You have forty unread WhatsApp threads and three of them matter. Finding those three is the job, and nobody has ever automated it for you. Here is the five-minute build: connect the number you already use, paste one standing brief, and get a ranked shortlist before a single message leaves your account.
What does it actually mean to build a WhatsApp agent with no code?
To build a WhatsApp agent with no code you assemble four things: a live WhatsApp connection, a tool scope, standing instructions, and guardrails. Installing a connector is plumbing. The agent is what you write on top, and its first job is to read and triage your chats, not to send.
- Live connection - your own number, reachable by the model.
- Tool scope - which actions it is allowed to call.
- Standing instructions - the brief that defines its job every time.
- Guardrails - draft-don't-send, plus escalation rules for the messages that need you raw.
People conflate the plumbing with the agent constantly, and it costs them a working setup. The Model Context Protocol is an open-source standard for connecting AI applications to external systems, which its own docs compare to "a USB-C port for AI applications." A port is not a workflow. The connector lets Claude reach WhatsApp. It does not tell Claude what you want done, in what order, or what it must never do without asking.
Read-first is the frame that makes this safe. A no code WhatsApp agent that starts by sending is a liability on your personal number. One that starts by reading costs you a bad summary and a re-prompt. Why this interface arrived as a protocol rather than a dashboard is the argument in our piece on agent native WhatsApp.
What do you need before the five minutes start?
Three things: a WhatsApp number you already use, an MCP-capable client such as Claude, and an engine that stays online when your laptop does not. The first two take two minutes. The third is the one people skip, and it is why most of these builds quietly stop working in week two.
Your own number. Not a new one, not a business identity. The agent reads your real history because it drives a real session on your account. WhatsApp supports up to four linked devices without keeping your primary phone connected, and the same Help Center page notes you must log in on your primary phone every 14 days to keep linked devices attached. Put that 14-day tap on a recurring reminder. It is the most boring way this setup dies.
An MCP client. Anthropic documents custom connectors over remote MCP as available on Claude, Cowork, and Claude Desktop across the Free, Pro, Max, Team, and Enterprise plans, with Free accounts limited to one connector. A Claude WhatsApp setup does not need a paid plan to try.
An engine that outlives your session. This gets its own section below. For now: if the thing holding your WhatsApp session is a process on your laptop, your agent's working hours are your laptop's working hours. The daily routine you build on top is in our guide to Claude as a WhatsApp chief of staff.
Minute 0 to 2: how do you give the agent a live WhatsApp connection?
Link your number once, then add a remote connector in Claude by pasting a URL and approving a login. Nothing to install, no key to store, no config file to edit. Two minutes, most of it waiting for a QR scan.
Create a Blueticks account, link the number the way you would link WhatsApp Web, then in Claude open Connectors, add a custom connector, and paste https://api.blueticks.co/mcp. Claude sends you to a Blueticks screen to sign in and approve access. That is standard OAuth, so Claude never sees a password and you can revoke it from your settings later. When you come back, nine WhatsApp tools are live in the session, and the one that matters today is chats.
I am not re-teaching the click path, because it already exists in full. The connect-to-Claude walkthrough covers every screen, both the connector route and the key route, plus troubleshooting for when the tools do not appear. Come back here once Claude can list your chats.
Minute 2 to 4: how do you write the agent's instructions so it reads and triages instead of blasting?
Paste one standing brief into Claude's project or agent instructions and the agent behaves the same way every day. The brief has five parts: a read-only scope, a four-bucket triage rubric, an escalation rule, a draft-don't-send rule, and an output format you can skim in 60 seconds. This is the actual build.
Copy the whole block. Edit the bracketed bits to your accounts and keywords, then leave it alone for a week before tuning.
You are my WhatsApp chief of staff. These rules apply to every request in this project.
SCOPE
- Use read actions only: list my chats, read messages in a thread, search history.
- Do not send, schedule, archive, mark as read, add a contact, or create anything
until I ask for it in that specific message.
- If a request would need a write action, say so and stop. Do not do it.
TRIAGE RUBRIC
Put every thread you read into exactly one of these four buckets:
- NEEDS A REPLY TODAY: someone asked me a direct question, someone is blocked on me,
or the thread mentions invoice, payment, refund, contract, reschedule, or cancel.
Anything from [Riverbend Supply, Acme Dental, K. Alvarez] lands here regardless.
- WAITING ON THEM: my last message ended in a question or a request and they have
not answered yet.
- FYI: worth knowing, no action from me.
- IGNORE: group chatter, forwards, greetings, and anything that neither names me
nor asks me something.
ESCALATION
Tag with [ESCALATE] and do NOT draft a reply for: money owed or disputed, anything
legal or contractual, and any message where the sender sounds angry or is
threatening to leave. Bring those to me raw, with the sender and one line of context.
