Better Telegram MCP
Telegram for AI agents: messages, chats, media, and contacts in bot and user-account modes.
Open source Open in the app JSON README (API)
About
Telegram for AI agents: messages, chats, media, and contacts in bot and user-account modes.
Details
- Kind
- MCP servers
- Topic
- Communication
- Publisher
- n24q02m
- Origin
- official
- Category
- ferramentas
- Transport
- local
- Version
- 4.19.0
- Stars
- 11
- Forks
- 5
- Open pull requests
- 4
- Last push
- 2026-09-04T22:41:07Z
- Repository state
- ativo
- Language
- Python
- License
- Apache-2.0
- Added
- 2026-08-29 04:00:52
- Updated
- 2026-08-31 12:00:08
- Origin id
io.github.n24q02m/better-telegram-mcp
README
# Better Telegram MCP mcp-name: io.github.n24q02m/better-telegram-mcp **Telegram for AI agents: messages, chats, media, and contacts in bot and user-account modes.** <!-- Badge Row 1: Status --> [](https://github.com/n24q02m/better-telegram-mcp/actions/workflows/ci.yml) [](https://codecov.io/gh/n24q02m/better-telegram-mcp) [](https://pypi.org/project/better-telegram-mcp/) [](https://hub.docker.com/r/n24q02m/better-telegram-mcp) [](https://www.apache.org/licenses/LICENSE-2.0) <!-- Badge Row 2: Tech --> [](#) [](https://core.telegram.org) [](#) [](https://github.com/python-semantic-release/python-semantic-release) [](https://github.com/renovatebot/renovate) <!-- BEGIN: AUTO-GENERATED-CROSS-PROMO --> <details> <summary><strong>Sister projects from n24q02m</strong> (click to expand)</summary> | Project | Tagline | Tag | |---|---|---| | [agent-chat-plugin](https://github.com/n24q02m/agent-chat-plugin) | Peer AI agents chat in a shared folder — no human relay, no orchestrator, wor... | Tooling | | [better-code-review-graph](https://github.com/n24q02m/better-code-review-graph) | Knowledge graph for token-efficient code reviews -- semantic search and call-... | MCP | | [better-drive](https://github.com/n24q02m/better-drive) | 2-way Google Drive sync with .driveignore filter — rclone engine, Windows tray | Tooling | | [better-email-mcp](https://github.com/n24q02m/better-email-mcp) | IMAP/SMTP email for AI agents -- read, send, organize folders, and manage att... | MCP | | [better-godot-mcp](https://github.com/n24q02m/better-godot-mcp) | Composite MCP server for Godot Engine -- 17 composite tools for AI-assisted g... | MCP | | [better-notion-mcp](https://github.com/n24q02m/better-notion-mcp) | Markdown-first Notion for AI agents -- pages, databases, blocks, and comments... | MCP | | [better-semantic-release](https://github.com/n24q02m/better-semantic-release) | Drop-in python-semantic-release fork with built-in release-safety guards (orp... | Tooling | | [better-telegram-mcp](https://github.com/n24q02m/better-telegram-mcp) | Telegram for AI agents -- messages, chats, media, and contacts across both bo... | MCP | | [better-workspace-mcp](https://github.com/n24q02m/better-workspace-mcp) | Google Workspace MCP server (Docs/Drive/Calendar/Gmail/Sheets/Slides/Tasks/Ch... | MCP | | [claude-plugins](https://github.com/n24q02m/claude-plugins) | Claude Code plugin marketplace for the n24q02m MCP servers -- install web sea... | Marketplace | | [imagine-mcp](https://github.com/n24q02m/imagine-mcp) | Image and video understanding + generation for AI agents -- across Gemini, Op... | MCP | | [jules-task-archiver](https://github.com/n24q02m/jules-task-archiver) | Chrome Extension for bulk operations on Jules tasks via batchexecute API -- a... | Tooling | | [mcp-core](https://github.com/n24q02m/mcp-core) | Shared foundation for building MCP servers -- Streamable HTTP transport, OAut... | MCP | | [mnemo-mcp](https://github.com/n24q02m/mnemo-mcp) | Persistent AI memory with hybrid search and embedded sync. Open, free, unlimi... | MCP | | [qwen3-embed](https://github.com/n24q02m/qwen3-embed) | Lightweight Qwen3 text embedding and reranking via ONNX Runtime and GGUF | Library | | [skret](https://github.com/n24q02m/skret) | Secrets without the server. | CLI | | [tacet](https://github.com/n24q02m/tacet) | A self-distilling neuro-symbolic cascade that amortises LLM cost across knowl... | Tooling | | [web-core](https://github.com/n24q02m/web-core) | Shared web infrastructure package for search, scraping, HTTP security, and st... | Library | | [wet-mcp](https://github.com/n24q02m/wet-mcp) | Open-source MCP server for AI agents: web search, content extraction, and lib... | MCP | </details> <!