Server data from the Official MCP Registry
Ask the user's phone where they are now. The phone answers each request with consent.
About
Ask the user's phone where they are now. The phone answers each request with consent.
Remote endpoints: streamable-http: https://relay.whereabot.io/mcp
Security Report
Whereabot is a location relay that pings a signed-in user's phone and returns a GPS fix to an authenticated agent, and the code shows bearer-token verification on both the MCP and device WebSocket routes plus a rejection of agent tokens acting as phones. The main concerns are an optional service-role-key fallback path that grants broad database access, CORS and host-validation settings whose full configuration is not visible, and the inherent sensitivity of location data, which is relayed by design. No malicious patterns, hardcoded secrets, or shell execution were found in the provided code. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 1 high severity).
17 files analyzed · 11 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
How to Install & Connect
Available as Local & Remote
This plugin can run on your machine or connect to a hosted endpoint. during install.
Documentation
View on GitHubFrom the project's GitHub README.
Whereabot
Let your AI agent ask your phone where you are, on demand. You host the relay. Sign-in and user data live in Supabase.
flowchart LR
Agent["AI agent"] -->|"MCP or HTTP"| Relay["Relay (Rust)"]
Relay -->|WebSocket| Phone["Phone app (Tauri)"]
Phone -->|"GPS fix"| Relay
Relay -->|"answer"| Agent
The relay keeps no location history. It sends a ping, the phone reads its GPS now, and the answer goes back to the agent. What is stored, for how long, and who sees your location: privacy.
Status
Early MVP, in beta. iOS answers in the background through push. Android answers only while the app is open. See the roadmap.
Repo layout
| Path | What |
|---|---|
server/ | Rust relay (axum). Agents call it over HTTP or MCP; the phone holds a WebSocket to it. |
app/ | Tauri v2 phone app (Android / iOS). Signs in, then answers pings with a GPS fix. |
supabase/ | Database migrations and tests. |
infra/ | OpenTofu for the dev and prod environments. |
scripts/ | Local dev, end-to-end check, deploy, hook install. |
docs/ | Source of the docs site. |
site/ | Landing page and OAuth consent page. |
docs-site/ | VitePress build of the docs site. |
design-system/, brand/ | Shared CSS tokens and components; logo files and usage rules. |
Connect your agent
-
Install the app: see Get started on whereabot.io, or install from the browser.
-
Sign in with Google on the phone.
-
Add the relay to your agent:
claude mcp add --transport http whereabot https://relay.whereabot.io/mcp -
In Claude Code run
/mcpand sign in with the same Google account as on the phone. You never paste a token. -
On Android, keep the app open while the agent asks, until Android push ships.
Relay URLs: live URLs. The tool and its arguments: protocol.
Self-host
Run your own relay and Supabase project with the OpenTofu code in infra/. Steps: infra/README.md. Build the app with your Supabase and relay values (app/.env.example), and add your relay to your agent. To run everything on one computer first: local quick start.
Docs
All docs, with the generated MCP and wire references: whereabot.io/docs. In this repo:
- Architecture: components, sign-in and ping flow, security, limits
- Protocol: HTTP, MCP and WebSocket at intent level
- Request flow: every state, notification and agent result of one request
- Location sharing: let another person's agent ask for your location
- Privacy: what is stored, retention, who sees your location
- Operations and infrastructure: how it runs, deploys and releases
- Prior art and roadmap
- Listings: MCP directories,
server.json, how to publish
Community
- Contributing: local setup, hooks, rules, adding a migration
- Security policy: report vulnerabilities privately
- Code of conduct
License
MIT. Third-party material: THIRD_PARTY_NOTICES.md.
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Rea
Freeby Morluto · Developer Tools
Reverse engineer anything from your terminal or agent with one CLI and MCP server.
Paperclip
Freeby Paperclipai · Developer Tools
Trending hip-hop artist momentum scores across four cultural dimensions.
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
by Lharries · Communication
Read, search, and send WhatsApp messages through your AI assistant