DRAFTING
When I ask for a reply, write the draft and stop. Match how I wrote earlier in that
same thread, not a generic professional register. Show me the text and the recipient.
Never call a send or schedule action unless my message contains the word SEND.
OUTPUT FORMAT
Return exactly this, nothing else:
1. NEEDS A REPLY TODAY, max 7 lines. Each line: name, how long they have waited,
what they want, under 15 words.
2. WAITING ON THEM, max 5 lines, same shape.
3. Counts only for FYI and IGNORE. Do not list them.
4. Any [ESCALATE] items at the bottom.
Four clauses are load-bearing. Scope stops an eager model marking forty chats as read while it helps. Named accounts and literal keywords encode your priorities as something a model handles reliably instead of asking it to guess. Escalation exists because a disputed invoice is the message you least want smoothed over by a competent draft. And the output caps matter more than they look, because a triage list you have to triage is not triage.
One honest note. That scope clause is an instruction, not a permission wall. The connector grants read and write together, so nothing in your brief physically blocks a write. In ordinary conversation what stops one is Claude asking you before it calls a tool, which is why the next section is about approvals rather than trust. Two things switch that prompt off, and you should know both before you rely on it: clicking "Allow always" for a tool, and Research, during which Claude "can invoke tools from your connectors automatically without further approval". Anthropic's advice for that second case is to disable any tools that can take write actions, and it is worth following.
Minute 4 to 5: how do you run the first triage pass and verify it worked?
Ask for one narrow window, read the output, then spot-check a single thread it named. Verification takes longer than the run. You are hunting two failure modes: an agent that summarised nothing because it read nothing, and an agent that produced a confident list of threads that do not exist.
Start with this, and nothing more ambitious:
"Read my one-to-one WhatsApp chats since Monday 9am. Apply the standing rubric. Skip group chats entirely."
Good output looks boring. Four or five lines under NEEDS A REPLY TODAY, two or three under WAITING ON THEM, counts for the rest, no prose. If you get a paragraph of summary, the output format clause did not take, and the usual cause is pasting the brief into a single chat instead of the project instructions.
Then run three checks.
- Spot-check one named thread. Take the top line, open that chat on your phone, confirm the person and the ask are real. A model that cannot reach your chats will still write a plausible list. This is the only way to tell the difference on run one.
- Check a thread it dropped. Pick a conversation you know is live and confirm it got classified, even into IGNORE. Silent omission is the expensive error, and it usually means your time window was wrong.
- Run a self-send test before you enable sending. Ask for a draft to your own number, approve it, watch it arrive. One message, to you, nothing at stake. If that round-trips cleanly, the write path works with an audience of one.
Do the self-send test even though you are not sending anything today. It turns your first real send into a repeat of something you already watched work.
Connect your own number and run your agent's first triage pass tonight. A free Blueticks account, the number you already use, and the hosted connector. No Meta verification, no card, and a ranked shortlist instead of forty unread threads. Start at blueticks.co/signup.
How do you let the agent draft replies without giving it permission to send?
Keep drafting and sending as two separate acts, and leave send on per-call approval permanently. The agent writes, you read, you say the word. Promote it to sending later only inside a scope narrow enough to describe in one sentence.
The protocol assumes this. The MCP specification states that "for trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations," and adds that clients should "show tool inputs to the user before calling the server". Anthropic's connector guidance is equally blunt: review tool approval requests carefully and only click "Allow always" for a server and tool you trust to run unsupervised. Read tools are a defensible candidate. A send tool is not.
When you promote the agent, clamp it: one chat, one message type, confirmation required. "You may send delivery confirmations to the Riverbend Supply thread only, one line, and only after showing me the text." That is auditable at a glance. "You may reply to customers" is not.
Consent is yours, not the tool's. WhatsApp's Business Messaging Policy says you may only contact people who gave you their number and opted in to receiving messages from you, and that you are "solely responsible for determining the method of opt-in." An agent does not inherit permission from your good intentions. It inherits your recipient list.
Why does a laptop-hosted MCP server break your agent the moment you close the lid?
Because a self-hosted bridge is a process on your machine holding a session tied to your machine. Sleep, reboot, a closed terminal, or a dropped hotel wifi and the agent is offline. Nothing errors loudly. Your 7am brief simply does not happen and you find out at 11.
Credit where it is due, because these projects came first and they are good software. lharries/whatsapp-mcp pairs a Go bridge on the whatsmeow library with a Python MCP server and keeps your history in a local SQLite file. WAHA is a self-hosted gateway that can expose an MCP endpoint. If you want your data on your own disk and you enjoy owning the stack, those are the right tools.
