github TypeScript analyzed c11319e

code4bones/tellymcp

github

Inter-session/machine pty collaboration control pane over telegram bot & webapp

maintainer: code4bones
license: MIT
first seen: 2026-06-06
last seen: 2026-07-16
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 41 tools

transport stdio · streamable-http · http counts 41 tools · 0 res · 0 prompts permission surface via code analysis

tools

ask_user_telegram
browser_attach_active_tab
browser_attach_tab
browser_clear_logs
browser_click
browser_close
browser_computed_style
browser_console
browser_detach_tab
browser_dom
browser_errors
browser_fill
browser_inject_script
browser_list_attached_instances
browser_list_tabs
browser_network_failures
browser_open
browser_press
browser_recording_start
browser_recording_status
browser_recording_stop
browser_reload
browser_screenshot
browser_wait_for
browser_wait_for_url
clear_session_context
get_file
get_file_list
get_runtime_diagnostics
get_session_context
get_xchange_record
list_gateway_sessions
list_xchange_records
mark_xchange_record_read
notify_telegram
refresh_tools_markdown
rename_session
send_file_to_telegram
send_partner_file
send_partner_note
set_session_context

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit c11319e · analyzer v33 · 4d ago

skills & prompt files 5

danger signals4

dynamic code execution indirect eval code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/app/webapp/assets.ts :1301 (0, eval)(source);
dynamic code execution vm exec code4bones-tellymcp-c11319e/tests/chromeExtensionActions.test.ts :27 vm.runInNewContext(`${declaration}\nthis.extracted = ${name};`, context);
suspicious endpoint api.telegram.org expected for this server's purpose code4bones-tellymcp-c11319e/src/configureServer.ts :706 const response = await fetch(`https://api.telegram.org/bot${token}/getMe`, {
suspicious endpoint api.telegram.org expected for this server's purpose code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/integrations/telegram/transportAttachmentStore.ts :137 const fileUrl = `https://api.telegram.org/file/bot${this.host.getRequiredBotToken(

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 247

filesystem 26

fs (weak) code4bones-tellymcp-c11319e/packages/chrome-attach-extension/scripts/build.mjs :1 import { cpSync, existsSync, mkdirSync, rmSync } from "node:fs";
fs (weak) code4bones-tellymcp-c11319e/packages/firefox-attach-extension/scripts/build.mjs :1 import { cpSync, existsSync, mkdirSync, rmSync } from "node:fs";
fs code4bones-tellymcp-c11319e/src/cli.ts :10 } from "node:fs";
fs code4bones-tellymcp-c11319e/src/codexPluginInstaller.ts :8 } from "node:fs";
fs code4bones-tellymcp-c11319e/src/lib/capabilities.ts :1 import fs from "fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/gateway-socket.service.ts :2 import { existsSync, readFileSync } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/app/config/env.ts :1 import { existsSync } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/app/webapp/assets.ts :1 import { readFileSync } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser-attach/model/browserRecordingBundle.ts :1 import { mkdir } from "node:fs/promises";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserService.ts :1 import { readFile, stat } from "node:fs/promises";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/distributed-gateway/model/gatewayHttpService.ts :2 import { readFileSync } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/embedded-runtime/model/embeddedRuntimeBroker.ts :1 import { readdirSync, statSync } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/file-content/model/getFileService.ts :1 import { createReadStream } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/file-content/model/temporaryFileLinkStore.ts :2 import { createReadStream, createWriteStream } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/tools-sync/model/refreshToolsMarkdownService.ts :2 import { readFileSync } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/integrations/object-storage/minioExchangeStore.ts :2 import { access } from "node:fs/promises";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/integrations/telegram/transport.ts :2 import { readFile, stat } from "node:fs/promises";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/integrations/telegram/transportMenuState.ts :2 import { readFileSync } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/integrations/terminal/client.ts :11 } from "node:fs/promises";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/integrations/terminal/ptyRegistry.ts :1 import fs from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/lib/project-identity/projectIdentity.ts :2 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/lib/version/versionHandshake.ts :1 import { existsSync, readFileSync } from "node:fs";
fs (weak) code4bones-tellymcp-c11319e/tests/chromeExtensionActions.test.ts :1 import { readFileSync } from "node:fs";
fs (weak) code4bones-tellymcp-c11319e/tests/getFileService.test.ts :1 import { mkdir, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
fs (weak) code4bones-tellymcp-c11319e/tests/projectIdentity.test.ts :1 import { mkdtempSync, readFileSync, rmSync } from "node:fs";
fs (weak) code4bones-tellymcp-c11319e/tests/sendPartnerFileService.test.ts :1 import { mkdtemp, rm, truncate, writeFile } from "node:fs/promises";

