wa_send_contact

What wa_send_contact does on WA MCP

AI agents use wa_send_contact to create or update resources in WA MCP, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your WA MCP environment.

Why wa_send_contact is rated Medium

This tool writes/creates data (vCard transmission) with reversible side effects. It does not execute arbitrary code, destroy data, or move money. Severity is medium because unsolicited contact sharing could enable social engineering, spam, or privacy violations if misused by an AI agent, but the action itself is reversible (contacts can be deleted) and lacks the blast radius of Execute or Destructive operations.

From the tool's definition Tool description states 'Send a vCard contact to a WhatsApp contact or group' — this creates/transmits new contact data to recipients, modifying the state of conversations and recipient contact lists.

The rule that runs wa_send_contact safely

PolicyLayer is an MCP gateway: it sits between your AI agents and WA MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For wa_send_contact, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "wa_send_contact": {
      "limits": [
        {
          "counter": "wa_send_contact_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about wa_send_contact