
Security News
Risky Biz Podcast: AI Agents Are Raising the Stakes for Software Supply Chain Security
Open source attacks are accelerating as AI coding agents pull in dependencies faster, with less human review.
wacli is a Rust WhatsApp Web CLI designed for coding agents and terminal workflows. It uses the personal WhatsApp Web multi-device protocol through whatsapp-rust, stores a local SQLite message index, and keeps command output predictable for automation.
This is not the WhatsApp Business Cloud API. It links like WhatsApp Web and depends on WhatsApp's unofficial Web protocol behavior.
From npm:
npm install -g whatshell
From this directory:
npm install -g .
The npm postinstall script builds the Rust release binary with Cargo and installs a small Node launcher. You can also use Cargo directly:
cargo install --path .
The npm install also installs the WACLI Agent Skill globally for coding agents:
~/.claude/skills/wacli~/.agents/skills/wacliOpenCode also discovers the Claude-compatible and agent-compatible locations and de-duplicates by skill name, so WACLI does not install a third OpenCode-native copy by default. Set WACLI_INSTALL_OPENCODE_SKILL=1 if you explicitly want ~/.config/opencode/skills/wacli too. Set WACLI_INSTALL_CODEX_HOME_SKILL=1 if you explicitly want a legacy $CODEX_HOME/skills/wacli copy. Set WACLI_SKIP_SKILL_INSTALL=1 to skip skill installation.
wacli auth
Scan the QR code in WhatsApp: Settings > Linked Devices > Link a Device.
Phone-number pairing is supported when WhatsApp allows it:
wacli auth --phone +15551234567
Status and local logout:
wacli auth status --json
wacli auth logout
auth logout removes the local session files. If you need to revoke the linked device remotely, remove it from WhatsApp's Linked Devices screen.
WACLI keeps a local SQLite index built from WhatsApp Web sync data. Read commands are fastest and most useful after a sync:
wacli sync --once --json
wacli contacts sync --json
Use --json for automation and preserve returned message IDs, chat JIDs, group JIDs, status IDs, and invite links when you may need to reply, revoke, clean up, or verify an action later.
Live WhatsApp commands use a per-store process lock. Run live commands serially against the same store; if you need an isolated account or test profile, use a separate store:
wacli --store ~/.wacli-work auth
wacli --store ~/.wacli-work sync --once --json
Use --read-only when you want WACLI to reject side-effecting commands.
Sync and listen:
wacli sync --once --json
wacli sync --follow --stream-jsonl
wacli listen --stream-jsonl
Send messages:
wacli send text --to +15551234567 --message "Build finished" --json
wacli send file --to 120363000000000000@g.us --file ./report.pdf --caption "Latest report"
wacli send react --to +15551234567 --id MESSAGE_ID --reaction "+1"
wacli send poll --to +15551234567 --question "Ship?" --option Yes --option No --json
wacli send location --to +15551234567 --latitude 12.9716 --longitude 77.5946 --name Bengaluru --json
wacli send contact --to +15551234567 --name "Ops Phone" --phone +15551234567 --json
Query the local index:
wacli chats list --json
wacli messages list --chat +15551234567 --limit 20 --json
wacli messages search "deployment failed" --limit 10 --json
wacli messages context --chat +15551234567 --id MESSAGE_ID --before 5 --after 5 --json
wacli messages reply --chat +15551234567 --id MESSAGE_ID --message "Looking now" --json
wacli contacts sync --json
wacli contacts list --json
wacli contacts search "Devansh" --json
wacli contacts check +15551234567 --json
wacli contacts info +15551234567 --json
wacli groups list --json
wacli presence typing --chat +15551234567 --json
wacli chats mark-read --chat +15551234567 --json
wacli media list --chat +15551234567 --json
wacli export messages --chat +15551234567 --format jsonl --output ./chat.jsonl
wacli export analytics --json
Message actions:
wacli messages edit --chat +15551234567 --id MESSAGE_ID --message "Edited text" --json
wacli messages revoke --chat +15551234567 --id MESSAGE_ID --json
wacli messages delete-for-me --chat +15551234567 --id MESSAGE_ID --json
wacli messages star --chat +15551234567 --id MESSAGE_ID --json
wacli media download --chat +15551234567 --id MESSAGE_ID --output ./downloads
Groups, profile, and status:
wacli groups create --subject "Build Room" --participant +15551234567 --dry-run --json
wacli groups add --jid 120363000000000000@g.us +15551234567 --json
wacli groups set-subject --jid 120363000000000000@g.us --subject "Build Room 2" --json
wacli groups set-description --jid 120363000000000000@g.us --description "Release coordination" --json
wacli groups set-description --jid 120363000000000000@g.us --clear --json
wacli groups lock --jid 120363000000000000@g.us --json
wacli groups ephemeral --jid 120363000000000000@g.us --seconds 86400 --json
wacli profile set-about "Available through wacli" --json
wacli blocking is-blocked +15551234567 --json
wacli status text --message "Working" --to +15551234567 --json
wacli status revoke --id STATUS_MESSAGE_ID --to +15551234567 --json
Implemented now:
Remaining parity boundaries:
Diagnostics:
wacli doctor --json
wacli doctor --connect
By default, wacli stores session and index data in the platform data directory. Override it per command or with WACLI_STORE:
wacli --store ~/.wacli-work auth
WACLI_STORE=~/.wacli-work wacli auth status --json
Files:
session.db: WhatsApp Web session managed by whatsapp-rustindex.db: local chat/message index with SQLite FTS5 when availableLOCK: process lock for commands that touch the live WhatsApp sessionmedia/: local media downloadsThe command model borrows from the strongest public WhatsApp CLI and agent-oriented projects:
steipete/wacli: SQLite-backed CLI, FTS search, JSON output, store locking, agent-focused command designvicentereig/whatsapp-cli: personal WhatsApp Web CLI patterns for Claude/Codex workflowstulir/whatsmeow: mature Go WhatsApp Web implementation and operational patternsWhiskeySockets/Baileys: TypeScript WhatsApp Web protocol coveragejlucaso1/whatsapp-rust: Rust WhatsApp Web client used as the runtime protocol implementationWhatsApp Web automation can break when WhatsApp changes its private protocol. Keep the linked device limited to accounts where this automation is acceptable, and avoid sending spam or high-volume automated traffic.
FAQs
Whatshell: a Rust WhatsApp Web CLI for coding agents
The npm package whatshell receives a total of 8 weekly downloads. As such, whatshell popularity was classified as not popular.
We found that whatshell demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Open source attacks are accelerating as AI coding agents pull in dependencies faster, with less human review.

Research
/Security News
Malicious Chrome and Firefox extensions posed as free VPNs while stealing clipboard data through later extension updates.

Research
/Security News
Miasma Mini Shai-Hulud hits @immobiliarelabs Backstage plugins, targeting GitLab and LDAP auth packages on npm.