shell / exec 5

shell (weak) code4bones-tellymcp-c11319e/scripts/postinstall.js :3 const { spawnSync } = require("node:child_process");
shell code4bones-tellymcp-c11319e/src/cli.ts :12 import { spawn } from "node:child_process";
shell code4bones-tellymcp-c11319e/src/codexPluginInstaller.ts :11 import { spawnSync } from "node:child_process";
shell code4bones-tellymcp-c11319e/src/configureServer.ts :7 import { spawn } from "node:child_process";
shell code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/integrations/terminal/ptyRegistry.ts :232 const pty = spawn(record.shell, launch.args, {

network 26

net code4bones-tellymcp-c11319e/src/cli.ts :14 import net from "node:net";
net code4bones-tellymcp-c11319e/src/configureServer.ts :5 } from "node:http";
net code4bones-tellymcp-c11319e/src/lib/moleculer.ts :3 import { IncomingHttpHeaders, IncomingMessage, OutgoingMessage } from "http";
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/gateway-socket.service.ts :3 import type { IncomingMessage, Server as HttpServer } from "node:http";
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/mcp-http.service.ts :2 import type { IncomingMessage, ServerResponse } from "node:http";
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/app/http.ts :5 } from "node:http";
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/app/oauthFacade.ts :13 import type { IncomingMessage, ServerResponse } from "node:http";
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/app/webapp/assets.ts :852 const response = await fetch(config.basePath + "/api/bootstrap", {
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/distributed-client/model/gatewayClientAccess.ts :28 const response = await fetch(url, {
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/distributed-client/model/gatewayCollaborationBackend.ts :50 const response = await fetch(url, {
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/distributed-gateway/model/gatewayHttpService.ts :1 import type { IncomingMessage, ServerResponse } from "node:http";
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/file-content/model/getFileService.ts :314 const response = await fetch(input.upload_url, {
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/file-content/model/temporaryFileLinkStore.ts :4 import type { IncomingMessage, ServerResponse } from "node:http";
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/notify/model/notifyService.ts :536 const response = await fetch(url, {
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/tools-sync/model/refreshToolsMarkdownService.ts :155 const response = await fetch(url, {
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/integrations/telegram/proxyFetch.ts :57 globalThis.fetch(input, {
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/integrations/telegram/transport.ts :369 const response = await fetch(url, {
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/lib/bodyLimits.ts :1 import type { IncomingMessage } from "node:http";
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/shared/lib/version/versionHandshake.ts :268 const response = await fetch(
net code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/standalone-http.service.ts :1 import { createServer, type IncomingMessage, type ServerResponse, type Server } from "node:http";
net (weak) code4bones-tellymcp-c11319e/tests/bodyLimits.test.ts :1 import type { IncomingMessage } from "node:http";
net (weak) code4bones-tellymcp-c11319e/tests/browserAttachSecurity.test.ts :1 import { createServer } from "node:net";
net (weak) code4bones-tellymcp-c11319e/tests/configureServer.test.ts :190 const page = await fetch(url);
net (weak) code4bones-tellymcp-c11319e/tests/gatewayHttpService.test.ts :1 import type { IncomingMessage, ServerResponse } from "node:http";
net (weak) code4bones-tellymcp-c11319e/tests/gatewayWsAuth.test.ts :1 import { createServer } from "node:http";
net (weak) code4bones-tellymcp-c11319e/tests/oauthFacade.test.ts :2 import type { IncomingMessage, ServerResponse } from "node:http";

secrets 1

secrets code4bones-tellymcp-c11319e/src/lib/mixins/db.ts :106 password: process.env.DB_PASSWORD || "",

database 3

db code4bones-tellymcp-c11319e/src/cli.ts :16 import Redis from "ioredis";
db code4bones-tellymcp-c11319e/src/configureServer.ts :9 import Redis from "ioredis";
db code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/app/providers/redis/client.ts :1 import { Redis } from "ioredis";

