Evolution API MCP Server — agentic threat model

Not certain from the listing — The MCP server itself does not bundle a specific foundation model, but acts as a tool provider for external LLMs. The primary threat is that the host LLM is vulnerable to prompt injection, which could trick it into executing malicious WhatsApp actions via the exposed tools.

Not certain from the listing — The server manages WhatsApp chats, messages, and profiles, but does not explicitly mention a vector database or RAG pipeline. The primary data risk is the exfiltration of sensitive chat histories and contact lists through the 121 exposed tools.

The server exposes 121 highly sensitive tools for WhatsApp interaction (messages, groups, webhooks). The primary threat is insecure tool integration and tool misuse, where an LLM client can be manipulated into sending unauthorized messages, modifying group settings, or creating malicious webhooks.

The server relies on an EVOLUTION_API_KEY for authentication. If this key is compromised or insecurely stored in the environment, attackers gain full control over the associated WhatsApp instances. Sandboxing of the MCP server process is critical to prevent lateral movement.

Not certain from the listing — There is no mention of built-in guardrails, logging, or anomaly detection. Without external monitoring, malicious or accidental bulk messaging and webhook modifications could go unnoticed until account suspension occurs.

The server supports a configurable tool subset, which is a vital compliance and authorization control to limit the attack surface. However, it lacks fine-grained user-level authorization, meaning any client with access to the MCP server can invoke any enabled tool.

As an MCP server, this agent is designed to be integrated into broader multi-agent workflows. A compromised or rogue agent in the same ecosystem could abuse the trust relationship to send spam or exfiltrate data via the WhatsApp tools without human intervention.