registry / @deadragdoll/tellymcp / 0.0.16

@deadragdoll/tellymcp@0.0.16

TellyMCP - Telegram control plane for MCP-connected coding agents

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 202 file(s), 1.85 MB of source, external domains: 127.0.0.1, api.telegram.org, builder.undoo.ru, chatgpt.com, claude.ai, gateway.local, github.com, registry.npmjs.org, standalone.local, telegram.org, telly.example.com, your-host.example

Source & flagged code

9 flagged

package.jsonView file

Lines 21-61json

21 "VERSION.md",

22 "CHANGELOG.md",

23 "TOOLS.md",

24 ".env.example.client",

25 ".env.example.gateway"

26 ],

27 "publishConfig": {

28 "access"

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

.env.example.gatewayView file

58patternName = private_key_rsa severity = critical line = 58 matchedText = # TELLYM...-\n"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.example.gatewayView on unpkg · L58

58patternName = private_key_rsa severity = critical line = 58 matchedText = # TELLYM...-\n"

Critical

Secret Pattern

RSA private key in .env.example.gateway

.env.example.gatewayView on unpkg · L58

dist/index.jsView file

16Object.defineProperty(exports, "__esModule", { value: true }); L17: __exportStar(require("./lib/moleculer"), exports);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L16

dist/services/features/telegram-mcp/src/shared/integrations/terminal/ptyRegistry.jsView file

69const parts = ["[pty exited"]; L70: if (typeof record.exitCode === "number") { L71: parts.push(`code=${record.exitCode}`); ... L89: return { L90: ...process.env, L91: TELLYMCP_TERMINAL_CONTEXT: "1", ... L98: const tempDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "tellymcp-pty-bash-")); L99: const rcPath = node_path_1.default.join(tempDir, `${sanitizeFileNameSegment(record.sessionId)}.bashrc`); L100: const promptPrefix = buildContextPromptPrefix(record); ... L178: const target = input.target?.trim() || buildPtyTarget(input.sessionId); L179: const cwd = input.cwd?.trim() || process.cwd(); L180: const terminal = createHeadlessTerminal(config);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/services/features/telegram-mcp/src/shared/integrations/terminal/ptyRegistry.jsView on unpkg · L69

scripts/build-package-artifact.shView file

•path = scripts/build-package-artifact.sh kind = build_helper sizeBytes = 648 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/build-package-artifact.shView on unpkg

dist/services/features/telegram-mcp/src/shared/integrations/telegram/proxyFetch.jsView file

14patternName = generic_password severity = medium line = 14 matchedText = url.pass...D]";

Medium

Secret Pattern

Hardcoded password in dist/services/features/telegram-mcp/src/shared/integrations/telegram/proxyFetch.js

dist/services/features/telegram-mcp/src/shared/integrations/telegram/proxyFetch.jsView on unpkg · L14

docs/CHAT_CONNECTOR.mdView file

17patternName = private_key_rsa severity = critical line = 17 matchedText = TELLYMCP...-\n"

Critical

Secret Pattern

RSA private key in docs/CHAT_CONNECTOR.md

docs/CHAT_CONNECTOR.mdView on unpkg · L17

Findings

3 Critical1 High8 Medium5 Low

CriticalCritical Secret.env.example.gateway

CriticalSecret Pattern.env.example.gateway

CriticalSecret Patterndocs/CHAT_CONNECTOR.md

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/index.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/services/features/telegram-mcp/src/shared/integrations/terminal/ptyRegistry.js

MediumShips Build Helperscripts/build-package-artifact.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/services/features/telegram-mcp/src/shared/integrations/telegram/proxyFetch.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

.env.example.gatewayView file

Lines 38-78text

38# TELEGRAM_WEBHOOK_PATH=/telegram/webhook

39# TELEGRAM_WEBHOOK_PUBLIC_URL=https://your-domain.example/api/telegram/webhook

40# TELEGRAM_WEBHOOK_SECRET=change_me_webhook_secret

41# TELEGRAM_WEBHOOK_TRACE=false

42# TELEGRAM_WEBHOOK_DROP_PENDING_UPDATES=false

44# Optional static bearer auth for internal MCP clients.