tool registrations 41

ask_user_telegram code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/ask-user/model/askUserTelegram.ts :25
browser_attach_active_tab code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserAttachActiveTabTool.ts :18
browser_attach_tab code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserAttachTabTool.ts :18
browser_clear_logs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserClearLogsTool.ts :18
browser_click code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserClickTool.ts :18
browser_close code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserCloseTool.ts :18
browser_computed_style code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserComputedStyleTool.ts :18
browser_console code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserConsoleTool.ts :18
browser_detach_tab code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserDetachTabTool.ts :18
browser_dom code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserDomTool.ts :18
browser_errors code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserErrorsTool.ts :18
browser_fill code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserFillTool.ts :18
browser_inject_script code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserInjectScriptTool.ts :18
browser_list_attached_instances code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserListAttachedInstancesTool.ts :23
browser_list_tabs code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserListTabsTool.ts :23
browser_network_failures code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserNetworkFailuresTool.ts :18
browser_open code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserOpenTool.ts :23
browser_press code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserPressTool.ts :18
browser_recording_start code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserRecordingStartTool.ts :18
browser_recording_status code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserRecordingStatusTool.ts :18
browser_recording_stop code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserRecordingStopTool.ts :18
browser_reload code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserReloadTool.ts :18
browser_screenshot code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserScreenshotTool.ts :18
browser_wait_for code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserWaitForTool.ts :18
browser_wait_for_url code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/browser/model/browserWaitForUrlTool.ts :18
list_gateway_sessions code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/collaboration/model/listGatewaySessionsTool.ts :25
send_partner_file code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/collaboration/model/sendPartnerFileTool.ts :25
send_partner_note code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/collaboration/model/sendPartnerNoteTool.ts :25
get_file_list code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/file-content/model/getFileListTool.ts :23
get_file code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/file-content/model/getFileTool.ts :39
notify_telegram code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/notify/model/notifyTelegramTool.ts :23
send_file_to_telegram code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/notify/model/sendFileToTelegramTool.ts :23
clear_session_context code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/session-context/model/clearSessionContextTool.ts :25
get_runtime_diagnostics code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/session-context/model/getRuntimeDiagnosticsTool.ts :16
get_session_context code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/session-context/model/getSessionContextTool.ts :25
rename_session code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/session-context/model/renameSessionTool.ts :25
set_session_context code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/session-context/model/setSessionContextTool.ts :25
refresh_tools_markdown code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/tools-sync/model/refreshToolsMarkdownTool.ts :25
get_xchange_record code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/xchange/model/getXchangeRecordTool.ts :18
list_xchange_records code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/xchange/model/listXchangeRecordsTool.ts :18
mark_xchange_record_read code4bones-tellymcp-c11319e/src/services/features/telegram-mcp/src/features/xchange/model/markXchangeRecordReadTool.ts :18

install hooks 3

postinstall code4bones-tellymcp-c11319e/package.json :41 node ./scripts/postinstall.js
prepack code4bones-tellymcp-c11319e/package.json :43 yarn build && yarn build:extensions
prepublishOnly code4bones-tellymcp-c11319e/package.json :44 yarn build && yarn build:extensions && yarn lint && yarn test

declared dependencies 41

@modelcontextprotocol/sdk@^1.29.0
@grammyjs/menu@^1.3.1
@grammyjs/storage-redis@^2.5.1
@xterm/addon-fit@0.10.0
@xterm/headless@5.5.0
@xterm/xterm@5.5.0
amqplib@0.10.9
dotenv@^17.4.2
grammy@1.43.0
https-proxy-agent@^7.0.6
i18next@^26.2.0
ioredis@5.10.1
knex@^3.2.10
mime-types@^3.0.2
module-alias@^2.3.4
moleculer@0.15.0
node-pty@^1.1.0
pg@^8.20.0
picocolors@^1.1.1
pino@^10.3.1
pino-pretty@^13.1.3
playwright@^1.60.0
socks-proxy-agent@^8.0.5
ws@8.21.0
zod@4.4.3
@eslint/js@^9.34.0
@types/amqplib@^0.10.8
@types/mime-types@^3.0.1
@types/node@24.12.4
@types/pg@^8.20.0
eslint@^9.34.0
eslint-import-resolver-typescript@^4.4.4
eslint-plugin-import@^2.32.0
globals@^16.3.0
prettier@^3.6.2
ts-node@^10.9.2
tsc-alias@^1.8.17
tsx@4.22.1
typescript@^5.9.2
typescript-eslint@8.59.3
vitest@^4.1.6