An implementation of the Model Context Protocol (MCP) designed to act as a bridge between an MCP-compliant client and the ChatKazi WhatsApp API gateway.
ChatKazi MCP defines 7 tools with complete input schemas and descriptions. All tools follow verb_noun naming (list_, start_, get_, send_). Descriptions are present and actionable (avg ~80 chars). However, output schemas are entirely undocumented, callers cannot predict response structure. Parameter descriptions lack format constraints (e.g., phone number format is mentioned but not enforced via pattern). No error handling guidance, no recovery hints, and no idempotency markers. Security concern: sessionId defaults to 'default' silently, risking unintended session reuse. Missing tool annotations (readOnlyHint, destructiveHint) despite clear read/write semantics.
Retrieve the QR code pairing link for an initialized session.
Check the current state of a specific WhatsApp session (e.g., connected, qr_ready).
List all WhatsApp sessions connected to the ChatKazi account.
Disconnect and log out a WhatsApp session, clearing its authentication state.
Send a media message (image, video, audio, or document) to a recipient.
Send a plain text WhatsApp message to a recipient.
No output schemas documented. Callers cannot predict response structure, field names, or types. LLMs must guess what fields to extract for downstream tool calls.
Missing tool annotations (readOnlyHint, destructiveHint). Tools like logout_session and send_whatsapp_* are clearly destructive/write operations but lack explicit markers. Agents cannot distinguish safe from unsafe tools without reading descriptions.
No error handling guidance. Tool responses return JSON strings without structure. If an API call fails, the LLM receives a raw error message with no recovery hints (e.g., 'Try list_sessions() first to find valid sessionId').
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
Initialize a new WhatsApp session connection.
Phone number format constraint mentioned in description ('international format without spaces or +') but not enforced via JSON Schema pattern. LLMs may pass invalid formats; validation happens server-side with no client-side guidance.
Silent default for sessionId='default' in send_whatsapp_text and send_whatsapp_media. If LLM omits sessionId, message silently sends from 'default' session, risking unintended behavior. Defaults should not cause side effects.