Self-hosted Telegram multi-account management with Web UI, CLI, Bot, MCP, Telethon, and Telegram Desktop tdata import.
Critical gaps across all dimensions. Tool names lack clear action verbs (op_alive, op_twofa, op_privacy use 'op_' prefix that obscures intent). Descriptions are present but written in Chinese with domain-specific jargon, making them inaccessible to English-speaking LLMs. Parameter schemas exist but lack proper type definitions and descriptions in many cases. No documented output schemas. Error handling and recovery guidance absent. Security concerns: tools manipulate Telegram accounts with no visible permission gates or audit trails. The server is STDIO-only, capping protocol readiness at 50.
号包 ZIP → session + api.json + 取码链接清单。能力对齐机器人侧 GAFBot zhuanapi,但不依赖 python-telegram-bot,也不写全局 acd 目录;结果落在临时 job 目录供下载。
session 号包 → passkey 凭证 zip。需要能连上 Telegram。
筛活:号还能不能用。原版用 GetAppConfigRequest 探测。这个请求很轻,不产生任何可见行为,比发消息安全得多。加超时是因为死号常常是连上了但一直不回包。
批量设隐私。防骚扰、防被搜到,养号必做。不传 items 就用一套保守默认:谁都看不到手机号和最后上线,只有联系人能拉进群、能看头像。
改二步验证密码。Telethon 的 edit_2fa 有两个坑,都得绕:1. 号上没有二验时,绝对不能传 current_password;2. 无二验的号传个错密码去关闭,它会返回 True,所以不能拿返回值当成功判据,得回头再查一次真实状态。
发起二验重置(官方等待期,通常约 7 天)。对应 account.resetPassword:ResetPasswordOk(立即清掉)、ResetPasswordRequestedWait(已进入等待)、ResetPasswordFailedWait(距上次申请太近)。
Tool names use 'op_' prefix that obscures action intent. 'op_alive', 'op_twofa', 'op_privacy' do not follow verb_noun pattern. LLMs cannot infer what these tools do from names alone.
All descriptions are in Chinese. English-speaking LLMs cannot parse intent, prerequisites, or return values. Descriptions must be in English and follow the 'WHAT, WHEN, WHY' structure.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields. Every tool must declare what it returns.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
取消进行中的二验重置等待(account.declinePasswordReset)。
查二验状态:有无云密码、有无辅助邮箱、是否已在重置等待期。只调用 GetPasswordRequest,不改任何设置、不发邮件。
批量执行工具箱操作。支持并发控制、参数校验、结果保序。
session 号包 → tdata 号包。需要 opentele。
tdata 号包 → StringSession 文本 + json。内置解析,无需 opentele。
校验工具箱操作的参数。检查操作是否存在、参数是否合法、危险操作是否已确认。
Destructive operations (op_twofa, op_twofa_reset, op_privacy, convert_zip) lack confirmation steps or dry-run modes. No permission gates visible. Agents can irreversibly modify Telegram accounts without safeguards.
Parameter descriptions missing or minimal. 'timeout' in op_alive has a description, but 'items' in op_privacy lacks detail on valid keys/values. 'mode' in convert_zip is underdocumented. LLMs cannot validate inputs.