I built whatsapp-mcp: an MCP server that gives LLM agents full access to WhatsApp. This post covers the architecture and the interesting problems I hit.

The Landscape

Three years ago, a rotating proxy pool and a randomized user-agent were enough to get through most defenses. Today:

• Cloudflare Turnstile / Bot Management runs JavaScript challenges and fingerprints your TLS handshake
• DataDome does real-time behavioral analysis — mouse movement, scroll patterns, timing
• PerimeterX (now HUMAN) watches your request graph across sessions

The fundamental shift is that detection moved from request-level to session-level. A single suspicious signal used to flag a request. Now, systems build a behavioral profile across hundreds of interactions before deciding whether you’re a bot.

The old site was a single HTML file with Tailwind and GSAP animations — fun to build, but hard to maintain and impossible to blog on. This new setup gives me:

• A proper blog with tags, categories, and RSS
• A projects showcase page
• Dark/light mode auto-detection
• Math rendering via KaTeX
• Code highlighting with line numbers
• Comments via giscus (GitHub Discussions)
• Search via Lunr.js

Feature Tour

Code Blocks

def fibonacci(n: int) -> list[int]:
    """Generate Fibonacci sequence up to n terms."""
    if n <= 0:
        return []
    seq = [0, 1]
    while len(seq) < n:
        seq.append(seq[-1] + seq[-2])
    return seq[:n]

print(fibonacci(10))
# [0, 1, 1, 2, 3, 5, 8, 13, 21, 34]

Math (KaTeX)

Inline math: $E = mc^2$