Telegram (overpod) MCP Server
@overpod/mcp-telegram
npm
v1.41.6
Source verified
Published by mcp-telegram — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
MCP server for Telegram userbot — messages, media, reactions, polls & more. Built on GramJS/MTProto.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 3 = 97. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 1
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([telegram-set-emoji-status, telegram-get-boosts-status, telegram-read-topic-messages, telegram-get-group-call, telegram-download-media, telegram-get-profile-photo, telegram-get-web-preview, telegram-read-messages, telegram-get-unread, telegram-get-updates, telegram-get-channel-updates, telegram-get-quick-replies, telegram-get-quick-reply-messages, telegram-get-stars-status, telegram-get-stars-transactions, telegram-send-sticker, telegram-get-all-stories, telegram-get-peer-stories, telegram-get-stories-by-id, telegram-get-stories-archive]) co-exist with external-action tools ([telegram-send-message, telegram-forward-message, telegram-get-discussion-message]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [telegram-set-emoji-status, telegram-get-boosts-status, telegram-read-topic-messages, telegram-get-group-call, telegram-download-media, telegram-get-p
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow telegram-set-emoji-status → telegram-send-message
Tools 181
Each tool and what it can reach — statically extracted from the published source.
telegram-download-mediaingests untrusted inputtelegram-forward-messagenetwork egresstelegram-get-all-storiesingests untrusted inputtelegram-get-boosts-statusingests untrusted inputtelegram-get-channel-updatesingests untrusted inputtelegram-get-discussion-messagenetwork egresstelegram-get-group-callingests untrusted inputtelegram-get-peer-storiesingests untrusted inputtelegram-get-profile-photoingests untrusted inputtelegram-get-quick-repliesingests untrusted input
Show 171 more tools ↓
telegram-get-quick-reply-messagesingests untrusted inputtelegram-get-stars-statusingests untrusted inputtelegram-get-stars-transactionsingests untrusted inputtelegram-get-stories-archiveingests untrusted inputtelegram-get-stories-by-idingests untrusted inputtelegram-get-unreadingests untrusted inputtelegram-get-updatesingests untrusted inputtelegram-get-web-previewingests untrusted inputtelegram-read-messagesingests untrusted inputtelegram-read-topic-messagesingests untrusted inputtelegram-send-messagenetwork egresstelegram-send-stickeringests untrusted inputtelegram-set-emoji-statusingests untrusted inputtelegram-activate-stealth-modeno sensitive capabilitytelegram-add-contactno sensitive capabilitytelegram-approve-join-requestno sensitive capabilitytelegram-archive-chatno sensitive capabilitytelegram-ban-userno sensitive capabilitytelegram-block-userno sensitive capabilitytelegram-change-stars-subscriptionno sensitive capabilitytelegram-clear-draftsno sensitive capabilitytelegram-clear-recent-emoji-statusesno sensitive capabilitytelegram-close-pollno sensitive capabilitytelegram-convert-star-giftno sensitive capabilitytelegram-create-business-chat-linkno sensitive capabilitytelegram-create-folderno sensitive capabilitytelegram-create-groupno sensitive capabilitytelegram-create-invite-linkno sensitive capabilitytelegram-create-pollno sensitive capabilitytelegram-create-topicno sensitive capabilitytelegram-delete-business-chat-linkno sensitive capabilitytelegram-delete-fact-checkno sensitive capabilitytelegram-delete-folderno sensitive capabilitytelegram-delete-messageno sensitive capabilitytelegram-delete-profile-photono sensitive capabilitytelegram-delete-scheduledno sensitive capabilitytelegram-delete-storiesno sensitive capabilitytelegram-delete-topicno sensitive capabilitytelegram-edit-business-chat-linkno sensitive capabilitytelegram-edit-fact-checkno sensitive capabilitytelegram-edit-folderno sensitive