Official MCP RegistryListed
Cosend
Read your WhatsApp inbox, reply in existing chats, and check and deploy automations.
First seen 31 Oct 2026. Evidence as of 5 Nov 2026.
93
Tools
From an anonymous probe
1
Source listings
Each with its own history
50
Recorded changes
Since first seen
Tools
| Tool | Description | Behaviour |
|---|---|---|
| ask_for_conversation | Asks the person who holds one conversation, named by id, in the Cosend Inbox to hand it over; reason is an optional note for them. They get a hand-over prompt: when they say yes, or do not answer within 60 seconds, the chat passes to the person this app acts for, and messages can be sent in it; when they say no, it stays theirs. This is the only way into a chat someone else holds: nothing takes one without asking. A chat nobody holds, or one the person this app acts for already holds, is refused, as there is nothing to ask for and a message can be sent there as it is. Asking again while a request waits returns that request. Returns the request: its state (pending until answered), who holds the chat (held_by) and when it passes without an answer (expires_at). Whether it has passed shows in the conversation’s lock (held_by, can_i_send). Nothing is sent to the customer. | Destructive |
| automation_recipes | Works with the recipe library. action list returns the published recipes as cards, one page at a time. action instantiate fills one recipe in with params and returns the automation document (ir) with its validation report; it writes nothing, so saving the document is a separate step. Read-only. | Read-only |
| bulk_update_conversations | Applies one action to up to 100 conversations named in ids: resolve marks each Done, assign sets assignee_id (null takes it off), label adds labels_add and takes off labels_remove, priority sets priority, and read marks each read in Cosend. Each chat gets its own result, so one that is not found or that someone else is replying in is skipped with its reason while the rest go through. It acts only on a confirmed call: without confirmation_token it changes nothing and returns a preview and a token for a person to approve; called again with that token, it acts. Nothing is sent to any customer. | Destructive |
| cancel_campaign | Stops a campaign, named by id, that is scheduled, sending or paused, and returns it stopped: nothing more goes out, and sends still waiting are cancelled. Messages already sent stay sent. A stopped campaign does not start again; its results stay readable. Stopping a draft, or a campaign that has finished, is refused in words. | Destructive |
| cancel_run | Cancels a run that has not finished, as a stop: it needs no confirmation. Messages the run already sent stay sent. Returns the run as it is after the cancel. | Destructive |
| cancel_setup_link | Cancels an open set-up link so its page stops working, for example when the person changed their mind or the link asks for the wrong thing. A link already completed, expired or cancelled is refused, and nothing a link set up is undone. Only the person who asked for it can cancel it. | Destructive |
| change_knowledge | Changes one AI assistant’s knowledge, named by id. action add takes a kind: file (media_id of a file uploaded on the assistant’s number), text (text, with an optional title), url (a website) or place (a Google Maps link); it answers at once with the source, and the assistant reads it in the background (a website is read again every month). action remove (sourceId) forgets a source and everything read from it, and only on a confirmed call: without confirmation_token it changes nothing and returns a preview and a token for a person to approve. action refresh (sourceId) reads a source again now. action review_suggestion (suggestionId, accepted true or false, optional question and answer edits) turns a suggested answer into knowledge or drops it. Owners and admins. | Destructive |
| change_template | Changes an existing message template at Meta. action edit replaces all of its components and returns it to review (an approved template can be edited once in 24 hours); copy creates it on another WhatsApp account of the same business, where Meta reviews it again; delete removes it at Meta and from Cosend once Meta confirms. It acts only on a confirmed call: without confirmation_token it changes nothing and returns a preview and a token for a person to approve; called again with that token, it acts. Ten changes a day per workspace. It sends no message to anyone. Meta’s reason for a refusal is in Meta’s words. | Destructive |
| chat_notes | Internal notes on one conversation, named by id; the customer does not see them. action list returns the notes one page at a time. action add writes a note (body, with mentions as a list of usr_ ids of members to notify). action edit changes a note’s body (noteId and body; only its author can). action delete removes a note (noteId; its author, an owner or an admin can). Deleting acts only on a confirmed call: without confirmation_token it deletes nothing and returns a preview and a token for a person to approve; called again with that token, it deletes. Notes can quote customers and come back marked untrusted. | Destructive |
| check_setup_link | Reads a set-up link’s status. status open means the step is not done; completed means it has, and result says what was set up; expired means its 30 minutes passed; cancelled means it was cancelled or replaced by a newer one. For connect_integrations, result.connector_accounts lists each account saved; when the workspace has several WhatsApp numbers an account is on none of them until it is added to a number (the Integrations page in Cosend, or the integration account tool’s add_number). For reconnect_number, result names the connection and its number once Meta’s flow finished; for pick_google_file, completed means Google’s picker was opened for the account, and the account’s spreadsheet list shows what was chosen. Only the person who asked for the link can read it. Read-only. | Read-only |
| contact_fields | The workspace’s contact fields: the keys a contact’s attributes can hold. action list returns each field with how many contacts hold a value for it. action create adds one (key, label, type text, number, date, boolean or choice, choices for a choice field, required). action update (id) changes a field’s label, type, choices or required; its key stays. action delete (id) removes the field and every contact’s value for it. Creating, changing and deleting are for owners and admins. Deleting acts only on a confirmed call: without confirmation_token it deletes nothing and returns a preview and a token for a person to approve; called again with that token, it deletes. | Destructive |
