github TypeScript re-analysis due

jetapi/jetapi-mcp-server

Official JetAPI MCP server — send WhatsApp, Telegram, SMS and MAX messages, files and bulk mailings from AI agents (Claude, Cursor, VS Code)

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 14 tools

transport stdio verified reported listed in the official MCP registry counts 14 tools · 0 res · 0 prompts permission surface via README inference

create_webhook

Subscribe a URL to events: incoming messages, WhatsApp statuses, login/logout
delete_delivery

Delete a delivered WhatsApp/Telegram message on all recipient devices
delete_webhook

Delete a webhook
get_account

Full account info: balance, dispatch routing, sender names, subscription, WhatsApp/Telegram session status (token is masked)
get_balance

Balance, customer ID, dispatch routing channels and registered sender names
get_delivery_status

Status and details of a delivery, with the status explained in plain words
get_phone_info

Country, operator and normalized format of a phone number
get_utm_tags

List UTM tags used to track dispatches
get_webhook

Details of one webhook
list_webhooks

All registered webhooks
send_bulk

Send the same message to many phone numbers at once
send_file

Send a document, image, audio, video or contact card from a local path, URL or base64 (up to 100 MB)
send_message

Send a text via WhatsApp, Telegram (tdlib), Telegram Bot, SMS, VK/OK or MAX — with cascade, scheduling, priority, reply-to and callbacks
update_webhook

Change a webhook's URL and/or event types

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 4dc4e50 · analyzer v33 · 4d ago

suspicious endpoint t.me jetapi-jetapi-mcp-server-4dc4e50/src/types.ts :211 17: { name: "too_many_requests", label: "Request limit exceeded", final: true, hint: "Telegram reports too many requests; check the account at https://t.me/SpamBot." },

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 15

fs jetapi-jetapi-mcp-server-4dc4e50/src/tools/file.ts :1 import { readFile, stat } from "node:fs/promises"

net jetapi-jetapi-mcp-server-4dc4e50/src/client.ts :53 response = await fetch(url, {
net jetapi-jetapi-mcp-server-4dc4e50/src/tools/file.ts :90 response = await fetch(args.file_url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) })

secrets jetapi-jetapi-mcp-server-4dc4e50/src/config.ts :33 token: process.env.JETAPI_TOKEN?.trim() || undefined,

prepublishOnly jetapi-jetapi-mcp-server-4dc4e50/package.json :22 npm run build