-- END: AUTO-GENERATED-CROSS-PROMO --> ## Table of contents - [Features](#features) - [Status](#status) - [Install](#install) - [Smithery](#smithery) - [Configuration](#configuration) - [CLI](#cli) - [Documentation](#documentation) - [Tools](#tools) - [Comparison](#comparison) - [Security](#security) - [Build from Source](#build-from-source) - [Deploy to Cloudflare](#deploy-to-cloudflare) - [Trust Model](#trust-model) - [License](#license) <a href="https://glama.ai/mcp/servers/n24q02m/better-telegram-mcp"> <img width="380" height="200" src="https://glama.ai/mcp/servers/n24q02m/better-telegram-mcp/badge" alt="better-telegram-mcp MCP server" /> </a> ## Features - **Dual mode** -- Bot API (httpx) for bots, MTProto (Telethon) for user accounts - **7 tools** with action dispatch: `message`, `chat`, `media`, `contact`, `config`, `help`, `config__open_relay` - **Auto-detect mode** -- Set bot token for bot mode, or API credentials for user mode - **Web-based OTP auth** -- HTTP-mode browser relay form handles phone, OTP, and 2FA for user accounts - **Local CLI auth** -- `auth` configures a single-user machine; `login` remains a deprecated alias - **Tool annotations** -- Each tool declares `readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint` - **MCP Resources** -- Documentation available as `telegram://docs/*` resources - **Security hardened** -- SSRF protection, path traversal prevention, error sanitization ## Status Two clean transports: **stdio** (default, local single-user mode) and **HTTP** (bot + user mode, browser relay setup, optional multi-user). No daemon-bridge layer and no auto-spawn from stdio. See [Modes overview](https://mcp.n24q02m.com/get-started/modes-overview/) for the full transport model. Sister MCP servers from the same author are listed in the [collapsible section above](#better-telegram-mcp) -- they share this architecture, so install patterns transfer. ## Install ```bash # Method 1 (default): plugin install via Claude Code (stdio, bot mode) /plugin marketplace add n24q02m/claude-plugins /plugin install better-telegram-mcp@n24q02m-plugins # Method 1 (CLI): direct uvx invocation (stdio, bot mode) claude mcp add telegram -e TELEGRAM_BOT_TOKEN=123456:ABC-DEF -- uvx better-telegram-mcp # Method 2 (fallback): Docker stdio docker run -i --rm -e TELEGRAM_BOT_TOKEN=123456:ABC-DEF n24q02m/better-telegram-mcp # Method 3 (recommended for user mode / multi-device / OAuth): Docker HTTP docker run -d --name better-telegram-mcp-http -p 8080:8080 \ -e MCP_TRANSPORT=http \ -e PUBLIC_URL=https://telegram.example.com \ -e MCP_DCR_SERVER_SECRET=<32+ random bytes> \ n24q02m/better-telegram-mcp:latest ``` Stdio mode is local single-user mode. Bot mode uses `TELEGRAM_BOT_TOKEN`; user mode can be configured locally with `better-telegram-mcp auth --phone <+number>`. HTTP user mode uses the browser-based relay form at `/authorize` for phone, OTP, and 2FA. **Remote endpoint** -- an HTTP deployment is OAuth-gated and serves `/mcp`. Point any MCP client that speaks Streamable HTTP + OAuth 2.1 at `https://<your-host>/mcp`; each user completes the browser relay setup (bot token, or phone + OTP) on first connect. To run one, use the Docker HTTP method above or the [Cloudflare deploy](#deploy-to-cloudflare) below. Full setup matrices live at the canonical docs site [mcp.n24q02m.com/servers/better-telegram-mcp/setup/](https://mcp.n24q02m.com/servers/better-telegram-mcp/setup/), and the paste-to-agent snippets at [claude-plugins/plugins/better-telegram-mcp/setup-with-agent.md](https://github.com/n24q02m/claude-plugins/blob/main/plugins/better-telegram-mcp/setup-with-agent.md). ## Smithery Also listed on [Smithery](https://smithery.ai/servers/n24q02m/better-telegram-mcp). Per [`smithery.yaml`](smithery.yaml), Smithery starts the server over **stdio** with `uvx --python 3.13 better-telegram-mcp` and takes **no install-time configuration** (empty `configSchema`) -- credentials are provided at runtime through the server's own setup flow: the `TELEGRAM_BOT_TOKEN` env var or local `auth` command for stdio single-user mode, or the browser relay form for HTTP user mode (see [Configuration](#configuration)). ## Configuration Settings load from `TELEGRAM_`-prefixed environment variables (Pydantic Settings). **Stdio mode (local single-user):** | Variable | Required | Description | |:---------|:---------|:------------| | `TELEGRAM_BOT_TOKEN` | Yes | Bot token from [@BotFather](https://t.me/BotFather) (format `123456789:ABCdef...`) | **HTTP mode (bot + user):** credentials are entered via the browser relay form, not env vars. Server-side env vars for self-hosting: | Variable | Required | Default | Description | |:---------|:---------|:--------|:------------| | `MCP_TRANSPORT` | Yes | `stdio` | Set to `http` to enable HTTP mode (`--http` CLI flag or `TRANSPORT_MODE=http` also work) | | `PUBLIC_URL` | Self-host | -- | Public URL of the server; presence enables the multi-user OAuth branch | | `MCP_DCR_SERVER_SECRET` | Self-host | -- | Multi-user OAuth shared secret, 32+ random bytes (legacy `DCR_SERVER_SECRET` still accepted) | | `HOST` | No | `0.0.0.0` | Bind address | | `PORT` | No | `8080` | HTTP port | **User-mode credentials (optional overrides):** `TELEGRAM_API_ID` and `TELEGRAM_API_HASH` ship with built-in public dev defaults, so only `TELEGRAM_PHONE` is needed to start the phone + OTP flow. `TELEGRAM_SESSION_NAME` and `TELEGRAM_DATA_DIR` customize the Telethon session file location. There is no `TELEGRAM_PASSWORD` env var -- HTTP relay 2FA is entered through the web UI; local CLI auth prompts interactively and never stores it in the environment. ## CLI The `better-telegram-mcp` console script (installed by `uvx` / `pip`) **starts the server** when run with no subcommand, and exposes a few operator subcommands for local single-user setup and diagnostics. Any flag that is not a subcommand is passed straight through to the server (e.g. `--http`). ```bash better-telegram-mcp # start the MCP server (stdio, bot mode by default) better-telegram-mcp --http # start in HTTP mode better-telegram-mcp --version # print the version ``` **Subcommands** (`better-telegram-mcp <subcommand>`): | Subcommand | Usage | Description | |:-----------|:------|:------------| | `auth` | `auth --bot-token <token>` or `auth --phone <+number>` | Authenticate this machine (single-user). Bot mode validates the token; phone mode runs the interactive OTP/2FA flow and stores the Telethon session on disk | | `login` | Same arguments as `auth` | Deprecated alias of `auth` | | `logout` | `logout` | Revoke the Telegram session server-side, delete the local session file, and clear saved credentials | | `config` | `config status`, `config delete [--yes]` | Show or delete the saved local credential config (env overrides still take precedence at server start) | | `relay` | `relay status`, `relay open`, `relay reset` | Inspect, open (print a fresh setup URL for), or reset the browser relay setup session | | `doctor` | `doctor` | Print environment diagnostics -- Python version, credential backend, config + relay state, and transport mode | ```bash # Bot mode: validate a bot token and save it to the local config better-telegram-mcp auth --bot-token 123456:ABC-DEF # User mode: interactive phone + OTP (+ 2FA if enabled) sign-in better-telegram-mcp auth --phone +15551234567 # Remove local credentials and revoke the session better-telegram-mcp logout ``` The `auth` command, its deprecated `login` alias, and `logout` are single-user and local-machine only -- they write the on-disk Telethon session and the encrypted single-user config, so run them on the machine that hosts the stdio server. For remote / multi-user HTTP deployments, credentials are entered through the browser relay form instead (see the [remote endpoint](#install) and [Configuration](#configuration)). ## Documentation Full docs at **[mcp.n24q02m.com/servers/better-telegram-mcp/setup/](https://mcp.n24q02m.com/servers/better-telegram-mcp/setup/)**: - [Setup](https://mcp.n24q02m.com/servers/better-telegram-mcp/setup/) -- install methods for Claude Code, Codex, Gemini CLI, Cursor, Windsurf, mcp.json - [Modes overview](https://mcp.n24q02m.com/get-started/modes-overview/) -- stdio (local, single-user) and HTTP (remote, OAuth 2.1) - [Multi-user setup](https://mcp.n24q02m.com/get-started/multi-user/) -- per-JWT-sub credential model **Install with AI agent** -- paste this to your AI coding agent: > Install MCP server `better-telegram-mcp` following the steps at > https://raw.githubusercontent.com/n24q02m/claude-plugins/main/plugins/better-telegram-mcp/setup-with-agent.md ## Tools | Tool | Actions | Description | |:-----|:--------|:------------| | `message` | `send`, `edit`, `delete`, `forward`, `pin`, `react`, `search`, `history` | Send, edit, delete, forward messages. Pin, react, search, browse history | | `chat` | `list`, `info`, `create`, `join`, `leave`, `members`, `admin`, `settings`, `topics` | List and manage chats, groups, channels. Members, admin, forum topics | | `media` | `send_photo`, `send_file`, `send_voice`, `send_video`, `download` | Send photos, files, voice notes, videos. Download media from messages | | `contact` | `list`, `search`, `add`, `block` | List, search, add contacts. Block/unblock users (user mode only) | | `config` | `status`, `set`, `cache_clear`, `setup_status`, `setup_start`, `setup_reset`, `setup_complete` | Server status, runtime settings, cache, credential setup (relay, status, reset, complete) | | `help` | -- | Full documentation for any topic | | `config__open_relay` | -- | Re-trigger the zero-config relay setup flow (prints a fresh relay URL for the browser form). Registered via `mcp-core`'s `register_open_relay_tool` so an LLM can restart setup without a manual restart | ### MCP Resources | URI | Content | |:----|:--------| | `telegram://docs/messages` | Message operations reference | | `telegram://docs/chats` | Chat management reference | | `telegram://docs/media` | Media send/download reference | | `telegram://docs/contacts` | Contact management reference | | `telegram://stats` | All documentation combined | ## Comparison How better-telegram-mcp stacks up against direct competitors in each pillar: | Capability | better-telegram-mcp | chigwell/telegram-mcp | sparfenyuk/mcp-telegram | guangxiangdebizi/telegram-mcp | |---|---|---|---|---| | Bot API mode (bot token) | Yes (httpx) | No | No | Yes | | MTProto user-account mode | Yes (Telethon) | Yes | Yes | No | | Send / edit / delete messages | Yes | Yes | No (read-only, draft only) | Yes (send only) | | Media download from messages | Yes | Yes | Yes | No (send only) | | Contact management (add / block) | Yes (user mode) | Yes | Partial (list only) | No | | Web-based / browser OTP auth | Yes (relay form, headless) | No (CLI session string) | No (CLI sign-in) | No (pre-set bot token) | | Multi-user remote, per-user isolation | Yes (per-JWT-sub backends) | No | No | No | | SSRF protection | Yes (URL validation + DNS-rebinding) | ? | ? | No | | Path-traversal prevention | Yes | Yes (real-path allowed-root) | ? | No | | Self-hostable | Yes | Yes | Yes | Yes | ## Security - **SSRF Protection** -- All URLs validated against internal/private IP ranges, DNS rebinding blocked - **Path Traversal Prevention** -- File paths validated, sensitive directories blocked - **Session File Security** -- 600 permissions, 2FA via web UI only (never stored in env vars) - **Error