github JavaScript analyzed b738f3b

kfastov/tgcli

github

Telegram user console client and archiver

maintainer: kfastov
license: MIT
first seen: 2026-06-04
last seen: 2026-07-17
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 38 tools

transport stdio · streamable-http · http counts 38 tools · 0 res · 0 prompts permission surface via code analysis

tools

autoTagChannels
contactsAliasRemove
contactsAliasSet
contactsGet
contactsNotesSet
contactsSearch
contactsTagsAdd
contactsTagsRemove
getChannelMetadata
getSyncedMessageStats
groupsInfo
groupsInviteLinkGet
groupsInviteLinkRevoke
groupsJoin
groupsLeave
groupsList
groupsMembersAdd
groupsMembersRemove
groupsRename
listActiveChannels
listChannelTags
listChannels
listMessageSyncJobs
listTaggedChannels
markChannelRead
mediaDownload
messagesContext
messagesGet
messagesList
messagesSearch
messagesSend
messagesSendFile
refreshChannelMetadata
scheduleMessageSync
searchChannels
setChannelTags
topicsList
topicsSearch

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit b738f3b · analyzer v33 · 1w ago

skills & prompt files 2

agent-rules kfastov-tgcli-b738f3b/AGENTS.md
skill kfastov-tgcli-b738f3b/SKILL.md

danger signals4

suspicious endpoint t.me kfastov-tgcli-b738f3b/cli.js :1279 return `https://t.me/${trimmed}`;
suspicious endpoint t.me kfastov-tgcli-b738f3b/tests/control-server.test.js :231 getGroupInviteLink: vi.fn(() => Promise.resolve({ link: 'https://t.me/+warm' })),
suspicious endpoint t.me kfastov-tgcli-b738f3b/tests/folders.test.js :530 const result = await tc.joinChatlist('https://t.me/addlist/abc123');
suspicious endpoint t.me kfastov-tgcli-b738f3b/tests/operations-seam.test.js :53 getGroupInviteLink: vi.fn().mockResolvedValue({ link: 'https://t.me/+warm' }),

code evidence vv2.2.2 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 44

filesystem 20

fs kfastov-tgcli-b738f3b/cli.js :2 import fs from 'fs';
fs kfastov-tgcli-b738f3b/core/config.js :1 import fs from 'fs';
fs kfastov-tgcli-b738f3b/core/control-client.js :10 import fs from 'fs';
fs kfastov-tgcli-b738f3b/core/control-server.js :1 import fs from 'fs';
fs kfastov-tgcli-b738f3b/mcp-server.js :2 import fs from "fs";
fs kfastov-tgcli-b738f3b/message-sync-service.js :3 import fs from 'fs';
fs kfastov-tgcli-b738f3b/store-lock.js :1 import fs from 'fs';
fs kfastov-tgcli-b738f3b/telegram-client.js :8 import fs from 'fs';
fs (weak) kfastov-tgcli-b738f3b/tests/backfill-progress.test.js :1 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/cli-auth.test.js :1 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/cli-send-photo.test.js :1 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/control-client.test.js :5 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/control-server-cold-start.test.js :11 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/feedback.test.js :1 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/idle-exit.test.js :1 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/media-download.test.js :17 import fs from 'fs';
fs (weak) kfastov-tgcli-b738f3b/tests/send-messages.test.js :17 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/services.test.js :1 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/shutdown-requeue.test.js :1 import fs from 'node:fs';
fs (weak) kfastov-tgcli-b738f3b/tests/store-lock.test.js :1 import fs from 'node:fs';

shell / exec 3

shell kfastov-tgcli-b738f3b/cli.js :5 import { spawn, spawnSync } from 'child_process';
shell kfastov-tgcli-b738f3b/core/control-client.js :12 import { spawn } from 'child_process';
shell (weak) kfastov-tgcli-b738f3b/tests/control-client.test.js :3 // child_process.spawn are mocked — no real network, no real process.

