Telegram MCP Server using Telethon and MTProto protocol for interacting with Telegram
Server has 4 tools with basic schemas and descriptions, but significant gaps limit production readiness. telegram_status has good diagnostic output but lacks input schema documentation. telegram_execute_code is a dangerous catch-all with minimal guardrails. telegram_send_command and telegram_send_message have reasonable parameter schemas but descriptions lack actionable guidance on when to use each vs. the other. No error recovery hints, no parameter constraints (enums), no output schema documentation. Naming is verb-noun compliant but descriptions average ~150 chars, acceptable but generic. No tool annotations (readOnlyHint/destructiveHint) despite clear risk levels.
Executes arbitrary custom asynchronous Python code with direct access to the live Telethon client and MTProto API. Available pre-injected variables: - `client`: Authenticated Telethon TelegramClient instance (e.g. `await client.get_dialogs()`, `await client(...)`) - `service` / `telegram_service`: The TelegramService instance - `events`: telethon.events - `functions`: telethon.tl.functions (raw MTProto functions) - `types`: telethon.tl.types (raw MTProto types) - `asyncio`, `json`, `os`, `time` Stdout/stderr and return values are captured and returned in the JSON result.
Sends a bot command (e.g. /start, /help, /settings) to the target bot and optionally waits for response.
Sends a text message or payload to the target bot or chat. Supports Markdown ('md') or HTML ('html') formatting. Use topic_id to route directly into a supergroup forum topic.
Checks the current Telegram connection state, session validity, and environment configuration. Call this first to diagnose auth issues before using other tools.
telegram_execute_code allows arbitrary Python execution with no sandboxing, rate limiting, or confirmation step. Agents can accidentally delete data, exfiltrate secrets, or crash the server. Missing dry-run/confirmation pattern.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels. telegram_status is READ_ONLY; telegram_execute_code is IRREVERSIBLE; telegram_send_command and telegram_send_message are WRITE. LLMs cannot infer safety without explicit hints.
No output schema documentation. telegram_status returns JSON but structure is not formally declared. telegram_send_command and telegram_send_message return values are undocumented. LLMs cannot plan downstream calls without knowing response fields.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
parse_mode parameter in telegram_send_message accepts free-form string ('md' or 'html') but lacks enum constraint. LLMs may hallucinate invalid values like 'markdown' or 'text'. Should declare enum: ['md', 'html'].
Error messages in telegram_status are diagnostic but lack recovery guidance. 'Session permanently revoked' tells the agent to run login.py, but no tool exists to do so. Agents cannot self-recover; they must ask the user.