Telegram MCP Server (TONresistor/telegram-mcp) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 324 tools. No publisher has claimed this listing.

C
Caution
74/100

Telegram MCP Server

Enables interaction with Telegram through the complete Bot API, supporting all 162 methods with a token-optimized meta mode for minimal context usage.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

TONresistor

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical, 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 2 credentials: TELEGRAM_BOT_TOKEN, WEBHOOK_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes163 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

getUpdates

Receive incoming updates using long polling. Returns an Array of Update objects.

setWebhook

Specify a URL to receive incoming updates via webhook. Use deleteWebhook to remove.

deleteWebhook

Remove webhook integration. Use getUpdates to receive updates after this.

getWebhookInfo

Get current webhook status. Returns a WebhookInfo object with URL, pending updates count, and errors.

getMe

Get basic information about the bot. Returns a User object with id, is_bot, first_name, username, etc.

logOut

Log out from the cloud Bot API server. After logging out, you must wait 10 minutes before logging in again.

close

Close the bot instance. Use before moving the bot to a local server. Must be called before running locally.

getForumTopicIconStickers

Get custom emoji stickers that can be used as forum topic icons by any user. Returns an Array of Sticker objects.

createForumTopic

Create a topic in a forum supergroup chat. The bot must be an administrator with can_manage_topics rights. Returns ForumTopic object.

editForumTopic

Edit name and icon of a forum topic. The bot must be an administrator with can_manage_topics rights. Returns True on success.

closeForumTopic

Close an open topic in a forum supergroup chat. The bot must be an administrator with can_manage_topics rights. Returns True on success.

reopenForumTopic

Reopen a closed topic in a forum supergroup chat. The bot must be an administrator with can_manage_topics rights. Returns True on success.

deleteForumTopic

Delete a forum topic along with all its messages in a forum supergroup chat. The bot must be an administrator with can_delete_messages rights. Returns True on success.

unpinAllForumTopicMessages

Clear the list of pinned messages in a forum topic. The bot must be an administrator with can_pin_messages rights. Returns True on success.

editGeneralForumTopic

Edit the name of the 'General' topic in a forum supergroup chat. The bot must be an administrator with can_manage_topics rights. Returns True on success.

closeGeneralForumTopic

Close the 'General' topic in a forum supergroup chat. The bot must be an administrator with can_manage_topics rights. Returns True on success.

reopenGeneralForumTopic

Reopen the closed 'General' topic in a forum supergroup chat. The bot must be an administrator with can_manage_topics rights. Returns True on success.

hideGeneralForumTopic

Hide the 'General' topic in a forum supergroup chat. The bot must be an administrator with can_manage_topics rights. The topic will be automatically closed if it was open. Returns True on success.

unhideGeneralForumTopic

Unhide the 'General' topic in a forum supergroup chat. The bot must be an administrator with can_manage_topics rights. Returns True on success.

unpinAllGeneralForumTopicMessages

Clear the list of pinned messages in a General forum topic. The bot must be an administrator with can_pin_messages rights. Returns True on success.

answerInlineQuery

Send answers to an inline query. Results are displayed in the user's chat. Maximum 50 results per query. Returns True on success.

answerCallbackQuery

Send answers to callback queries sent from inline keyboards. The answer is displayed as a notification at the top of the chat screen or as an alert. Returns True on success.

answerWebAppQuery

Set the result of an interaction with a Web App and send a corresponding message on behalf of the user to the chat from which the query originated. Returns a SentWebAppMessage object on success.

savePreparedInlineMessage

Store a message that can be sent by a user of a Mini App. Returns a PreparedInlineMessage object with a unique identifier and expiration date.

setMessageReaction

Change the chosen reactions on a message. Service messages cannot be reacted to. Bots cannot use paid reactions. Returns True on success.

getUserChatBoosts

Get the list of boosts added to a chat by a user. Requires administrator rights in the chat. Returns a UserChatBoosts object on success.

getBusinessConnection

Get information about the connection of the bot with a business account. Returns a BusinessConnection object on success.

editMessageText

Edit text and game messages. Returns the edited Message on success, or True if the message is an inline message.

editMessageCaption

Edit captions of messages. Returns the edited Message on success, or True if the message is an inline message.

editMessageMedia

Edit animation, audio, document, photo, or video messages, or add media to text messages. If a message is part of a message album, then it can only be edited to an audio for audio albums, only to a document for document albums and to a photo or a video otherwise. Returns the edited Message on succes

editMessageLiveLocation

Edit live location messages. A location can be edited until its live_period expires or editing is explicitly disabled by a call to stopMessageLiveLocation. Returns the edited Message on success, or True if the message is an inline message.

stopMessageLiveLocation

Stop updating a live location message before live_period expires. Returns the edited Message on success, or True if the message is an inline message.

editMessageReplyMarkup

Edit only the reply markup of messages. Returns the edited Message on success, or True if the message is an inline message.

stopPoll

Stop a poll which was sent by the bot. Returns the stopped Poll on success.

