Zapcore Mcp

io.github.adeiltonpessiniPublished by GitHub account adeiltonpessiniv0.1.1Updated Oct 30, 2026

Servidor MCP do zapCore (WhatsApp): leitura sempre, envio atrás de flag e allowlist de destino.

VerifiedSTDIODesktop onlyFiles & Storage Communication & Collaboration

Server details

Identifier: io.github.adeiltonpessini/zapcore-mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account adeiltonpessini for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.adeiltonpessini%2Fzapcore-mcp.svg)](https://sourceweft.com/mcp/io.github.adeiltonpessini%2Fzapcore-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local MCP server for a zapCore WhatsApp instance: read access by default, with message sending gated behind a flag and a destination allowlist.

What you can do: Read data from a zapCore WhatsApp instance through its v2 API (read access is always on).
Send messages only when sending is explicitly enabled, and only to phone numbers on the configured allowlist.
Download media files from the instance into a configured local directory.
Tune per-call HTTP timeouts against the zapCore API.
Optionally authenticate through Cloudflare Access with a service token when the API base sits behind it.
When to use it: Use it when you run a self-hosted zapCore WhatsApp instance and want an assistant to read its data, and optionally send messages to a fixed set of approved numbers. It suits teams that want WhatsApp access from the desktop with sending deliberately restricted.
Requirements: Runs as a local process (npm package or OCI image) over stdio, desktop only. Needs ZAPCORE_URL (API base) and ZAPCORE_TOKEN (instance token, sent in the token header). Optional ZAPCORE_CF_ACCESS_CLIENT_ID and ZAPCORE_CF_ACCESS_CLIENT_SECRET must be set together for Cloudflare Access. Sending requires ZAPCORE_MCP_WRITE plus ZAPCORE_MCP_ALLOW with E.164 numbers; ZAPCORE_MCP_DOWNLOAD_DIR and ZAPCORE_MCP_TIMEOUT_MS are optional.

Before you install

Requires the zapCore instance token (ZAPCORE_TOKEN) and possibly a Cloudflare Access service token pair; treat all three as secrets. Enabling ZAPCORE_MCP_WRITE registers four sending tools that can message real WhatsApp contacts, so keep the ZAPCORE_MCP_ALLOW allowlist narrow; the server refuses to start with sending on and no allowlist. Media downloads write files to the configured directory. Message content and media pass through the zapCore API you point it at.

Installation

In SourceWeft

Open Zapcore Mcp in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

This repository has no README.

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v0.1.1LatestSep 16, 2026

Score

25% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
License10 pts
Declare a license in the repository or the registry entry.