45# MCP_HTTP_BEARER_TOKEN=

46MCP_HTTP_ENABLE_DEBUG_ROUTES=false

47MCP_HTTP_ENABLE_PRUNE_ROUTE=false

49# ChatGPT / Claude OAuth facade. Setting any OAuth value enables it.

50# TELLYMCP_PUBLIC_URL=https://your-domain.example/api

51# TELLYMCP_OAUTH_ISSUER=https://your-domain.example/api

52# TELLYMCP_OAUTH_AUDIENCE=https://your-domain.example/api

53# TELLYMCP_MAGIC_TOKEN=change_me_private_connector_token

54# TELLYMCP_MAGIC_TOKEN_HASH=sha256:<hex>

55# TELLYMCP_OAUTH_CLIENT_ID=tellymcp

56# TELLYMCP_OAUTH_CLIENT_SECRET=

57# TELLYMCP_ALLOWED_REDIRECT_URIS=https://chatgpt.com/connector/oauth/...,https://claude.ai/api/mcp/auth_callback

58# TELLYMCP_OAUTH_PRIVATE_KEY_PEM="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.env.example.gatewayView on unpkg · L58

Critical

Secret Pattern

RSA private key in .env.example.gateway

.env.example.gatewayView on unpkg · L58

59# TELLYMCP_AUTH_CODE_TTL_SECONDS=300

60# TELLYMCP_OAUTH_SCOPES=tellymcp:read tellymcp:write

61# TELLYMCP_OAUTH_KEY_ID=tellymcp-oauth

63# Optional RabbitMQ fanout.

64# RMQ_HOST=127.0.0.1

65# RMQ_PORT=5672

66# RMQ_USER=

67# RMQ_PASSWORD=

68# RMQ_VHOST=/

69# RMQ_EXCHANGE=telegram_mcp.gateway

71# Telegram Mini App.

72WEBAPP_ENABLED=true

73WEBAPP_BASE_PATH=/webapp

74WEBAPP_PUBLIC_URL=https://your-domain.example/api/webapp

75WEBAPP_INITDATA_TTL_SECONDS=300

76WEBAPP_SESSION_TTL_SECONDS=900

77WEBAPP_LAUNCH_MODE=fullscreen

78WEBAPP_VISIBLE_SCREENS=2

dist/services/features/telegram-mcp/src/shared/integrations/terminal/ptyRegistry.jsView file

Lines 49-89javascript

49exports.renderVisiblePtyHtml = renderVisiblePtyHtml;

50exports.renderVisiblePtyAnsi = renderVisiblePtyAnsi;

51exports.sendPtyAction = sendPtyAction;

52exports.sendPtyText = sendPtyText;

53exports.resizePtyTarget = resizePtyTarget;

54exports.subscribePtyTarget = subscribePtyTarget;

55exports.stopPtyTarget = stopPtyTarget;

56exports.stopAllPtyTargets = stopAllPtyTargets;

57const node_fs_1 = __importDefault(require("node:fs"));

58const node_os_1 = __importDefault(require("node:os"));

59const node_path_1 = __importDefault(require("node:path"));

60const node_pty_1 = require("node-pty");

61const XtermHeadless = __importStar(require("@xterm/headless"));

62const PTY_TARGET_PREFIX = "pty:";

63const sessions = new Map();

64function getShellDisplayName(shell) {

65 const baseName = node_path_1.default.basename(shell.trim());

66 return baseName || shell.trim() || "bash";

67}

68function buildExitLine(record) {

69 const parts = ["[pty exited"];

70 if (typeof record.exitCode === "number") {

71 parts.push(`code=${record.exitCode}`);

72 }

73 if (typeof record.signal === "number") {

74 parts.push(`signal=${record.signal}`);