deleteMessage

Delete a message, including service messages, with the following limitations: A message can only be deleted if it was sent less than 48 hours ago. Service messages about a supergroup, channel, or forum topic creation can't be deleted. A dice message in a private chat can only be deleted if it was se

deleteMessages

Delete multiple messages simultaneously. If some of the specified messages can't be found, they are skipped. Returns True on success.

getAvailableGifts

Returns the list of gifts that can be sent by the bot to users and channel chats. Returns a Gifts object.

sendGift

Sends a gift to the given user or channel chat. The gift cannot be converted to Telegram Stars by the receiver. Returns True on success.

giftPremiumSubscription

Gifts a Telegram Premium subscription to the given user. Returns True on success.

getBusinessAccountGifts

Returns the gifts received and owned by a managed business account. Requires the can_view_gifts_and_stars business bot right. Returns an OwnedGifts object on success.

getUserGifts

Returns the gifts received and owned by a given user. Returns an OwnedGifts object on success.

getChatGifts

Returns the gifts received and owned by a chat. Returns an OwnedGifts object on success.

convertGiftToStars

Converts a given regular gift to Telegram Stars. Requires the can_convert_gifts_to_stars business bot right. Returns True on success.

upgradeGift

Upgrades a given regular gift to a unique gift. Requires the can_transfer_and_upgrade_gifts business bot right. Returns True on success.

transferGift

Transfers an owned unique gift to another user. Requires the can_transfer_and_upgrade_gifts business bot right. Returns True on success.

verifyUser

Verifies a user on behalf of the organization which is represented by the bot. Returns True on success.

verifyChat

Verifies a chat on behalf of the organization which is represented by the bot. Returns True on success.

removeUserVerification

Removes verification from a user who is currently verified on behalf of the organization represented by the bot. Returns True on success.

removeChatVerification

Removes verification from a chat that is currently verified on behalf of the organization represented by the bot. Returns True on success.

setPassportDataErrors

Informs a user that some of the Telegram Passport elements they provided contain errors. The user will not be able to re-submit their Passport to you until the errors are fixed. Returns True on success.

readBusinessMessage

Marks incoming message as read on behalf of a business account. Requires the can_read_messages business bot right. Returns True on success.

deleteBusinessMessages

Deletes messages on behalf of a business account. Requires can_delete_sent_messages for bot's own messages or can_delete_all_messages for any message. Returns True on success.

setBusinessAccountName

Changes the first and last name of a managed business account. Requires the can_change_name business bot right. Returns True on success.

setBusinessAccountUsername

Changes the username of a managed business account. Requires the can_change_username business bot right. Returns True on success.

setBusinessAccountBio

Changes the bio of a managed business account. Requires the can_change_bio business bot right. Returns True on success.

setBusinessAccountProfilePhoto

Changes the profile photo of a managed business account. Requires the can_edit_profile_photo business bot right. Returns True on success.

removeBusinessAccountProfilePhoto

Removes the current profile photo of a managed business account. Requires the can_edit_profile_photo business bot right. Returns True on success.

setBusinessAccountGiftSettings

Changes the privacy settings for gifts in a managed business account. Requires the can_change_gift_settings business bot right. Returns True on success.

getBusinessAccountStarBalance

Returns the current Telegram Star balance of a managed business account. Requires the can_view_gifts_and_stars business bot right. Returns a StarAmount object on success.

transferBusinessAccountStars

Transfers Telegram Stars from a managed business account to the bot's balance. The Stars can then be withdrawn by the bot. Requires the can_transfer_stars business bot right. Returns True on success.

postStory

Posts a story on behalf of a managed business account. Requires the can_manage_stories business bot right. Returns a Story object on success.

editStory

Edits a story previously posted by the bot on behalf of a managed business account. Requires the can_manage_stories business bot right. Returns a Story object on success.

deleteStory

Deletes a story previously posted by the bot on behalf of a managed business account. Requires the can_manage_stories business bot right. Returns True on success.

repostStory

Reposts a story from one managed business account to another. Both accounts must be managed by the same bot. Requires the can_manage_stories business bot right for both accounts. Returns a Story object on success.

approveSuggestedPost

Approves a suggested post in a direct messages chat. The bot must have the can_post_messages administrator right in the corresponding channel chat. Returns True on success.

declineSuggestedPost

Declines a suggested post in a direct messages chat. Requires the can_manage_direct_messages administrator right in the corresponding channel. Returns True on success.

sendInvoice

Send an invoice to a user. On success, the sent Message is returned.

createInvoiceLink

Create a link for an invoice. Returns the created invoice link as String on success.

answerShippingQuery

Reply to shipping queries. If you sent an invoice requesting a shipping address and the parameter is_flexible was specified, the Bot API will send an Update with a shipping_query field to the bot. Use this method to reply to shipping queries. On success, True is returned.

