Tell your AI what to do in Telegram.

  • “What did I miss in my work chats?”
  • “Find the restaurant in Tbilisi someone recommended me.”
  • “Book a table for four on Friday.”

Unofficial. Made by Kirill Bobykin, an independent developer; not affiliated with Telegram. Developers: Claude Code, Cursor, self-host.

You stay in control.

Not “it's safe”, but exactly what tg-mcp can't do with your account.

You worry What actually happens Why that's true
“It will send something as me.” Out of the box it only reads. Writing stays off until you allow it when you sign in, only for the chats you pick, and every message waits for your OK, or becomes a draft you send yourself. You choose permissions on the sign-in screen. Tools you didn't allow aren't even visible to the AI.
“The developer will read my chats.” Your messages aren't stored anywhere. Your Telegram session is locked with a key the developer doesn't have. The key lives only in the sign-in tokens your AI app holds. The server keeps the session encrypted and can't open it on its own.
“Someone will steal my password or my account.” You type your password on tg-mcp's own sign-in page, and the AI never sees it. A stolen database has nothing readable in it. The QR login and the cloud password happen outside the AI app. The session in the database is encrypted.
“I won't be able to turn it off.” One tap: Telegram → Settings → Devices → end the “Unofficial MCP Server” session. That logs the server out for real. Your AI gets an error on its next request.

Read the privacy policy

Don't trust. Verify.

Encryption protects what's stored. While your AI reads a chat, the messages pass through the server's memory, so whoever runs the server could, in theory, see them. And whatever you ask goes to your AI provider: OpenAI, Anthropic or Google.

Don't want to trust even me? Run your own copy.

  • Open source, MIT.Free, forever. The code is yours to read, fork and run.github.com/qelphybox/tg-mcp
  • One command to self-host.Ready images for amd64 and arm64, built from every release tag. Nothing to compile.
  • Deployed in public.The public instance deploys from the public main branch through GitHub Actions, with open build logs. No one can prove what a server runs; self-hosting is the answer to that.See the deploys
docker run -d --name tg-mcp --restart unless-stopped \
  -p 127.0.0.1:8080:8080 -v tg-mcp-data:/data \
  -e TG_MCP_PUBLIC_URL=https://tg.example.com \
  -e TG_MCP_DB_PATH=/data/tg-mcp.db \
  -e TG_MCP_API_ID=123456 -e TG_MCP_API_HASH=your_api_hash \
  ghcr.io/qelphybox/tg-mcp:latest

You need HTTPS on a public hostname and your own app id from my.telegram.org. Full guide

Questions.

Can Telegram block my account for this?

It uses Telegram's official API through its own registered app, stays within Telegram's rate limits, and when Telegram asks it to wait, it waits instead of retrying around the limit. We can't speak for Telegram, so nobody can honestly promise that nothing will ever happen.

Who makes this?

I do: Kirill Bobykin, an independent developer, @qelphybox on GitHub. tg-mcp is unofficial and not affiliated with Telegram, OpenAI, Anthropic or Google. All the code is public, and issues go straight to me.

What does my AI provider see?

The messages the AI reads to answer your question, the same as if you had pasted them into the chat yourself.

I removed it from my AI app. Is it disconnected?

Not always. Some apps only forget their keys, and the Telegram session stays. To be sure, end it in Telegram → Settings → Devices → Unofficial MCP Server.