75 }

76 return `${parts.join(" ")}]`;

77}

78function sanitizeFileNameSegment(value) {

79 const sanitized = value.trim().replace(/[^a-zA-Z0-9._-]+/gu, "-");

80 return sanitized || "session";

81}

82function shellSingleQuote(value) {

83 return `'${value.replace(/'/gu, `'\\''`)}'`;

84}

85function buildContextPromptPrefix(record) {

86 return `[TELLY ${record.sessionId}]`;

87}

88function buildContextEnv(record) {

89 return {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/services/features/telegram-mcp/src/shared/integrations/terminal/ptyRegistry.jsView on unpkg · L69

dist/services/features/telegram-mcp/src/shared/integrations/telegram/proxyFetch.jsView file

Lines 1-34javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.createTelegramBaseFetchConfig = createTelegramBaseFetchConfig;

4exports.createTelegramFetch = createTelegramFetch;

5const https_proxy_agent_1 = require("https-proxy-agent");

6const socks_proxy_agent_1 = require("socks-proxy-agent");

7function maskProxyUrl(rawUrl) {

8 try {

9 const url = new URL(rawUrl);

10 if (url.username) {

11 url.username = "[REDACTED]";

12 }

13 if (url.password) {

14 url.password = "[REDACTED]";

Medium

Secret Pattern

Hardcoded password in dist/services/features/telegram-mcp/src/shared/integrations/telegram/proxyFetch.js

dist/services/features/telegram-mcp/src/shared/integrations/telegram/proxyFetch.jsView on unpkg · L14

15 }

16 return url.toString();

17 }

18 catch {

19 return "[INVALID_PROXY_URL]";

20 }

21}

22function createTelegramBaseFetchConfig(config, logger) {

23 const agent = config.telegram.proxy

24 ? config.telegram.proxy.type === "http"

25 ? new https_proxy_agent_1.HttpsProxyAgent(config.telegram.proxy.url)

26 : new socks_proxy_agent_1.SocksProxyAgent(config.telegram.proxy.url)

27 : undefined;

28 if (config.telegram.proxy) {

29 logger.info("Telegram proxy configured", {

30 proxyType: config.telegram.proxy.type,

31 proxyUrl: maskProxyUrl(config.telegram.proxy.url),

32 });

33 }

34 else {

docs/CHAT_CONNECTOR.mdView file

Lines 1-37markdown

1# ChatGPT and Claude connector

3TellyMCP can expose its Streamable HTTP MCP endpoint to ChatGPT and Claude

4through an OAuth 2.0 authorization-code facade with PKCE. The facade coexists

5with `MCP_HTTP_BEARER_TOKEN`; existing internal clients can continue to use the

6static bearer token.

8## Configure the gateway

10Add the following to the gateway environment file:

12```bash

13TELLYMCP_PUBLIC_URL=https://mcp.example.com/api

14TELLYMCP_OAUTH_ISSUER=https://mcp.example.com/api

15TELLYMCP_OAUTH_AUDIENCE=https://mcp.example.com/api

16TELLYMCP_MAGIC_TOKEN=replace_with_a_private_human_login_token

17TELLYMCP_OAUTH_PRIVATE_KEY_PEM="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"

Critical

Secret Pattern

RSA private key in docs/CHAT_CONNECTOR.md

docs/CHAT_CONNECTOR.mdView on unpkg · L17

18```

20Generate the stable signing key with:

22```bash

23tellymcp oauth key

24```

26The command prints a dotenv-ready `TELLYMCP_OAUTH_PRIVATE_KEY_PEM` assignment.

27If the private key is omitted, TellyMCP generates an ephemeral key and existing

28OAuth access tokens stop working after a restart.

30For a hashed magic token, configure

31`TELLYMCP_MAGIC_TOKEN_HASH=sha256:<64-hex-digest>` instead of the raw token.

32Never configure both forms.

34Optional restrictions:

36```bash

37TELLYMCP_OAUTH_CLIENT_ID=tellymcp