answerPreCheckoutQuery

Respond to pre-checkout queries. Once the user has confirmed their payment and shipping details, the Bot API sends the final confirmation in the form of an Update with the field pre_checkout_query. Use this method to respond to such pre-checkout queries. On success, True is returned. Note: The Bot A

getStarTransactions

Returns the bot's Telegram Star transactions in chronological order. On success, returns a StarTransactions object.

refundStarPayment

Refunds a successful payment in Telegram Stars. Returns True on success.

editUserStarSubscription

Allows the bot to cancel or re-enable extension of a subscription paid in Telegram Stars. Returns True on success.

getMyStarBalance

Returns the bot's current balance in Telegram Stars. On success, returns a StarAmount object.

sendGame

Send a game. On success, the sent Message is returned.

setGameScore

Set the score of the specified user in a game message. On success, if the message is not an inline message, the Message is returned, otherwise True is returned. Returns an error, if the new score is not greater than the user's current score in the chat and force is False.

getGameHighScores

Get data for high score tables. Will return the score of the specified user and several of their neighbors in a game. Returns an Array of GameHighScore objects.

setMyCommands

Change the list of bot commands. Returns True on success. At most 100 commands can be specified.

deleteMyCommands

Delete the list of bot commands for the given scope and language. Returns True on success.

getMyCommands

Get the current list of bot commands for the given scope and language. Returns an Array of BotCommand objects.

setMyName

Change the bot's name. Returns True on success.

getMyName

Get the current bot name for the given user language. Returns a BotName object.

setMyDescription

Change the bot's description, shown in empty chats and shared via bot links. Returns True on success.

getMyDescription

Get the current bot description for the given user language. Returns a BotDescription object.

setMyShortDescription

Change the bot's short description, shown on the bot's profile page and shared alongside bot links. Returns True on success.

getMyShortDescription

Get the current bot short description for the given user language. Returns a BotShortDescription object.

setChatMenuButton

Change the bot's menu button in a private chat, or the default menu button. Returns True on success.

getChatMenuButton

Get the current value of the bot's menu button in a private chat, or the default menu button. Returns a MenuButton object.

setMyDefaultAdministratorRights

Change the default administrator rights requested when adding the bot as administrator to groups or channels. Returns True on success.

getMyDefaultAdministratorRights

Get the current default administrator rights of the bot. Returns a ChatAdministratorRights object.

getUserProfilePhotos

Get a list of profile pictures for a user. Returns a UserProfilePhotos object.

setUserEmojiStatus

Change the emoji status for a user who authorized the bot via Mini App method requestEmojiStatusAccess. Returns True on success.

getFile

Get basic info about a file and prepare it for downloading. Returns a File object with file_path for download. Files up to 20MB can be downloaded.

banChatMember

Ban a user in a group, supergroup or channel. The bot must be an administrator with the appropriate rights. Returns True on success.

unbanChatMember

Unban a previously banned user in a supergroup or channel. The user will NOT return to the group automatically but will be able to join via link, etc. The bot must be an administrator. Returns True on success.

banChatSenderChat

Ban a channel chat in a supergroup or channel. Until the chat is unbanned, the owner of the banned chat won't be able to send messages on behalf of any of their channels. The bot must be an administrator and must have the appropriate administrator rights. Returns True on success.

unbanChatSenderChat

Unban a previously banned channel chat in a supergroup or channel. The bot must be an administrator and must have the appropriate administrator rights. Returns True on success.

restrictChatMember

Restrict a user in a supergroup. The bot must be an administrator with can_restrict_members rights. Pass True for all permissions to lift restrictions from a user. Returns True on success.

promoteChatMember

Promote or demote a user in a supergroup or channel. The bot must be an administrator with the appropriate rights. Pass False for all boolean parameters to demote a user. Returns True on success.

setChatAdministratorCustomTitle

Set a custom title for an administrator in a supergroup promoted by the bot. Returns True on success.

63 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies1 critical1 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@4.0.17GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.0.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configHEALTH_PORTEnable health endpoints (/health, /metrics)
configLOG_LEVELinfo debug / info / warning / error / critical
configMAX_RETRIES3 Retry attempts (0-10)
configRATE_LIMIT_PER_MINUTE30 Global rate limit (1-60)
configREQUEST_TIMEOUT30000 Request timeout in ms (5000-120000)
🔐 secretTELEGRAM_BOT_TOKEN"": "your_token_here"
configWEBHOOK_PORT
🔐 secretWEBHOOK_SECRET
configWEBHOOK_URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

324/324 tools missing one or more hints — getUpdates (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); setWebhook (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); deleteWebhook (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +321 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 14/324 tools referenced in tests (4%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 1 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Dependency freshness

1/3 production deps stale: prom-client@2024-06-27 (2.1y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/tonresistor/telegram-mcp?variant=verified)](https://m8ven.ai/mcp/tonresistor/telegram-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: f9ff67476434e0203f3b6e21b9234abef43f0a87
code hash: f64c8eaaecc8108c3e1f18db197105e5fe59b94ad96a44530982cfc16df0202d
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client