Is Tgfmcp safe to use?

Tgfmcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.

How do I install Tgfmcp?

Tgfmcp can be installed by cloning its GitHub repository and following the setup instructions in the README.

What AI clients work with Tgfmcp?

Tgfmcp is compatible with Claude Desktop, Cursor, Claude Code, and most MCP clients that support stdio transport. It uses stdio transport.

Is Tgfmcp actively maintained?

Tgfmcp is actively maintained — last commit was 1 day ago. It has 1 GitHub stars.

Tgfmcp

tgfmcp is an open-source Telegram stdio MCP server built on top of telegraf, commander, and @modelcontextprotocol/sdk.

ActiveNot tested

Other

★ 1GitHub

31DNo CVEsactiveMIT

Quick Install

{
  "mcpServers": {
    "tgfmcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Setup guide

No install config available. Check the server's README for setup instructions.

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/tgfmcp)](https://mcppedia.org/s/tgfmcp)

Should you use this server?

tgfmcp is an open-source Telegram stdio MCP server built on top of telegraf, commander, and @modelcontextprotocol/sdk.

✓

Is it safe?

No package registry to scan.

No authentication — any process on your machine can connect.

MIT. View license →

✓

Is it maintained?

Last commit 1 days ago. 1 stars.

Will it work with my client?

Transport: stdio. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.

Loading README…

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Score Breakdown

MCPpedia Score

Click each category to see evidence

31D

Last scored 14h ago

How we score →

Security

5/30

No known vulnerabilities.

○

Known CVEs — No package registry to scan

○

Tool safety — No tools to analyze

○

Tool poisoning — No tools to analyze

○

Injection vectors — No tools to analyze

○

Tool stability — First scan — baseline recorded

○

Dependency health — No package to analyze

✓

License — License: MIT

○

Authentication — No authentication required

○

Repository — active repo

CVEs checked daily via OSV.dev. Score algorithm is open source.

Reviews

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Tgfmcp safe to use?: Tgfmcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Tgfmcp?: Tgfmcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with Tgfmcp?: Tgfmcp is compatible with Claude Desktop, Cursor, Claude Code, and most MCP clients that support stdio transport. It uses stdio transport.
Is Tgfmcp actively maintained?: Tgfmcp is actively maintained — last commit was 1 day ago. It has 1 GitHub stars.

Similar servers

View all →

Memory MCP Server

OfficialNo CVEs98A

Persistent memory using a knowledge graph

5 toolsstdio84.0k81.6k/wk3d ago

Context Mode

No CVEs95A

Privacy-first. MCP is the protocol for tool access. We're the virtualization layer for context.

6 toolsremote7.4k10.0k/wk3d ago

Idea Reality MCP Server

No CVEs95A

Pre-build reality check. Scans GitHub, HN, npm, PyPI, Product Hunt — returns 0-100 signal.

1 toolsremote60643.6k/wk3d ago

Hash-verified file editing MCP server with token efficiency hook. 11 tools for AI coding agents.

No CVEs95A

Hash-verified file editing MCP server with token efficiency hook. 11 tools for AI coding agents.

5 toolsremote405698.1k/wk1d ago

MCP Security Weekly

Get CVE alerts and security updates for Tgfmcp and similar servers.

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

tgfmcp

tgfmcp is an open-source Telegram stdio MCP server built on top of telegraf, commander, and @modelcontextprotocol/sdk.

It lets MCP-compatible clients interact with the Telegram Bot API through Telegraf and optionally subscribe to incoming Telegram events through an MCP notification channel.

Highlights

Exposes Telegram as an MCP server over stdio.
Uses telegraf directly for polling and Bot API operations.
Connects using TELEGRAM_BOT_TOKEN from the environment.
Provides direct Bot API tools for bot identity and chat lookups.
Includes mutating tools for sending, replying, reacting, editing, deleting, forwarding, and typing.
Can emit incoming message events over an optional MCP notification channel.
Stores downloaded incoming media attachments under ~/.tgfmcp/attachments/.

Requirements

Node.js 24+
A Telegram bot token exported as TELEGRAM_BOT_TOKEN

Installation

Use it without installing globally:

npx tgfmcp mcp

Or with Bun:

bunx tgfmcp mcp

If you prefer a global install:

npm install -g tgfmcp

For local development:

npm install
npm run build
npm run dev -- mcp

Quick Start

Export your Telegram bot token:

export TELEGRAM_BOT_TOKEN="123456:telegram-bot-token"

Start the MCP server:

npx tgfmcp mcp

If your MCP host supports notifications and you want incoming Telegram events, provide a channel name:

npx tgfmcp mcp --channel claude/channel

The server uses stdio, so it is meant to be launched by an MCP client or wrapper rather than browsed directly in a terminal.

CLI Usage

MCP Server

npx tgfmcp mcp
bunx tgfmcp mcp

Starts the stdio MCP server for the configured Telegram bot.

MCP Tools

The server currently exposes these tools:

telegram_get_me
telegram_get_status
telegram_get_chat
telegram_get_chat_administrators
telegram_lookup_chat
telegram_send_message
telegram_send_media_from_base64
telegram_send_media_from_path
telegram_reply_to_message
telegram_react_to_message
telegram_edit_message
telegram_delete_message
telegram_forward_message
telegram_send_typing

Push Channel

When started with --channel <name>, the server:

advertises the experimental MCP capability <name>
emits notifications/<name> for incoming Telegram message events

The event payload includes:

source
self
message
text

If an incoming message contains downloadable media, the file is downloaded and included as a local attachment path in the event payload. Files are stored under ~/.tgfmcp/attachments/.

Local Data

tgfmcp stores local state under ~/.tgfmcp/:

attachments/ for downloaded incoming media attachments

Notes

Telegram bots cannot access arbitrary private chats; they can only interact where the bot has been added, contacted, or is otherwise permitted.
Message mutation tools that target an existing message require explicit chatId and messageId inputs.
The CLI intentionally exposes only tgfmcp mcp.

License

MIT. See LICENSE.