How to connect an AI agent to WhatsApp (Claude, ChatGPT and others)

An AI agent starts answering on a company's WhatsApp when the account is exposed as an MCP server and the agent receives a scoped credential. From there Claude, ChatGPT, Cursor, Codex, n8n or a custom agent read the inbox and reply on the team's own number — under the same rules.

What MCP is and why it solves this

MCP (Model Context Protocol) is an open protocol that standardises how an AI model talks to external tools and data. Before it, every assistant needed its own integration. With it, you publish one server and any compatible client can use it.

That changes the cost of putting AI into support: instead of writing a bot, you hand an agent that already exists the tools it needs — list conversations, read messages, reply, send a template, mark as read.

Two ways to authenticate

OAuth 2.1 is the path for clients that support authorisation — claude.ai, Claude Desktop, ChatGPT, code editors. The client discovers the endpoints on its own, opens the browser, the admin picks the access level and which numbers that agent may use, and clicks authorise. No key is pasted anywhere, and the access shows up in the same list it is revoked from.

An API key is the path for everything else: a script, an n8n flow, a custom agent. The admin generates the key, it is shown once and goes into the client's secret store. Only the hash is kept on the server — the plaintext key cannot be recovered.

Scope is a role, not a pile of permissions

An agent does not get a loose set of permissions: it gets a role, the same vocabulary that applies to people.

Scope	Equals	Can
read	viewer	list conversations and read messages
messages	agent	the above + reply and send approved templates
full	manager	the above + create and delete templates

Admin actions — inviting people, changing roles, connecting or disconnecting numbers — do not exist over MCP, in any scope. And each credential only sees the numbers an admin allowed for it: that list is the boundary, checked on every read and every send.

What the agent still cannot do

WhatsApp rules apply equally to people and to agents:

• free-form replies only inside the 24-hour window the customer opened;
• outside it, only an approved template reopens the conversation;
• no blasting people who never asked — number quality belongs to the business, not to the agent.

A well-behaved agent respects that because the server refuses what breaks the rule, not because the prompt asked nicely.

How the customer knows who they are talking to

Every outgoing message records its author: a person on the team, or the agent by name. The inbox shows that authorship inside the conversation, so the hand-off is explicit in the history — the customer sees one number and the team sees exactly where the agent stopped.

A realistic way to start

1. Connect the number through the official API.
2. Create a read-scoped access and let the agent only summarise and classify conversations for a few days.
3. Move up to messages with a narrow brief: FAQs, opening hours, order status.
4. Write down when the agent must stop and call a person — and test that limit before opening it to everyone.

The technical documentation with endpoints, tools and per-client examples lives at /docs/mcp.