secure-telegram-mcp

Overview Schema Source Related Servers Discussions Admin

Download message media

download_media

Read-only

Downloads media from a single in-scope Telegram message to an allow-listed server file and returns the saved path, requiring the read_media grant.

Instructions

Download the media attached to a single in-scope message to a server-chosen file inside the allow-listed media directory, returning the file path (NOT the bytes). Requires the read_media grant — a text-only endpoint is refused. Media larger than the configured download cap is refused before any bytes are fetched. Every successful download submits an audit record; a sink failure is reported by the service but does not remove the downloaded file. The original file name is untrusted and surfaced under a named key, never as a bare instruction-bearing string.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "peer": "<peer>",
      "messageId": "<messageId>"
    },
    "name": "download_media"
  }
}

Input Schema

Name	Required	Description	Default
`peer`	Yes	Chat reference: { kind:'id', value:'<decimal id>' } \| { kind:'username', value:'@name' } \| { kind:'me' }.
`messageId`	Yes	A positive per-chat message id.

Output Schema

Name	Required	Description
`file_path`	Yes	Path (inside the confined media root) where the downloaded bytes were written.
`mime_type`	Yes	Sanitized MIME type of the downloaded media.
`size_bytes`	Yes	Downloaded file size in bytes.
`untrusted_text`	No	Attacker-controlled ORIGINAL file name (untrusted; display only).

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 4, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the supplied annotations: server-chosen filename, path-not-bytes return, size cap enforced before any fetch, an audit record per success, and the failure mode where a sink error is reported but the file is retained. It also flags the untrusted original filename as returned under a named key, which is prompt-injection-relevant context the annotations cannot express.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and return shape are front-loaded in the first sentence, and every following sentence adds a distinct constraint (grant, size cap, audit, untrusted filename) with no filler. The semicolon-chained clauses in the last two sentences are dense enough to slightly slow scanning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with an output schema and full annotation coverage, the description supplies everything an agent needs: authorization requirement, refusal conditions, persistence behavior, and the failure semantics. Nothing material about calling it correctly is left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters carry their own descriptions, so the baseline applies. The description adds only the 'in-scope message' framing, which implies peer/messageId must resolve within an authorized scope, but gives no format or resolution details beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource ('Download the media attached to a single in-scope message') plus the key outcome: a server-chosen file path inside the allow-listed media directory, explicitly NOT the bytes. That outcome clause is what separates it from metadata siblings like get_media_info/prepare_media without needing to name them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear preconditions for use: a single in-scope message, the read_media grant required, and refusal on text-only endpoints. It stops short of naming alternatives (e.g., when to call get_media_info or prepare_media instead), so the agent must infer the routing rather than being told.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

This server cannot be deployed