Once an AI assistant can call tools, the first review question is simple: which system does it touch, and with whose permissions? For WhatsApp there are now two MCP servers on the table, and they sit on opposite sides of that question. Treating them as interchangeable is the mistake to avoid.
Layer one: platform provisioning
Meta's WhatsApp Business Tools MCP runs remotely, is still in beta and is protected by Meta OAuth. Its tools handle the plumbing of a Business Platform account: finding the business account, registering and verifying phone numbers, managing message templates, sending messages and configuring webhooks. Sending is limited to plain text within the 24 hour window, or approved templates.
Meta positions it for development and testing workflows, not for production sending at scale. Its documentation does not list tools for groups or communities. If your threat model includes group admin actions, this server is simply out of scope, which is a fine property for a provisioning tool.
Layer two: daily group operations
The comparison of Meta's MCP and the 9bot MCP server covers the other layer. The 9bot server runs at mcp.9bot.com.br/mcp and acts on groups and communities of a WhatsApp number you own, linked as a device through a pairing code or a QR scan. The published toolsets and their sizes:
| Toolset | Tools |
|---|---|
| Automations | 62 |
| Workflows | 40 |
| Groups | 29 |
| Integrations | 27 |
| Reports, Community | 17 each |
| Moderation | 16 |
| Messages | 15 |
| Schedules | 13 |
| Jobs | 4 |
A new application starts with Groups, Reports and Workflows enabled. Everything else is opt in, which is the right default for an agent that can write to real conversations.
The controls worth auditing
A larger tool surface only makes sense if the access model is tight. These are the controls the 9bot documentation describes:
- OAuth 2.1 with scopes, so each client receives only the permissions someone approved.
- Group level scoping: the application sees authorized groups and nothing else.
- Allowlists and denylists per tool, plus read only applications for reporting use.
- Preview and single use confirmation before sensitive operations run.
- Data policy: sensitive fields can be blocked, masked or allowed.
- Audit trail with the complete action history.
For a security review, the useful question is what happens when the model is wrong. Read only applications cap the blast radius for analytics. Confirmation steps put a human between a prompt and a mass removal. The audit log lets you reconstruct who asked for what.
Mapping tasks to servers
Use Meta's server when an engineer is standing up a test number, drafting a template or checking that a webhook reaches the right endpoint during implementation. Use the 9bot server when the task belongs to someone running communities: a manager asking an assistant to summarize engagement for each customer group each week, or a marketing team asking for a workflow that sends a reminder on Fridays. Operations teams can also connect group commands to a CRM, a pattern described in the guide to WhatsApp webhooks for CRM and ERP.
The two can run side by side. A company may keep one to one customer service on Meta's platform and put the community layer on the 9bot server, each with its own credentials and its own number type: a Cloud API number on one side, your own number linked as a device on the other.
Disclosure and limits
9bot is an independent product. It has no official status and no partnership with Meta. It is a paid service with a 7-day trial, and the MCP server is part of the plan rather than a separate purchase. Any client that speaks remote MCP with OAuth can connect, for example ChatGPT, Claude or Gemini.
Two cautions for the runbook. First, WhatsApp rules do not allow automated bulk messaging, so scope agents to organizing and reporting, not to blasting. Second, tying a number to unofficial software carries account risk, so treat the linked number as a privileged identity: restrict who can scan the pairing code and review linked sessions on a schedule.
Takeaway
Do not ask which server is better. Ask which layer the agent will touch. Meta's beta server configures the messaging infrastructure of a business account. The 9bot server operates groups and communities under scoped, confirmed and logged access. Pick by the privilege the task needs, then grant the smallest scope that gets it done.
Top comments (0)