capabilitytelegram-edit-groupno sensitive capabilitytelegram-edit-messageno sensitive capabilitytelegram-edit-storyno sensitive capabilitytelegram-edit-topicno sensitive capabilitytelegram-export-story-linkno sensitive capabilitytelegram-get-admin-logno sensitive capabilitytelegram-get-available-star-giftsno sensitive capabilitytelegram-get-boosts-listno sensitive capabilitytelegram-get-broadcast-statsno sensitive capabilitytelegram-get-business-chat-linksno sensitive capabilitytelegram-get-chat-foldersno sensitive capabilitytelegram-get-chat-infono sensitive capabilitytelegram-get-chat-membersno sensitive capabilitytelegram-get-contact-requestsno sensitive capabilitytelegram-get-contactsno sensitive capabilitytelegram-get-draftsno sensitive capabilitytelegram-get-fact-checkno sensitive capabilitytelegram-get-global-privacy-settingsno sensitive capabilitytelegram-get-group-call-participantsno sensitive capabilitytelegram-get-groups-for-discussionno sensitive capabilitytelegram-get-installed-stickersno sensitive capabilitytelegram-get-invite-linksno sensitive capabilitytelegram-get-megagroup-statsno sensitive capabilitytelegram-get-message-buttonsno sensitive capabilitytelegram-get-message-linkno sensitive capabilitytelegram-get-message-read-participantsno sensitive capabilitytelegram-get-my-boostsno sensitive capabilitytelegram-get-my-roleno sensitive capabilitytelegram-get-outbox-read-dateno sensitive capabilitytelegram-get-paid-reaction-privacyno sensitive capabilitytelegram-get-poll-resultsno sensitive capabilitytelegram-get-poll-votersno sensitive capabilitytelegram-get-profileno sensitive capabilitytelegram-get-reactionsno sensitive capabilitytelegram-get-recent-reactionsno sensitive capabilitytelegram-get-recent-stickersno sensitive capabilitytelegram-get-repliesno sensitive capabilitytelegram-get-saved-dialogsno sensitive capabilitytelegram-get-saved-star-giftsno sensitive capabilitytelegram-get-scheduledno sensitive capabilitytelegram-get-sessionsno sensitive capabilitytelegram-get-stars-subscriptionsno sensitive capabilitytelegram-get-stars-topup-optionsno sensitive capabilitytelegram-get-stateno sensitive capabilitytelegram-get-sticker-setno sensitive capabilitytelegram-get-story-viewsno sensitive capabilitytelegram-get-suggested-foldersno sensitive capabilitytelegram-get-top-reactionsno sensitive capabilitytelegram-get-transcriptionno sensitive capabilitytelegram-get-unread-mentionsno sensitive capabilitytelegram-get-unread-reactionsno sensitive capabilitytelegram-inline-queryno sensitive capabilitytelegram-inline-query-sendno sensitive capabilitytelegram-invite-to-groupno sensitive capabilitytelegram-join-chatno sensitive capabilitytelegram-kick-userno sensitive capabilitytelegram-leave-groupno sensitive capabilitytelegram-list-chatsno sensitive capabilitytelegram-list-emoji-statusesno sensitive capabilitytelegram-list-topicsno sensitive capabilitytelegram-loginno sensitive capabilitytelegram-logoutno sensitive capabilitytelegram-mark-as-readno sensitive capabilitytelegram-mark-dialog-unreadno sensitive capabilitytelegram-mute-chatno sensitive capabilitytelegram-pin-chatno sensitive capabilitytelegram-pin-messageno sensitive capabilitytelegram-press-buttonno sensitive capabilitytelegram-rate-transcriptionno sensitive capabilitytelegram-react-to-storyno sensitive capabilitytelegram-read-storiesno sensitive capabilitytelegram-remove-adminno sensitive capabilitytelegram-reorder-foldersno sensitive capabilitytelegram-report-spamno sensitive capabilitytelegram-report-storyno sensitive capabilitytelegram-resolve-business-chat-linkno sensitive capabilitytelegram-revoke-invite-linkno sensitive capabilitytelegram-save-draftno sensitive capabilitytelegram-save-star-giftno sensitive capabilitytelegram-search-chatsno sensitive capabilitytelegram-search-globalno sensitive capabilitytelegram-search-messagesno sensitive capabilitytelegram-search-sticker-setsno