WeChat 4.1.7 or newer is the only supported lane
wx-cli supports WeChat 4.1.7 and newer on Apple Silicon macOS. It reads the application's local databases, decrypts them, and gives you commands for conversations, contacts, keyword search, media, exports, and new-message watching. A local server exposes the same material through REST and server-sent events. That is a useful shape for an assistant or archive because the original chat database stays on the Mac instead of being uploaded to a conversion service.
The main README and user guide are written in Chinese, with no separate English README in the repository tree. Commands and API paths are easy to recognize, but the security warnings, failure recovery, and privacy limits require careful translation if you do not read Chinese. The project carries an MIT license. GitHub showed 805 stars and 11 combined issues and pull requests when we fetched it, so the audience is real but still small.
The v1 API can read a timeline across every chat
The v1 REST API includes a timeline route that returns messages from all conversations inside a time window. That saves an agent from walking through each session merely to catch up after a pause. Other endpoints cover sessions, contacts, messages, search, media, and an SSE event stream. The command line can reuse a server already listening on 127.0.0.1:9100, which also avoids reopening databases for every frequent query.
There is an installable agent skill for Claude Code, Codex, and Cursor. The skill teaches the client how to query history and subscribe to new messages, while the API remains the durable boundary underneath it. wx-cli does not send messages itself. The README discusses pairing it with some other sending or agent capability, but that is an example of what a user could build, not a feature supplied here.
What happened when we ran it
Our sandbox installed 274 packages in 9 seconds at commit 2abe708. The Rust build completed in 105 seconds, and cargo test finished in 258 seconds with all 1,411 tests passing. The repository contained 195 files and about 43,668 lines of source in a 1.6 MB checkout. There were 2 CI workflow files, no Dockerfile, and no top-level tests directory.
That is one of the cleaner lab results in this batch, but it covers the Rust workspace in a fresh Debian container. It does not prove key extraction or database compatibility on a Mac with a real WeChat account. The product's supported platform is macOS on arm64, while our 3-CPU, 12 GB container measured install, compilation, and tests. Treat the successful suite as code-health evidence, then test the whole account workflow on a spare copy of your data.
A 120-second key capture asks for a security trade
The example extraction command allows 120 seconds for an LLDB hook to capture the database key while WeChat logs in. The README says the normal path requires System Integrity Protection to be disabled, plus developer-tool access and Apple's command-line tools. Extraction restarts WeChat. If you already have the keys, you can enter them manually and avoid that extraction step.
Issue 20 complicates the blanket SIP requirement. Its reporter says extraction worked on WeChat 4.1.13 with SIP enabled after ad-hoc signing the app and preserving entitlements, yet the current preflight still rejects that setup. Issue 19 reports a 120-second timeout even though login succeeded. Those are user reports, not controlled results from our lab, but they show why the passing 1,411-test suite cannot settle whether extraction will work on your machine.
Contact hiding does not cover full-text search
The v1 server can bind to localhost for private use or to 0.0.0.0 with a required token. That token matters because the service exposes private conversations, contacts, images, and live events. The tool also stores keys and settings under Application Support and keeps decrypted databases in a cache directory. Anyone backing up the Mac or granting an agent broad file access should treat both locations as sensitive.
Contact-hiding rules can exclude named contacts, groups, tags, or group members from queries, exports, and monitoring. The README names a sharp exception: full-text search does not automatically apply those rules. An agent with search access can therefore retrieve material that another command hides. That gap makes the feature unsuitable as a hard authorization boundary. Run different trust levels under separate data access rather than relying on one ignore list.
v0.7.4 is maintained, while account risk remains unresolved
Release v0.7.4 shipped on July 22, 2026, and added avatar URLs plus image-quality metadata. The repository was pushed again on August 26. New issues arrived in late August and September, including Windows support, key-capture timeouts, and the SIP preflight report. Recent source activity plus current issue traffic is a better health sign than the release date alone.
Issue 16 says one user on wx-cli 0.3.0 and WeChat 4.1.11 had an account blocked after using the tool for a short period. The report does not prove what caused the block, so it would be wrong to turn it into a universal warning that wx-cli triggers bans. It still belongs in the buying decision. Use a tool that reaches into an unsupported client process only when the value of searchable local history outweighs host changes and uncertain account consequences.