| create_campaign | Starts a campaign as a draft, with a name and the WhatsApp number it goes out on, and returns it with its id. It sends nothing and messages nobody: a draft waits until a person approves it. The draft is on the Campaigns page of the Cosend dashboard too. Campaigns are on the Starter plan and above, and for owners and admins. | Destructive |
| create_setup_link | Makes a link for the person in this chat to open in their own browser, signed in to Cosend, to do one set-up step only they can do there, and returns its url. It works for 30 minutes and only for them, and carries no password or key. kind connect_number connects a WhatsApp number; reconnect_number needs connection_id and runs Meta’s flow again for that number; connect_integrations needs connectors (each integration by its Cosend key, as list_connectors gives them) and completes when every one has an account, and with account_id (and that account’s one connector) the person types a new key for an account that already exists; pick_google_file needs account_id, a Google account, and opens Google’s file picker for it so the person can choose spreadsheets Cosend may open; upgrade needs plan, the plan to buy; payment_method adds a card. The person does the step themselves on the page: they connect the number in Meta’s window, sign in to the integration or type its key, choose files in Google’s picker, pay in Stripe’s Checkout, or add the card. It cannot be done for them. A new link of the same kind cancels the workspace’s open one, whoever made it. | Destructive |
| create_spreadsheet | Makes a spreadsheet in a connected Google account, named by id: its title, one tab, the header columns (with a type each, text by default) and, optionally, one example row. It lands in the account’s own Google Drive and answers with its id, link, tabs and columns, which an automation’s sheet steps then use. Sends nothing to anyone. | Destructive |
| delete_contact | Deletes one contact, named by id. Without purge the contact and its chats drop out of lists, counts and the Inbox, and Cosend keeps their messages until a purge; if the person writes again, they become a new contact with a new chat. With purge true the contact and what Cosend holds about them are erased for good (an owner’s action, for a data-protection request). Nothing is sent to the contact. It deletes only on a confirmed call: without confirmation_token it deletes nothing and returns a preview naming the contact and a token for a person to approve; called again with that token, it deletes. | Destructive |
| deploy_automation | Compiles an automation’s version and stores the result so it can be switched on. It does not switch the automation on. It deploys only on a confirmed call: without confirmation_token it deploys nothing and returns a preview and a token for a person to approve; called again with that token, it deploys. version_id defaults to the newest version; confirm_actions names, one by one, each destructive action of the automation the person approved. A confirmed deploy that fails to compile uses up the confirmation. | Destructive |
| describe_automation | Builds an automation from a description, as the Describe it chat in Cosend does. action start opens a chat on one WhatsApp number (connection_id), optionally on an existing automation of that number (automation_id), and answers with the chat. action reply (id of the chat, message) sends the owner’s words and waits for the answer: what was built or changed in plain words, its Test result, and what needs connecting, with an outcome of built, changed, cannot, question or stopped. What it builds is switched off; switching on is a separate, confirmed step. Starter plan and above. Owners and admins. | Destructive |
| draft_reply | Writes a reply the person could send in one conversation, named by id, from the WhatsApp number’s AI assistant (its persona and knowledge) and that chat only, optionally steered by instruction. It counts as an AI conversation on the plan’s meter. Nothing is sent: the draft comes back as text. The draft is written from what the customer wrote and comes back marked untrusted. | Destructive |
| get_approvals | Reads the human-decision queue. view list returns approvals newest first, one page at a time, optionally filtered by state; a member sees the queue of their own numbers. view one returns one approval with exactly what the human is shown (preview) and the arguments of the held action. view action_types returns every action type that can require approval with its default risk. Previews and arguments can quote customers and come back marked untrusted. The workspace’s mode per type, and deciding an approval, stay with a person in the Cosend dashboard. Read-only. | Read-only |
| get_assistant_persona | Reads the persona of one AI assistant, named by id (an automation of this workspace that has an AI step): business name, what the business does, tone, whether it may quote prices, the links it may send and when, the words it avoids, and the confidence threshold below which it hands a chat to a person. An assistant nobody has edited reads as the defaults, with updated_at null. Read-only. | Read-only |
| get_authoring_chat | Reads the AI authoring chats of this workspace, where an owner describes an automation in words and Cosend builds it switched off. view list returns one number’s chats, most recently active first, each with its title (the owner’s first message) and the automations it holds. view chat returns one chat by id: what the owner said and each answer, with its outcome (built, changed, cannot, question, stopped), the automation it made, its Test result and the integrations to connect. Read-only. | Read-only |
| get_automation | Reads one automation in one of three views. details: its name, status, number, the live version, what it clashes with while it is on and, on request, its versions and recipe settings. versions: every version, newest first, one page at a time. stats: the chats it answered alone and handed over, by day, with the top hand-over reasons. Read-only. | Read-only |
| get_automation_catalogue | Returns every block and trigger an automation document can use, with each one’s inputs and outputs: what is needed to write the ir of an automation. Read-only. | Read-only |
