Better Telegram MCP

It requires TELEGRAM_BOT_TOKEN, TELEGRAM_API_ID, and TELEGRAM_API_HASH, all of which are sensitive credentials that can enable direct Telegram bot/account access. If exposed, they could be abused for reading or sending messages or using account APIs; the materials do not describe credential storage or least-privilege handling.

Although no custom remote host is listed, its stated function as a Telegram MCP server using Bot API + MTProto implies outbound communication to Telegram services and transmission of message-related data/metadata. The provided materials do not show evidence of exfiltration to unrelated third-party endpoints.

The system flags it as executes-code, meaning it runs an MCP service/process locally; this is a normal capability for this class of tool. The available materials do not indicate unusual system privileges or clearly unrelated high-risk operations.

Given its dual Telegram modes, it can reasonably be expected to access messages, chats, and related metadata visible to the bot or Telegram account. The materials do not specify local file read/write scope, and no excessive permissions beyond stated functionality are evident, but the data surface is inherently sensitive.

Positive signals include an official registry source, an auditable open-source repository, and updates within the last year. Points of caution are the missing README, unspecified license, and very low community adoption (0 stars), which limit auditability and long-term maintenance signals, though not enough on their own to rate it as high risk.