github TypeScript analyzed 16b5ddf

scitex-ai/claude-code-telegrammer

Custom Telegram MCP server + TUI auto-responder for Claude Code — 10 MCP tools, SQLite message store, access control, reaction support

Drift inferred · capture-to-capture

HIGH 2026-07-19 code analysis flagged dynamic code execution in scitex-ai/claude-code-telegrammer
HIGH 2026-07-15 code analysis flagged dynamic code execution in scitex-ai/claude-code-telegrammer
HIGH 2026-07-10 code analysis flagged dynamic code execution ×8 in scitex-ai/claude-code-telegrammer

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 16b5ddf · analyzer v28 · 3d ago

dynamic code execution new Function() scitex-ai-claude-code-telegrammer-16b5ddf/ts/dist/telegram-server.js :2893 const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
suspicious endpoint api.telegram.org scitex-ai-claude-code-telegrammer-16b5ddf/ts/dist/telegram-server.js :13677 var API_BASE = `https://api.telegram.org/bot${TOKEN}`;
suspicious endpoint api.telegram.org scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/config.ts :80 export const API_BASE = `https://api.telegram.org/bot${TOKEN}`;
suspicious endpoint api.telegram.org scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/send-cli.ts :116 ` https://api.telegram.org/bot/sendMessage\n` +
suspicious endpoint api.telegram.org scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/telegram-api.ts :115 const url = `https://api.telegram.org/file/bot${TOKEN}/${filePath}`;
suspicious endpoint api.telegram.org scitex-ai-claude-code-telegrammer-16b5ddf/ts/test/config.test.ts :62 expect(API_BASE).toBe("https://api.telegram.org/botfake:token");
suspicious endpoint api.telegram.org scitex-ai-claude-code-telegrammer-16b5ddf/ts/test/health-checks.test.ts :264 const s = `Unable to connect. URL: https://api.telegram.org/bot${FAKE_TOKEN}/getWebhookInfo (${FAKE_TOKEN})`;

code evidence vv0.5.12 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 319

fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/dist/telegram-server.js :13711 } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/access.ts :6 import { readFileSync, statSync } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/attachments.ts :8 import { mkdirSync } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/health-adapters.ts :30 } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/lock.ts :35 } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/migrate-state.ts :38 } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/poller-paths.ts :11 import { readdirSync, statSync } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/poller-supervisor.ts :44 import { openSync } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/signature.ts :55 import { readFileSync } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/takeover.ts :57 } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/telegram-api.ts :7 import { mkdirSync, readFileSync } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/tools-messages.ts :14 import { existsSync } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/usage.ts :22 import { readFileSync } from "fs";
fs scitex-ai-claude-code-telegrammer-16b5ddf/ts/telegram-server.ts :62 import { existsSync } from "fs";

shell scitex-ai-claude-code-telegrammer-16b5ddf/ts/dist/telegram-server.js :7425 return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
shell scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/poller-supervisor.ts :23 * Bun.spawn (this codebase is Bun-first throughout — bun:sqlite,

net scitex-ai-claude-code-telegrammer-16b5ddf/ts/dist/telegram-server.js :13990 const res = await fetch(`${API_BASE2}/${method}`, {
net scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/health-adapters.ts :32 import { connect } from "net";
net scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/telegram-api.ts :14 const res = await fetch(`${API_BASE}/${method}`, {
net scitex-ai-claude-code-telegrammer-16b5ddf/ts/lib/wake.ts :122 const resp = await fetch(url, {
net scitex-ai-claude-code-telegrammer-16b5ddf/ts/telegram-server.ts :6 * Minimal, self-contained — uses raw Bot API via fetch (no grammy).

secrets scitex-ai-claude-code-telegrammer-16b5ddf/ts/dist/telegram-server.js :13676 var TOKEN = process.env.CCT_BOT_TOKEN ?? "";