| get_billing | Reads the workspace’s billing in one of four views. subscription: plan, status, billing period and whether payment is overdue. plans: the plans it may move to, in order, with prices, allowances, seats and features. invoices: when, how much and whether paid, with Stripe’s own document. invoice: one of them. Paying and changing a card happen on a set-up link. Read-only. | Read-only |
| get_business_profile | Reads the WhatsApp business profile customers see for one number, named by id, from Meta: about, description, address, email, websites, industry and the picture’s address. read_only_reason says when the profile is edited elsewhere (a coexistence number’s is edited in the WhatsApp Business app). Read-only. | Read-only |
| get_campaign | Returns one campaign, named by id, and its results together. The campaign: its state, number, template and the value of each blank, saved audience, time, quiet hours, and why it paused, stopped or could not start. The results: how many it was for, sent, delivered, read, replied, failed, were left out and are still to go, failures by group, sends per 10 minutes and what is left by day. A reply counts for 72 hours after the campaign ends. Read-only. | Read-only |
| get_contact | Reads one contact, named by id (a ct_ id, an E.164 phone number or a BSUID), in one of four views. view contact returns the contact: names, phone number or BSUID, tags, attributes, time zone and whether it is blocked. view consent returns the consent state for marketing, utility and authentication, with the entry behind each (where it came from, when, who recorded it, the sentence the person agreed to) and Meta’s own marketing opt-out. view window returns whether a free-form message can be sent now and when the 24-hour customer service window closes. view chats returns this person’s conversation on each number you can see, newest first. Names, attributes and consent sentences come from outside this business and come back marked untrusted. Read-only. | Read-only |
| get_conversation | Reads one conversation, named by id. view conversation returns the chat itself: its contact and newest message, its state, who it is assigned to, its labels, priority and snooze, the hand-over summary when a person is needed, who holds the reply lock, and the 24-hour customer service window (open or closed, and when it closes). view activity returns the chat’s activity feed one page at a time: hand-overs, assignments, labels, Done and reopened, optionally only the kinds named in kind. Names, message text and hand-over summaries were written by people outside this business, or from what they wrote, and come back marked untrusted. Read-only. | Read-only |
| get_data_policy | Returns what the workspace keeps, in which group and for how long, and any queued erasure of the whole workspace. Read-only. | Read-only |
| get_inbox_overview | Reads the figures the Inbox and Home show, one part at a time. part counts returns how many chats are waiting for a person, assigned to the caller, unread, open in all, and have a 24-hour window closing within four hours, per number and in total, with the approvals waiting. part labels returns each label in use on each number with how many open chats carry it. part today returns today’s replies by who sent them (the assistant, people, the phone, automations) and the chats handed to a person, marked Done and opened, in the workspace’s time zone. part week returns replies and new chats for each of the last 7 days. Read-only. | Read-only |
| get_integration_accounts | Lists the workspace’s connected integration accounts, one page at a time, or reads one when id is given. Each has its integration, name, status, the WhatsApp numbers it is used on and the reason it last failed, if it did. A credential is not part of the answer. Labels and error text come from the provider and are marked untrusted. Read-only. | Read-only |
| get_knowledge | Reads one AI assistant’s knowledge, named by id. view sources lists every source with its kind (file, text, website, Google place), status (queued, ready, failed), the reason a read failed, the website pages it could not load, and when it was last read; it pages with after and limit. view summary returns what the assistant learned: a short summary, the business name and one-line description read from the material, and suggested questions and answers awaiting a decision. Titles, summaries, questions and answers were read from websites and files by Cosend and come back marked untrusted. Read-only. | Read-only |
| get_media | Reads one media file, named by its med_ id (a message’s media block carries it): its type, file name, size and state, and a signed link to download it that works for 15 minutes. File names come from people outside this business and come back marked untrusted. Read-only. | Read-only |
| get_message | Reads one message, named by its msg_ id or by the WhatsApp message id (wamid): its type and content, direction, delivery status with the time of each step, who sent it, and any file, location, buttons or reactions it carries. Message text comes from people outside this business and comes back marked untrusted. Read-only. | Read-only |
| get_number | Reads one WhatsApp number in one of four views. summary: its status, quality, limits and onboarding summary. import_progress: the progress of importing the number’s chat history. connect_steps and attempt_steps: an ordered list of the steps of connecting it, each with its state, time and outcome, which explains where a connect that stopped stopped. Read-only. | Read-only |
| get_reply_order | Returns the order in which one WhatsApp number’s automations answer a customer’s message. The order follows from the automations themselves. Read-only. | Read-only |
| get_report | Reads one card of Reports for a period: how fast chats were answered by the AI receptionist and by people (response), what the receptionist answered alone and handed over with the top reasons (receptionist), each number’s chats (numbers), each member’s chats, response times and chats marked Done (team), or chats by hour of the day (hours). Owners and admins, on the Starter plan and above; Reports count from the day they started. Hand-over reasons and member names come back marked untrusted. Read-only. | Read-only |