Sanitization** -- Credentials never leaked in error messages ## Build from Source ```bash git clone https://github.com/n24q02m/better-telegram-mcp.git cd better-telegram-mcp uv sync uv run better-telegram-mcp ``` ## Deploy to Cloudflare [](https://deploy.workers.cloudflare.com/?url=https://github.com/n24q02m/better-telegram-mcp) Run your own multi-user better-telegram-mcp serverless on Cloudflare (Worker + Container + KV). **Prerequisites:** a Cloudflare account on the **Workers Paid plan** -- required for Containers (the Cloudflare free tier does not include Containers) -- and the `wrangler` CLI. 1. `git clone https://github.com/n24q02m/better-telegram-mcp && cd better-telegram-mcp` 2. `wrangler login` 3. Provision the KV namespace and paste its id into `wrangler.jsonc`: ``` wrangler kv namespace create better-telegram-kv ``` 4. Push the container image to your Cloudflare managed registry (CF Containers cannot pull from external registries directly), then set `<YOUR_ACCOUNT_ID>` in `wrangler.jsonc`: ``` docker pull ghcr.io/n24q02m/better-telegram-mcp:beta docker tag ghcr.io/n24q02m/better-telegram-mcp:beta better-telegram-mcp:beta wrangler containers push better-telegram-mcp:beta # prints registry.cloudflare.com/<ACCOUNT_ID>/better-telegram-mcp:beta ``` 5. Set `<YOUR_PUBLIC_URL>` (e.g. `https://telegram.example.com`) and `<YOUR_WORKER_DOMAIN>` (e.g. `telegram.example.com`) in `wrangler.jsonc`, then set secrets: ``` wrangler secret put CREDENTIAL_SECRET wrangler secret put MCP_RELAY_PASSWORD wrangler secret put MCP_DCR_SERVER_SECRET ``` `CREDENTIAL_SECRET` is REQUIRED: it derives a deterministic OAuth signing key so user identity survives container recreation. `MCP_RELAY_PASSWORD` gates the browser setup form (Gate A shared front door); `MCP_DCR_SERVER_SECRET` (32+ random bytes) marks the deploy as intentionally multi-user. 6. `wrangler deploy`, then complete setup in the browser relay form at your Worker domain -- each user enters their own bot token or phone + OTP there, so no per-user Telegram credentials live on the Worker. Storage maps to Cloudflare via `MCP_STORAGE_BACKEND=cf-kv` (the encrypted setup config). Do NOT set `MCP_AUTH_DISABLE` on a shared/public deployment -- it collapses all users into a single credential bucket. ## Trust Model This plugin implements **TC-NearZK** (in-memory, ephemeral). See [mcp-core trust model](https://mcp.n24q02m.com/servers/mcp-core/trust-model/) for full classification. The project no longer operates an n24q02m-hosted Telegram endpoint. HTTP mode is available only on infrastructure an operator deploys and controls. | Mode | Storage | Encryption | Who can read your data? | |---|---|---|---| | HTTP self-host (opt-in) | In-memory `dict[sub] = MTProtoSession` | In-process only | Operator-controlled server process (cleared on restart) | | stdio | `~/.config/mcp/config.enc` (credentials) + `~/.better-telegram-mcp/<name>.session` (Telethon session) | AES-GCM, machine-bound key | Only your OS user (file perm 0600) | ### Workspace username (HTTP setup form) The browser setup form has an optional **workspace username** field. Entering the same username always lands you in the same per-`sub` bucket, so your session stays reachable across a re-authorization and across devices, instead of being tied to the one-off subject minted for each `/authorize` round-trip. Leaving it blank keeps the previous per-authorize behaviour. Trust boundary: when the form is gated by a *shared* `MCP_RELAY_PASSWORD`, the username is a partition key, not a secret -- anyone who knows that password can type any username and reach that bucket. That is fine for a trusted group; an untrusted multi-tenant deployment needs a per-user secret or delegated OAuth instead. **One-time migration:** existing users must re-authenticate once after this change. Nothing is deleted; sessions stored under the old random subject are simply no longer addressed. ## License Apache-2.0 -- See [LICENSE](LICENSE).