types for discovery tools: whatsrust_history should return [{ id: string, sender: string, text: string, timestamp: number }]; whatsrust_search should return [{ id: string, jid: string, text: string, timestamp: number }] with total_count for pagination chaining.
• Add constraint hints to JID parameters: '([email protected] for direct messages, [email protected] for groups)' so LLMs validate format before calling.
• Implement confirmation pattern for destructive tools: add optional 'confirm_token' parameter to whatsrust_revoke and whatsrust_edit. First call returns { confirm_required: true, token: '...' }, second call with token executes irreversibly.
• Expand tool descriptions to 100-200 chars with WHEN guidance. Example: 'Send a text message with optional @mentions and link previews. Use for general messages; use whatsrust_reply to quote a specific message.' This helps LLM differentiate whatsrust_send vs. whatsrust_reply.
• Add explicit error handling descriptions to whatsrust_send: 'Returns error if JID invalid, recipient blocked, or rate-limited. If rate-limited, wait 60s and retry.'
• Document result limits in whatsrust_history and whatsrust_search descriptions: 'Returns up to {limit} messages (default 20, max 100) newest first. Use {before} Unix timestamp for pagination.'

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry