---
title: Wapiworld
description: WhatsApp API, CLI, Agent Skills, and OAuth-protected MCP for operating tenant-scoped senders.
canonical: https://app.wapiworld.com/
last-updated: 2026-08-25
---

# Wapiworld

Wapiworld is a WhatsApp API for connecting sender instances, sending deliberately approved messages, receiving webhook events, and inspecting operational health.

## Start here

- [Developer page](https://app.wapiworld.com/developers/)
- [OpenAPI specification](https://app.wapiworld.com/openapi.json)
- [Authentication guide](https://app.wapiworld.com/auth.md)
- [MCP server card](https://app.wapiworld.com/.well-known/mcp/server-card.json)
- [Agent Skills index](https://app.wapiworld.com/.well-known/agent-skills/index.json)
- [AI Catalog](https://app.wapiworld.com/.well-known/ai-catalog.json)
- [CLI package](https://www.npmjs.com/package/wapiworld)
- [Public CLI source](https://github.com/wapiworld/cli)
- [Public Agent Skills source](https://github.com/wapiworld/skills)
- [Public Claude plugin source](https://github.com/wapiworld/claude-plugin)

## Integration choices

Use the REST API with a project-scoped API key for unattended software. Use the remote MCP server with OAuth when an AI client acts for a signed-in operator. Use the public CLI and Agent Skills for terminal workflows.

## Safety boundary

The public MCP never returns recorded message bodies, previews, sender names, contact or chat identifiers, WhatsApp message identifiers, QR pairing data, API keys, instance secrets, proxy credentials, webhook signing secrets, complete webhook URLs, or raw provider errors.

`send_message` is destructive, open-world, and non-idempotent. Show the exact sender, recipient, and complete text; warn that recording settings may persist the text; obtain explicit confirmation for exactly one send; call once; and never automatically retry an uncertain outcome. Transport acceptance is not proof of delivery or reading.