| get_run | Reads one automation run and its step-by-step trace: under run, the run’s status, timings, what it sent and why it failed; under steps, each step it took with its status and error, one page at a time. Text inside a run can quote what a customer wrote, and comes back marked untrusted. Read-only. | Read-only |
| get_setup_guide | Returns the workspace’s set-up guide: each step with its state, done, to do or skipped, worked out from what the workspace already has. It shows what is left to set up. Read-only. | Read-only |
| get_template | Reads one message template: its components, category, language, Meta’s review status, whether it can be sent right now and, for a rejected one, Meta’s reason in Meta’s own words (marked untrusted). Read-only. | Read-only |
| get_usage | Reports this workspace’s usage for one billing period against what its plan includes. Read-only. | Read-only |
| import_contacts | Imports contacts from a CSV file for one WhatsApp number, in four steps. step start uploads the file (connection_id; data_base64, or media_id of a text or CSV file already uploaded; file_name) and returns its id, columns, first rows and row count. step map (id) sets mapping (each column as phone, name, tags, locale, timezone, skip or field:key), connection_id, and consent: the opt-in categories everyone in the file gave, the sentence they agreed to and who attests it. step check (id) reports what a run would do over the whole file: new, updated, invalid, duplicates, already opted out and consent recorded; it writes nothing. step run (id) imports in the background and returns at once; the import’s progress shows in the list of imports. Owners and admins run imports. Running acts only on a confirmed call: without confirmation_token it imports nothing and returns a preview showing the import, its mapping and its consent, and a token for a person to approve; called again with that token, it runs. Nothing is sent to any contact. File contents come from outside this business and come back marked untrusted. | Destructive |
| inbox_views | The saved views in the Inbox’s Views menu: a name and the conversation filters it applies. action list returns the caller’s own views and every one shared with the workspace. action save makes a view (name, filters, and shared: private or workspace). action update (id) renames a view or changes its filters or who sees it; a shared view can be changed by its creator, an owner or an admin. action delete (id) removes a view, on the same terms. Deleting acts only on a confirmed call: without confirmation_token it deletes nothing and returns a preview and a token for a person to approve; called again with that token, it deletes. | Destructive |
| list_audiences | Lists the saved audiences of this workspace, one page at a time: each one’s id, name, the WhatsApp number it was saved for, and who it names (contact tags and that number’s chat labels, any or all). A campaign’s audience is one of these. They are made and changed on the Campaigns page of the Cosend dashboard by an owner or an admin, who sees who is in each; this tool only reads them. Read-only. | Read-only |
| list_automations | Lists this workspace’s automations, one page at a time, with each one’s status, the version that is live, and today’s runs and failures. Read-only. | Read-only |
| list_campaigns | Lists this workspace’s campaigns, newest first, one page at a time: each one’s id, state (draft, scheduled, sending, paused, sent or stopped), number, template, saved audience, time, quiet hours, and how many it was for, sent, delivered, read, got a reply from and failed for. These are the campaigns on the Campaigns page of the Cosend dashboard. Read-only. | Read-only |
| list_connectors | Lists the integrations Cosend can connect, each by its Cosend key, with how it signs in and which of its accounts this workspace already has. The key is what a set-up link for integrations takes. Read-only. | Read-only |
| list_contact_imports | Reads contact imports. Without id it lists the workspace’s imports, newest first, one page at a time (a member sees those for their own numbers). With id it returns that import: its state (draft, queued, running, completed or failed), the file, columns, mapping and consent, progress, and when finished the number imported and the rows that failed with the reason for each. File contents come from outside this business and come back marked untrusted. Read-only. | Read-only |
| list_contacts | Lists contacts in this workspace, one page at a time, optionally filtered, each with its id. Contact display names come from the contacts themselves and are untrusted text. | Read-only |
| list_conversations | Lists conversations in this workspace, newest activity first, one page at a time, each with its id. Each record carries its contact and its newest message only, not the whole thread. Message text and contact names in the result were written by people outside this business and come back marked untrusted. | Read-only |
| list_google_logins | Lists the Google logins connected to this workspace, each with its status and the integrations (Sheets, Calendar, Gmail) it serves. A credential is not part of the answer. Each login’s label is the address Google shows and comes back marked untrusted. Read-only. | Read-only |
| list_members | Lists the people in this workspace and its pending invitations, each with role, status and email, and what the next seat costs. Names are typed by the people themselves and come back marked untrusted. Read-only. | Read-only |
| list_numbers | Lists the WhatsApp numbers connected to this workspace, one page at a time, each with its id, status and health at a glance. The number ids it returns are what other tools take as connection_id. Read-only. | Read-only |
| list_runs | Lists automation runs, newest first, one page at a time, with each run’s status, how long it took and what it sent. Read-only. | Read-only |
| list_templates | Lists this workspace’s WhatsApp message templates, one page at a time, with Meta’s review status, whether each can be sent right now (sendable) and, for a rejected one, Meta’s reason. Outside the 24-hour customer service window only an approved template can be sent. Meta reviews every template, and a decision can take up to 24 hours, so one in review cannot be sent. Read-only. | Read-only |