The limit is architectural, not a quality problem. A local stdio process starts when your client starts and dies when your machine does. Fine for interactive work, where you are sitting there anyway. Fatal for standing work, which is the entire value of the brief you just pasted: overnight triage, the Monday sweep, the follow-up that fires while you are on a plane. An agent that only runs while you watch it is a demo. Our comparison of hosted and open-source options weighs the trade-offs.
What can this agent not do, and where is the honesty line?
It is not the first WhatsApp MCP, it is not the Meta Cloud API, and no tool can promise your number will never be banned. It runs on your own number over WhatsApp Web or a hosted gateway, which is exactly why it reads your real conversations and exactly why WhatsApp's normal limits still apply to you.
Not Meta's official path. The WhatsApp Cloud API is a separate product for programmatic business messaging, with pre-approved templates and, effective July 1, 2025, per-message pricing. It cannot do this job either: Meta's own docs state a number registered on the platform "cannot be used with WhatsApp Messenger", so it has no access to your existing chats.
No ban guarantee exists. WhatsApp's Terms of Service prohibit using the service in ways that involve "sending illegal or impermissible communications such as bulk messaging, auto-messaging, auto-dialing, and the like" (WhatsApp Terms of Service). Reading your own chats is low-risk. What moves your risk is behaviour: volume, cold first contact, and how many people block or report you.
Not a 24/7 customer-facing chatbot. It is your agent, on your number, working your inbox. Nobody on the other end is talking to a bot. If you want one answering strangers, that is a different architecture, and the WhatsApp AI agent build-vs-buy comparison covers the routes to it.
Its judgement is only as good as your rubric. The failure mode is predictable. It catches the lead you forgot about in week one, and in the same pass it files your best customer's two-word message under IGNORE, because two words with no question mark look like noise. That is not the model being stupid. That is a missing line in your brief. Put the name in.
What does a hosted always-on engine add once your agent is running?
It makes the brief run on its own clock instead of yours: overnight triage waiting when you wake, scheduled sends that fire with your laptop shut, delivery status the agent can read back, and no local bridge to restart. The agent stops being something you operate and starts being something that operated while you slept.
Map that back to the rubric. NEEDS A REPLY TODAY is worth most at 7am, before your day fills, so the read has to happen while you sleep. WAITING ON THEM only works as a standing sweep, because the point is catching silence, and silence never triggers anything. Approved drafts want to leave at 8:30am Tuesday, not at the 11pm moment you approved them.
That is the gap a hosted engine fills. Blueticks runs your WhatsApp session on a managed 24/7 engine and exposes it to Claude through a hosted remote connector at https://api.blueticks.co/mcp, so there is no process on your laptop to keep alive. Sends that fire while your machine is off use the same offline gateway. The claim, as narrow as it deserves: a first hosted, no-code, product-grade agent-native WhatsApp interface. Not the first WhatsApp MCP. The open-source servers got there before us.
Connect your own number and run your agent's first triage pass tonight. Free account, the number you already use, the hosted connector added in Claude in about two minutes. No Meta verification, no per-message fees, no card. Get started at blueticks.co/signup.
Frequently asked questions
Do I need the WhatsApp Business API for this? No. This runs on the number you already use, over WhatsApp Web or a hosted gateway, with no Meta approval and no templates. The Cloud API is a separate product for high-volume business messaging, priced per message since July 1, 2025, and a number registered on it cannot be used with regular WhatsApp.
Can I use ChatGPT or Gemini instead of Claude? Yes, in principle. MCP is an open standard supported across a wide range of clients, so any MCP-capable client can hold the same connection and the same standing brief. Claude is the path documented end to end here, so it is the shortest route to a working first run today.
Will this get my WhatsApp number banned? Nobody can promise it will not, and anyone who does is overclaiming. Reading and triaging your own chats is low-risk. Sending through automation on a personal number carries the same exposure as any WhatsApp Web tool, since WhatsApp's terms prohibit bulk and auto-messaging.
Can the agent run while my computer is off? Only if the WhatsApp session is hosted somewhere that stays awake. A self-hosted local bridge stops the moment your laptop sleeps, and the overnight run silently does not happen. A managed engine keeps the session and any scheduled sends alive independently of your machine.
How is this different from a WhatsApp chatbot? A chatbot answers strangers on your behalf, automatically, in public. This agent works your side of the inbox: it reads your threads, ranks what needs you, and drafts replies you approve. The output is a shortlist for you, not a conversation for them.
Can it send messages on its own? Not by default, and I would leave it that way for the first month. The brief tells it to draft and stop, and in ordinary conversation Claude asks before each tool call, so sending stays a deliberate act. Two exceptions matter: "Allow always" removes the prompt for that tool, and during Research Claude can invoke connector tools automatically without further approval, which is why Anthropic tells you to disable write-capable tools there. When you promote it, clamp the rule to one chat, one message type, confirmation required.
