Sign inRequest access

AI Agents (MCP)

Warsita runs a Model Context Protocol server, so an AI agent such as Claude Code, Cursor or VS Code can send WhatsApp messages and look up contacts, groups and message status for you. There is nothing to install: add the endpoint to your client and sign in to Warsita, or give it an API key.
Endpoint https://api.warsita.com/mcp (Streamable HTTP)
Authentication OAuth sign-in, or Authorization: Bearer wsk_… (a session API key) or Bearer wsp_… (a personal access token)

When you sign in, you choose one WhatsApp number or every number in the workspace. Likewise, a session API key limits the agent to one number, which is the safer choice, while a personal access token lets it use every session; it then finds them with list_sessions and passes session_id to the other tools.

Connect a client

Claude (claude.ai and Claude Desktop): open Settings → Connectors → Add custom connector, name it Warsita, enter https://api.warsita.com/mcp and click Connect. Sign in to Warsita, choose the WhatsApp number, and click Allow.

Claude Code:

claude mcp add --transport http warsita https://api.warsita.com/mcp

Then run /mcp in Claude Code, pick warsita and Authenticate; your browser opens Warsita's sign-in. To use an API key instead, add --header "Authorization: Bearer wsk_…" to the command.

Cursor, VS Code and other clients sign in the same way when they support MCP OAuth; add the URL and follow their prompt. Clients that do not can send a key. Cursor (~/.cursor/mcp.json):

{
  "mcpServers": {
    "warsita": {
      "url": "https://api.warsita.com/mcp",
      "headers": { "Authorization": "Bearer wsk_…" }
    }
  }
}

VS Code (.vscode/mcp.json):

{
  "servers": {
    "warsita": {
      "type": "http",
      "url": "https://api.warsita.com/mcp",
      "headers": { "Authorization": "Bearer ${input:warsita-key}" }
    }
  },
  "inputs": [{ "id": "warsita-key", "type": "promptString", "description": "Warsita API key", "password": true }]
}

Then ask in plain words, for example: "Send +6281234567890 a WhatsApp saying the order has shipped, then tell me when it is read."

Tools

Tool What it does
send_message Queues a message: text, or one of image, video, audio, document (by public URL), location, contact or poll; with mentions or a quoted reply
get_message A sent message and its status: queued, sent, delivered, read or failed
list_messages Sent messages, newest first, optionally by status
edit_message Changes a sent text message, within 20 minutes
delete_message Deletes a sent message for everyone
react_to_message Reacts with an emoji, or removes the reaction
get_account The linked number: phone, name, about text, picture
check_numbers Which of up to 50 numbers use WhatsApp
list_contacts The number's contacts, with search to narrow them
get_contact A person's WhatsApp name, about text and business details
list_groups, get_group The number's groups, and one group with its participants
list_sessions The workspace's numbers (personal access token only)

Each tool makes the same call as the REST API, with the same validation, rate limits and errors: a failed call comes back to the agent as the API's error message and code. Tools that only read are marked read-only, and delete_message and edit_message are marked destructive, so clients can ask before running them.

Received messages are not available through MCP; Warsita sends them to the session's webhook and does not keep them. To have an agent answer incoming messages, use a webhook (or the n8n trigger) and call the agent from there.

Sign-in and connected apps

Signing in opens Warsita's consent page, which shows the app's name, the address it returns to, and what it can do. You pick one WhatsApp number or the whole workspace, then allow or cancel. If the workspace requires two-factor sign-in, you pass it first.

The app gets a token that works only with the MCP server, not with the REST API. It lasts an hour and renews itself while the app keeps the connection; nobody can read it back from Warsita. Settings → Connected Apps lists every app connected to the workspace, with its number and when it was last used, and Disconnect cuts it off at once.

For client developers: discovery starts from the 401 at /mcp, which points to https://api.warsita.com/.well-known/oauth-protected-resource/mcp; the authorization server metadata is at https://api.warsita.com/.well-known/oauth-authorization-server. Warsita accepts Dynamic Client Registration (RFC 7591) and Client ID Metadata Documents, public clients only, the authorization code flow with PKCE (S256), resource set to https://api.warsita.com/mcp, and refresh tokens that rotate on every use. Loopback redirect URIs (http://localhost or http://127.0.0.1) match on any port.

Good to know

  • The agent sends real WhatsApp messages from your number. Keep your client's approval prompts on for send_message, and follow the Acceptable Use Policy.
  • Each send_message call sends a new message. Ask the agent to check with get_message or list_messages before sending again.
  • To cut an agent off at once, disconnect it in Settings → Connected Apps, or regenerate the session's API key or delete the token in Settings → Access Tokens.
Nextn8n