sensitive capabilitytelegram-send-albumno sensitive capabilitytelegram-send-contactno sensitive capabilitytelegram-send-diceno sensitive capabilitytelegram-send-fileno sensitive capabilitytelegram-send-locationno sensitive capabilitytelegram-send-paid-reactionno sensitive capabilitytelegram-send-reactionno sensitive capabilitytelegram-send-scheduledno sensitive capabilitytelegram-send-storyno sensitive capabilitytelegram-send-typingno sensitive capabilitytelegram-send-venueno sensitive capabilitytelegram-send-video-noteno sensitive capabilitytelegram-send-voiceno sensitive capabilitytelegram-set-adminno sensitive capabilitytelegram-set-auto-deleteno sensitive capabilitytelegram-set-birthdayno sensitive capabilitytelegram-set-business-awayno sensitive capabilitytelegram-set-business-greetingno sensitive capabilitytelegram-set-business-hoursno sensitive capabilitytelegram-set-business-introno sensitive capabilitytelegram-set-business-locationno sensitive capabilitytelegram-set-chat-permissionsno sensitive capabilitytelegram-set-chat-reactionsno sensitive capabilitytelegram-set-default-reactionno sensitive capabilitytelegram-set-global-privacy-settingsno sensitive capabilitytelegram-set-personal-channelno sensitive capabilitytelegram-set-privacyno sensitive capabilitytelegram-set-profile-colorno sensitive capabilitytelegram-set-profile-photono sensitive capabilitytelegram-set-slow-modeno sensitive capabilitytelegram-statusno sensitive capabilitytelegram-terminate-sessionno sensitive capabilitytelegram-toggle-anti-spamno sensitive capabilitytelegram-toggle-channel-signaturesno sensitive capabilitytelegram-toggle-folder-tagsno sensitive capabilitytelegram-toggle-forum-modeno sensitive capabilitytelegram-toggle-paid-reaction-privacyno sensitive capabilitytelegram-toggle-prehistory-hiddenno sensitive capabilitytelegram-toggle-story-pinnedno sensitive capabilitytelegram-toggle-story-pinned-to-topno sensitive capabilitytelegram-transcribe-audiono sensitive capabilitytelegram-translate-messageno sensitive capabilitytelegram-unban-userno sensitive capabilitytelegram-unblock-userno sensitive capabilitytelegram-unpin-messageno sensitive capabilitytelegram-update-profileno sensitive capabilitytelegram-vote-pollno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (181 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 3
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.41.6 latest |
A 97/100 | 1 | 1.13.0 | 2026-09-05 |
v1.41.5 |
A 96/100 | 1 | 1.13.0 | 2026-08-25 |
v1.41.2 |
A 96/100 | 1 | 1.12.1 | 2026-08-20 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @overpod/mcp-telegram --onlineOther implementations of Telegram 14
Independent packages implementing the same tool, scanned with the same engine. Compare all 15 side by side →
Production-ready MCP Server for Telegram Bot API - 162 methods with token-optimized meta mode
Telegram MCP server (MTProto). Connect Claude, Codex, Cursor, Claude Code, VS Code, Cline, Windsurf, and other MCP clients to a real Telegram user account: read dialogs, search messages globally, send/edit/forward, react/poll, moderate channels, tag Saved
MCP server for a Telegram client built with the MTProto library and FastMCP framework
MCP server for telegram API integration
Telegram MCP server for interacting with Telegram via the Model Context Protocol
A MCP server for Telegram.
More in Communication & Collaboration
One key, 100+ models — chat with any LLM and generate video, images, speech. Free trial at 370.ai.
Retired compatibility stub for the AgentCanary MCP server. Daily briefs continue on X and Telegram.
A Backstage plugin that provides a chat interface for interacting with the MCP Servers.
Signal-first Bitcoin intelligence: sovereign, hiring & hashrate signals over MCP.
WhatsApp® reminders and rescheduling for Calendly. Public read-only MCP endpoint.
Open Source Generic MCP Client for testing & evaluating mcp servers and agents