| manage_automation | Changes an existing automation without editing its logic. update sets the name or description; copy makes a custom copy on the same number, switched off, with its own persona, knowledge and remembered values (name defaults to the original’s followed by “(copy)”); rollback moves the automation to an earlier version (to_version is the version number) and, if it is on, it runs that version from then on; delete removes it, and no run starts after it. rollback and delete act only on a confirmed call: without confirmation_token they change nothing and return a preview and a token for a person to approve; called again with that token, they act. | Destructive |
| manage_integration | Manages one connected integration account, named by id; the account returns no credential. action update takes name and config (non-secret settings only). action test makes one safe read at the provider and returns whether the credential works; a failed test is an answer with ok false. action add_number (connection_id) uses the account on another WhatsApp number of the workspace, the same sign-in and not a copy. action remove_number (connection_id) stops using the account on one number (refused on its only number, and while an automation switched on there needs it), and only on a confirmed call: without confirmation_token it changes nothing and returns a preview and a token for a person to approve. Signing in, and typing or replacing a key, happen on a set-up link the person opens; deleting an account or its saved login is done by a person in the Cosend dashboard. Owners and admins. | Destructive |
| manage_number | Looks after one WhatsApp number, named by id. action sync refreshes the number’s state, quality rating and limits from Meta and returns the connection. action recheck_payment is for a person who added a payment method in Meta after a number was blocked for payment: it asks Meta again and returns the connection (adding the method itself happens in Meta’s own tools). Owners and admins for sync. Disconnecting a number is done by a person in the Cosend dashboard. | Destructive |
| mark_read | Marks read, in one of three ways, with id naming a conversation (cosend, phone_thread) or a message (phone_message). where cosend clears the chat’s unread state for the whole workspace in Cosend; the customer sees nothing. where phone_thread tells WhatsApp the newest unread customer message was read, so the customer’s phone shows blue ticks on what they sent. where phone_message does the same for the one message named. The blue ticks reach a real person’s phone and cannot be taken back. | Destructive |
| merge_contacts | Merges two identities of one person (a phone number and a BSUID): the contact named by id keeps going, and the one named by from is folded into it and removed. It cannot be undone. It merges only on a confirmed call: without confirmation_token it merges nothing and returns a preview naming both contacts and a token for a person to approve; called again with that token, it merges. Returns the contact that remains. | Destructive |
| message_cost | Returns Meta’s list price for one delivered WhatsApp message in a country, for each category (marketing, utility, authentication, service), in one of Meta’s 16 rate-card currencies, with the day the rates took effect. These are Meta’s list prices: a business’s bill may differ, and the notes say what changes it. | Read-only |
| preview_campaign | Checks a campaign draft, named by id, and returns what sending it would do, under two keys. audience: how many the saved audience matches, how many get it, how many are left out and why (no WhatsApp number, blocked, opted out on this number, a US number, WhatsApp held back a marketing message to them in the last day, a blank with no value, or a chat open with them now), the first 20 people, and Meta’s list price for one delivered marketing message to each person who gets it, by market, in the WhatsApp account’s currency. estimate: the estimate_id a send names, which lasts 15 minutes; the count; the daily limit and what goes out on which day; the plan’s messages left; and whether the count must be confirmed, which it must above 500. It saves the estimate on the draft and sends nothing. The template must be approved by WhatsApp. Names in the sample were written by the customers themselves and come back marked untrusted. | Destructive |
| read_conversation | Lists the messages of one conversation, named by conversation_id (or of one contact, by contact_id), oldest first, one page at a time. With neither, it lists recent messages across the whole workspace. Message bodies include what members of the public wrote, and every one comes back marked untrusted. | Read-only |
| read_integration | Reads what one connected integration account holds, named by id. view spreadsheets lists the spreadsheets a Google account can open (the ones Cosend made or a person picked for it), 100 a page at most, or with spreadsheet_id one spreadsheet and its tabs. view forms lists a form account’s forms with the id an automation’s start takes as form_id. view appointments lists a calendar account’s upcoming events from now to days ahead, with the customer number found in each and counts of events with and without one. Names, tab titles and event titles were written by people outside this workspace and come back marked untrusted. Read-only. | Read-only |
| request_approval | Holds an action for a human decision: action (a type from the approval action types), preview (exactly what the person is shown, up to 4096 characters), arguments, and optionally risk (it can only raise the type’s default) and run_id. The approval is pending, expires 24 hours after it is made (an expiry is a rejection), and appears in the Cosend approvals queue for a person to approve or reject. The workspace’s setting for that action type can also approve or reject it at once, and the answer says which. It performs the action for nobody. A retry with the same arguments returns the same approval. | Destructive |
| resolve_conversation | Marks one conversation Done, as the Done button in the Cosend Inbox does. Nothing is sent to anyone and no automation starts. Afterwards no person holds the conversation (the person, the assignee, the priority and any hand-over are cleared) and every automation on that WhatsApp number treats the customer’s next message as a first message: the welcome menu greets again, an unfinished question flow starts over, and the AI assistant begins a new AI conversation, which counts as one more AI conversation on the plan. The message history stays. It does not hand the chat to the assistant or reply to the customer. It is refused for a credential with no person behind it. | Destructive |