network 5

net kfastov-tgcli-b738f3b/core/control-client.js :84 const res = await fetch(controlUrl(control, pathname), {
net kfastov-tgcli-b738f3b/mcp-server.js :1 import http from "http";
net (weak) kfastov-tgcli-b738f3b/tests/control-server-cold-start.test.js :14 import http from 'node:http';
net (weak) kfastov-tgcli-b738f3b/tests/control-server.test.js :1 import http from 'node:http';
net (weak) kfastov-tgcli-b738f3b/tests/send-operations.test.js :7 import http from 'node:http';

database 1

db kfastov-tgcli-b738f3b/message-sync-service.js :1 import Database from 'better-sqlite3';

tool registrations 38

listChannels kfastov-tgcli-b738f3b/mcp-server.js :650
searchChannels kfastov-tgcli-b738f3b/mcp-server.js :669
listActiveChannels kfastov-tgcli-b738f3b/mcp-server.js :688
setChannelTags kfastov-tgcli-b738f3b/mcp-server.js :706
listChannelTags kfastov-tgcli-b738f3b/mcp-server.js :724
listTaggedChannels kfastov-tgcli-b738f3b/mcp-server.js :742
refreshChannelMetadata kfastov-tgcli-b738f3b/mcp-server.js :760
getChannelMetadata kfastov-tgcli-b738f3b/mcp-server.js :784
autoTagChannels kfastov-tgcli-b738f3b/mcp-server.js :802
topicsList kfastov-tgcli-b738f3b/mcp-server.js :826
topicsSearch kfastov-tgcli-b738f3b/mcp-server.js :877
messagesList kfastov-tgcli-b738f3b/mcp-server.js :913
messagesGet kfastov-tgcli-b738f3b/mcp-server.js :950
messagesContext kfastov-tgcli-b738f3b/mcp-server.js :976
messagesSearch kfastov-tgcli-b738f3b/mcp-server.js :1010
messagesSend kfastov-tgcli-b738f3b/mcp-server.js :1063
messagesSendFile kfastov-tgcli-b738f3b/mcp-server.js :1087
mediaDownload kfastov-tgcli-b738f3b/mcp-server.js :1112
contactsSearch kfastov-tgcli-b738f3b/mcp-server.js :1131
contactsGet kfastov-tgcli-b738f3b/mcp-server.js :1150
contactsAliasSet kfastov-tgcli-b738f3b/mcp-server.js :1169
contactsAliasRemove kfastov-tgcli-b738f3b/mcp-server.js :1187
contactsTagsAdd kfastov-tgcli-b738f3b/mcp-server.js :1205
contactsTagsRemove kfastov-tgcli-b738f3b/mcp-server.js :1223
contactsNotesSet kfastov-tgcli-b738f3b/mcp-server.js :1241
groupsList kfastov-tgcli-b738f3b/mcp-server.js :1259
groupsInfo kfastov-tgcli-b738f3b/mcp-server.js :1278
groupsRename kfastov-tgcli-b738f3b/mcp-server.js :1297
groupsMembersAdd kfastov-tgcli-b738f3b/mcp-server.js :1316
groupsMembersRemove kfastov-tgcli-b738f3b/mcp-server.js :1335
groupsInviteLinkGet kfastov-tgcli-b738f3b/mcp-server.js :1354
groupsInviteLinkRevoke kfastov-tgcli-b738f3b/mcp-server.js :1373
groupsJoin kfastov-tgcli-b738f3b/mcp-server.js :1392
groupsLeave kfastov-tgcli-b738f3b/mcp-server.js :1420
scheduleMessageSync kfastov-tgcli-b738f3b/mcp-server.js :1439
getSyncedMessageStats kfastov-tgcli-b738f3b/mcp-server.js :1459
listMessageSyncJobs kfastov-tgcli-b738f3b/mcp-server.js :1484
markChannelRead kfastov-tgcli-b738f3b/mcp-server.js :1502

install hooks 2

prepare kfastov-tgcli-b738f3b/package.json :11 npm run build
prepublishOnly kfastov-tgcli-b738f3b/package.json :13 npm test

declared dependencies 7

@modelcontextprotocol/sdk@^1.25.2
@mtcute/core@^0.27.8
@mtcute/node@^0.27.8
better-sqlite3@^12.6.0
commander@^12.1.0
qrcode@^1.5.4
vitest@^4.1.2