telegram-mcp

The server handles Telegram API credentials and a session string, which are critical secrets. It correctly uses environment variables for these. The core functionality involves calling the Telegram API's search endpoint with user-provided queries. While no direct 'eval' or arbitrary command injection vulnerabilities are immediately apparent from user input within the provided source code, the reliance on third-party libraries (`telegram`, `chrono-node`) introduces external dependencies whose security is paramount. The `includeExtendedMetadata` option triggers additional API calls (e.g., for reply context, sender info per message), potentially increasing the attack surface or leading to rate-limiting issues if abused. Overall, the approach to secrets management and tool invocation appears standard and reasonably secure.