| run_automation | Starts one run of an automation now, as its manual trigger does, with payload as the trigger’s data. The automation then acts as it was built to, which can include sending WhatsApp messages to customers; those messages cannot be unsent. It starts only on a confirmed call: without confirmation_token it starts nothing and returns a preview and a token for a person to approve; called again with that token, it starts the run. Returns the run, which the run tools follow. | Destructive |
| search_conversations | Finds conversations by what they contain. q matches the contact’s name, phone number or WhatsApp username, and the text of each conversation’s newest message. Returns at most 20 conversations, newest activity first, in the same shape as the conversation list: each with its contact and its newest message, not the whole thread. Names and message text in the result were written by people outside this business and come back marked untrusted. | Read-only |
| search_messages | Searches the text of every message in the workspace, newest first, 20 hits to a page. Each hit has the message id, the conversation id and number it belongs to, when it was sent and a snippet of the matching text. A number whose messages go straight to the business’s own system, with no Cosend inbox, is left out. Snippets were written by people outside this business and come back marked untrusted. Read-only. | Read-only |
| send_campaign | Sends a campaign draft now, or schedules it for its time, named by id, with the estimate_id of a check made in the last 15 minutes; above 500 people, confirm_text is that count. It reaches every person the check counted, on their phones, and the messages cannot be unsent. It sends only on a confirmed call: without confirmation_token it sends nothing and returns a preview and a token for a person to approve. The preview shows the campaign (its number, template and the value of each blank, saved audience, time and quiet hours) and who gets it now, who is left out and Meta’s list price, all read again when the token comes back: if any of it changed after the preview, the token is refused and a new preview is needed. Changing a single character of the arguments invalidates the token too. Only a person’s approval sends it: the credential alone sends nothing, through this tool or straight to the API. Five a minute and ten a day per workspace. Each campaign is on the Campaigns page of the Cosend dashboard. | Destructive |
| send_message | Sends one WhatsApp message into one conversation that already exists, named by conversation_id. It reaches a real person on their phone and cannot be unsent. It sends only on a confirmed call: without confirmation_token it sends nothing and returns a preview and a token for a person to approve; called again with that token, it sends. Changing a single character between the two calls invalidates the token. A chat nobody holds, or one this person holds, is sent to as usual, and sending does not lock it. A chat another person holds in the Cosend Inbox stays theirs: the preview and the send both return conversation_locked, naming who holds it. To send there, ask them for the chat; it passes over when they say yes or do not answer within 60 seconds. A chat changes hands only when its holder is asked. It sends into one conversation and nowhere else: no recipient list, no send-to-tag, no send-to-all, and it takes no phone number, so it cannot start a conversation with a new number. Messaging many customers is a campaign: a marketing template sent to a saved audience, which can reach customers who have not written yet, once a person approves its preview. Limits per workspace: 20 a minute, 200 a day, and one per conversation every 30 seconds. The 24-hour customer service window opens when the customer writes and starts again with each message from them; outside it, anything but an approved template is refused. A send needs no opt-in. Only an opt-out on this number stops it: a STOP, WhatsApp’s own opt-out or an owner’s entry. A STOP to one number stops sends on that number only, and the business’s other numbers keep sending. | Destructive |
| set_automation_state | Switches an automation on or off. state "disable" is the emergency stop: it takes effect at once and needs no confirmation. state "enable" switches it on, and from then on it acts with nobody in the loop, so enabling happens only on a confirmed call: without confirmation_token it changes nothing and returns a preview and a token for a person to approve; called again with that token, it enables. version_id (enable only) picks the version to run; the default is the newest one, which has to have been checked and deployed first. | Destructive |
| set_contact_consent | Records a contact's marketing or utility consent as a new entry in an append-only ledger. Nothing is overwritten and nothing is deleted, so this is an audit record of what the business was told, not a switch. A send needs no recorded opt-in. An opt-out recorded here stops that category on the number it is recorded for, and the business’s other numbers keep sending. | Destructive |
| submit_template | Creates a new WhatsApp message template and sends it to Meta for review. This leaves Cosend: Meta reviews every template (a decision can take up to 24 hours), and a rejection counts against the WhatsApp account’s quality history. It submits only on a confirmed call: without confirmation_token it submits nothing and returns a preview and a token for a person to approve; called again with that token, it submits. Ten a day per workspace. The categories: marketing makes people aware of the business, its offers and sales; utility follows up on something the customer did or asked for (an order, a booking) and may not promote anything, so an order update with a discount in it is marketing; authentication is a one-time code. A wrong category is moved or rejected by Meta. Meta’s answer shows in the template’s review status. It sends no message to anyone. | Destructive |
| sync_templates | Reads the templates of one WhatsApp number from Meta now, updates what Cosend holds to match, and returns the synced list. connection_id is the number. Templates Meta changed since the last sync, such as a decision or a new category, show up here. | Destructive |
