This release includes 6 security fixes for security teams reviewing exposed deployments.
Topics
+4 more
Affected surfaces
Summary
AI summaryAdded 15 new Telegram client‑parity tools covering messaging, drafts, admin actions, and safety hardening.
Full changelog
GramJS Coverage Phase 1 — 15 new tools
Expands MCP coverage toward parity with a regular Telegram client. Focus: messaging, dialogs, drafts, admin tools, reactions, search and media.
Added
Messaging & threads
telegram-get-scheduled— list scheduled messages in a chattelegram-delete-scheduled— delete scheduled messages (capped 1–100)telegram-get-replies— read comments under a channel post or discussion threadtelegram-get-message-link— public t.me URL for a messagetelegram-get-unread-mentions— fetch unread @mentions (marks them read)telegram-get-unread-reactions— fetch unread reactions (marks them read)telegram-translate-message— translate messages (requires Telegram Premium)telegram-send-typing— typing / uploading indicator with 10s per-chat throttle
Dialogs & drafts
telegram-archive-chat— move chat to archive or backtelegram-pin-chat— pin/unpin a dialogtelegram-mark-dialog-unread— mark dialog as unreadtelegram-save-draft— save or clear a draft (clearing drops replyTo to avoid MESSAGE_EMPTY)telegram-get-drafts— list all drafts across chatstelegram-clear-drafts— clear draft(s); requireschatIdORconfirmAllChats: trueto wipe account-widetelegram-get-saved-dialogs— new per-peer Saved Messages folders
Admin / channels / groups
telegram-get-admin-log— channel/supergroup moderation history with user and action detailstelegram-set-chat-permissions— default banned rights (merges with current to keep omitted flags)telegram-set-slow-mode— slow mode seconds for supergroupstelegram-create-topic/telegram-edit-topic/telegram-delete-topic— forum topics CRUD
Reactions & media
telegram-set-default-reaction— set account-wide default reaction emojitelegram-get-top-reactions/telegram-get-recent-reactions— reaction discoverytelegram-get-web-preview— link preview (http(s) only; no SSRF)
Safety hardening during review
telegram-clear-draftsnow requireschatIdor explicitconfirmAllChats: trueto prevent accidental account-wide draft wipe.telegram-get-unread-mentions/telegram-get-unread-reactionsreclassified asWRITE— calling them marks items read on the server.telegram-translate-messagereclassified asWRITE(consumes Premium quota);toLangvalidated against ISO 639-1 / locale pattern.- Array inputs capped at 1–100 positive integers in
translate-messageanddelete-scheduled. telegram-get-web-previewrejects non-http(s)URLs, preventing use as an SSRF proxy.telegram-set-chat-permissionsmerges with the chat's currentdefaultBannedRights— omitted flags keep their current state instead of being silently cleared.telegram-create-topicreads the new topic ID fromUpdateNewChannelMessage(authoritative) and fails loudly if unavailable.
Infrastructure
- All new service methods go through
rateLimiter.execute()for FLOOD_WAIT handling. - All text outputs sanitize unpaired UTF-16 surrogates before JSON serialization.
- 3 new unit test files (admin-log, reactions, set-chat-permissions merge).
Install
npm install -g @overpod/[email protected]
or via npx @overpod/mcp-telegram for zero-install.
Security Fixes
- `telegram-clear-drafts` now requires explicit confirmation to prevent accidental account‑wide draft wipe.
- `telegram-get-unread-mentions` and `telegram-get-unread-reactions` reclassified as WRITE actions, marking items read on the server.
- `telegram-translate-message` reclassified as WRITE (consumes Premium quota) with validated `toLang` values.
- Array inputs capped at 1–100 positive integers in `translate-message` and `delete-scheduled` to prevent abuse.
- `telegram-get-web-preview` rejects non‑http(s) URLs, preventing SSRF use.
- `telegram-set-chat-permissions` now merges with existing `defaultBannedRights` instead of silently clearing omitted flags.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About overpod/mcp-telegram
Telegram MCP server via MTProto/GramJS — 20 tools for reading chats, searching messages, downloading media, managing contacts. QR code login, npx zero-install. Hosted version at mcp-telegram.com.
Related context
Beta — feedback welcome: [email protected]