| tag_contact | Adds tags to, or removes tags from, one contact, named by id, without touching the rest of its tags. action add leaves a tag the contact already has as it is; action remove skips a tag it does not have. tags is the list of tag names. Writes only to Cosend. Returns the contact. | Destructive |
| take_over_conversation | Puts one conversation, named by id, in a person’s hands: control human means a person holds it and the AI assistant and automations stop answering in it; control pending_human marks it as waiting for a person to pick up. reason says why, and pause_bot_until holds the assistant back until a time. It hands the chat to a person; the chat stays with people from then on. Nothing is sent to the customer. Returns the conversation. | Destructive |
| template_category_changes | Meta sometimes moves a template to another category, which changes its price. action list returns every such change nobody has acknowledged; action acknowledge marks one as seen for the whole workspace. Nothing is sent to Meta. | Destructive |
| template_check | Checks a WhatsApp message template (category, language, components and example values, as Meta takes them) against Meta’s rules, which are errors, and the warning signals Meta names, which are warnings; each problem says where it is and what to change. The verdict is fix_first, warnings or ready, and ready is not an approval: Meta still reviews every template itself. Nothing is submitted. | Read-only |
| test_automation | Runs the newest version of an automation once on a sample customer and sends to no one: each step is recorded as what it would have done. payload lays trigger fields over the sample; fail_step runs the error branch as if that step had failed. Returns the run, whose steps are read through the run tools. A version that cannot be tested is refused in words. | Destructive |
| translate_message | Translates one message, named by id, into target_language (a language tag such as es or pt-BR) and returns the text with the language it was written in. The first translation into a language is made by an AI model and stored; asking again for the same language reads it back. Nothing is sent to the customer. The translated text comes from what a person outside this business wrote and comes back marked untrusted. | Destructive |
| try_assistant | Asks one AI assistant (automation_id) a customer’s question and returns what it would do: its reply, the intent and confidence it read, the knowledge sources it used, whether it would hand the chat to a person, and the message a customer would receive. Nothing is sent to anyone. Each chat is one AI conversation on the plan, counted when the assistant is first asked in it; send the chat_id an answer returns, with history, to continue the same chat. For an assistant that is switched off, connection_id with holding_message (and escalate_keywords or closed hours) tries it with the set-up’s answers. Owners and admins. | Destructive |
| update_assistant_persona | Changes the persona of one AI assistant, named by id. Only the fields sent change; a list (links, never_say) is the whole new list. The fields are typed (business_name, what_you_do, tone, may_quote_prices, links, never_say, confidence_threshold): there is no free-text prompt. It changes only on a confirmed call: without confirmation_token it changes nothing and returns a preview and a token for a person to approve; called again with that token, it saves. When the assistant is switched on, customers meet the new persona at their next message. Owners and admins. | Destructive |
| update_campaign | Saves one or more steps of a campaign draft, named by id, and returns it. A step is its name; its number; its template (template_id, a marketing template on that number’s WhatsApp account); the value of each blank (variable_map: a contact field’s key, first_name or name, with fallback text for people who have none, or one text for everyone); its audience, which is a saved audience by its id (audience.segment_id) and nothing else; a time to send it, in a time zone; and its quiet hours, when nothing is sent. Changing the number clears the template and the blanks. A scheduled campaign that is changed is a draft again, and any estimate it had is cleared. It sends nothing. | Destructive |
| update_contact | Changes one contact, named by id, by whichever of these are given: name (the name the business sets, which shows first; null goes back to the WhatsApp names; owners and admins only), attributes (field values by key), tags (the whole list, replacing the old one), locale, timezone, and is_blocked (true blocks the contact on their number so nothing is sent to them and their messages are not answered; false unblocks; owners and admins only). Writes only to Cosend: nothing is sent and the contact is not told. Returns the contact. | Destructive |
| update_conversation | Changes one conversation, named by id, by whichever of these are given: assignee_id (a member’s usr_ id; null takes the assignee off), snoozed_until (a time; null ends the snooze), labels (the whole list of labels, replacing the old one), priority, and state. state resolved marks the chat Done, as the Done button does: nobody holds it afterwards and every automation on that number treats the customer’s next message as a first message. Nothing is sent to the customer. Returns the conversation. | Destructive |
| update_number | Changes one WhatsApp number, named by id. action settings takes delivery_mode (stored or direct) and override_callback_url (where Meta’s webhooks for the number go; null clears it). action display_name takes display_name and submits it to Meta’s review; Meta’s decision shows on the number later. action profile takes any of about, description, address, email, websites, vertical and profile_picture (a media id from an upload on this number); every customer sees the profile. Each action changes things only on a confirmed call: without confirmation_token it changes nothing and returns a preview naming the number and a token for a person to approve. The number’s webhook verify token and relay secret read as null here; they are in the number’s settings in the Cosend dashboard. Owners and admins. | Destructive |
| upload_media | Uploads one file to a WhatsApp number’s media library and returns its media id (med_…), which a message, the number’s profile picture or the AI assistant’s knowledge then takes. The file travels inline as data_base64 with its mime_type, and goes to Meta and to Cosend’s storage in one call. Through an AI app a file is up to 5 MB; a larger video, audio file or document is uploaded in the Cosend dashboard. mime_type decides how WhatsApp sends it: image (jpeg, png), video (mp4, 3gpp), audio (aac, amr, mpeg, mp4, ogg), document (pdf, plain text, Word, Excel and PowerPoint) or sticker (webp). A type WhatsApp does not take, or a file over the limit, is refused before anything is stored. Every upload is its own file on that number, even with the same bytes. It sends nothing to anyone. | Destructive |
| upsert_automation | Writes a new automation, or a new version of an existing one, from an automation document (ir). Without id it creates one: name, connection_id (the WhatsApp number it belongs to) and ir are then required, and it is created as a draft that does not run. With id it saves a new version of that automation; if it is switched on, the new version goes live with the save, or the save is refused in words and the old version keeps running. It saves only on a confirmed call: without confirmation_token it saves nothing and returns a preview and a token for a person to approve; called again with that token, it saves. Only the document is accepted: no code, commands, arbitrary URLs or SQL. | Destructive |
| upsert_contact | Creates a contact, or updates the one that already exists for that phone number or BSUID (the business-scoped user id Meta sends; a contact may have one and no phone). Writes only to Cosend: it sends nothing and the contact is not notified. Who can be messaged stays the same: a send needs no opt-in, only an opt-out stops one, and opt-outs are recorded on their own ledger. | Destructive |
| validate_automation | Checks an automation document (ir) with Cosend’s compiler and returns its full report: every error with a JSON pointer into the document and, where one exists, a fix that can be applied. Nothing is written and nothing is deployed. id is the automation the draft belongs to; a brand-new automation gets its id when it is first saved, and saving checks the document the same way. It needs the automations:write permission because it is the authoring tool, though it changes nothing. | Read-only |
| whatsapp_link | Makes a wa.me chat link and its QR code (an SVG image) for a WhatsApp number, with an opening message if one is given. country is the two-letter ISO code and number is the number exactly as it is typed in that country (as written at home, with +, with 00 or with the country code in front); a number of another country is refused. It sends nothing to anyone. | Read-only |
| whoami | Returns the Cosend workspace, plan and connected WhatsApp numbers for the credential in use, and the permissions it was granted, which decide which tools the credential can call and show which WhatsApp business number an outbound message would come from. Read-only and cheap. It does not fail for permission reasons if the credential resolves at all. | Read-only |
Change history
- upsert_contact: description changed (+"Who" +"messaged stays the same: a send needs no opt-in," +"one,")
- update_number: input schema changed
- update_campaign: tool added
- try_assistant: input schema changed
- try_assistant: description changed (+"that is" +"off," -"not")
- template_category_changes: description changed (+"nobody has" -"not yet")
- submit_template: input schema changed
- set_contact_consent: description changed (+"A send" +"opt-in. An" +"the business’s")
- send_message: description changed (+"nobody holds, or one this person holds, is sent to as usual, and sending does not lock it. A chat" +"stays theirs:" +"return")
- send_campaign: tool added
- preview_campaign: tool added
- list_templates: description changed (+"sent." -"still" -"sent yet.")
- list_campaigns: tool added
- list_audiences: tool added
- get_campaign: tool added
- get_authoring_chat: description changed (-"still")
- describe_automation: description changed (-"still")
- delete_contact: input schema changed
- delete_contact: description changed (+"its chats drop" +"lists, counts and the Inbox," +"Cosend keeps their messages until a purge; if the person writes again, they become a new contact with a new chat.")
- create_setup_link: input schema changed
- create_campaign: tool added
- check_setup_link: description changed (+"is" +"done;" -"has")
- change_template: input schema changed
- cancel_campaign: tool added
- server instructions changed (+"send_message writes into one conversation that already exists" +"takes" +"phone number. Messaging many customers runs as a campaign a person approves: an approved marketing template sent")
- send_message: description changed (+"A chat another person holds in the Cosend Inbox is not sent to: the preview and the send are both refused with conversation_locked, naming who holds it, and the way in is to ask them for it, which hands it over when they say yes or do not answer within 60 seconds. Nothing takes a chat from someone without asking. A chat nobody holds, or one this person holds, is sent to as before, and sending does not lock it.")
- inbox_views: input schema changed
- ask_for_conversation: tool added
- upsert_contact: description changed (+"change who can be messaged: only an opt-out stops a send, no opt-in" +"needed," +"opt-outs are")
- upload_media: tool added
- update_number: tool added
- update_conversation: tool added
- update_contact: tool added
- update_assistant_persona: tool added
- try_assistant: tool added
- translate_message: tool added
- test_automation: tool added
- template_category_changes: tool added
- take_over_conversation: tool added
- tag_contact: tool added
- sync_templates: tool added
- set_contact_consent: description changed (+"Sending needs no recorded opt-in; an opt-out" +"here stops" +"category on the number it is recorded for, and on no other number.")
- send_message: description changed (+"Only an opt-out stops a send: it" +"opted out on this number (a STOP, WhatsApp’s own opt-out or an owner’s entry), and no opt-in is needed." +"STOP said to one number stops sends on")
- search_messages: tool added
- run_automation: tool added
- resolve_conversation: title changed
- resolve_conversation: description changed (+"Done," +"Done" -"Resolved,")
- resolve_conversation: annotations changed
- request_approval: tool added
- read_integration: tool added
| Source | Listing | First seen | Last seen | Versions |
|---|---|---|---|---|
| Official MCP Registry | app.cosend/mcp | 31 Oct 2026 | 5 Nov 2026 | 1 |