# mcp-yandex360

An MCP server for [Yandex 360](https://360.yandex.com/): **Disk**, **Telemost**
and **Messenger** in one process, 28 tools.

Public MCP servers exist for Yandex Tracker, Yandex Cloud and Yandex Search.
None covered Disk, Telemost or Messenger, so this fills that gap — it lets an
assistant read and write files on Disk, spin up a Telemost meeting link, and
post into a Messenger chat.

## Tools

**Disk** — `disk_info`, `disk_list`, `disk_find`, `disk_last_uploaded`,
`disk_download_url`, `disk_read_text`, `disk_save_to_local`, `disk_upload_text`,
`disk_upload_file`, `disk_mkdir`, `disk_move`, `disk_copy`, `disk_publish`,
`disk_unpublish`, `disk_delete`, `disk_public_list`

**Telemost** — `telemost_create`, `telemost_get`, `telemost_update`,
`telemost_delete`, `telemost_org_settings`

**Messenger** — `messenger_send_text`, `messenger_send_file`,
`messenger_create_chat`, `messenger_update_members`, `messenger_updates`,
`messenger_delete_message`

**Escape hatch** — `yandex_api_request` calls any documented endpoint that has
no dedicated tool yet (reactions, polls, stickers), so you are not blocked
waiting on a release.

## Install

```bash
git clone https://github.com/<you>/mcp-yandex360.git
cd mcp-yandex360
python3 -m venv .venv && ./.venv/bin/pip install -r requirements.txt
```

Register with Claude Code:

```bash
claude mcp add yandex360 --scope user \
  -e YANDEX_DISK_TOKEN=... \
  -e YANDEX_TELEMOST_TOKEN=... \
  -e YANDEX_MESSENGER_BOT_TOKEN=... \
  -- "$PWD/.venv/bin/python" "$PWD/server.py"
```

Any MCP client works; the server speaks JSON-RPC over stdio.

## Configuration

| Variable | Purpose |
|---|---|
| `YANDEX_DISK_TOKEN` | OAuth token, scopes `cloud_api:disk.read` / `.write` / `.info` |
| `YANDEX_TELEMOST_TOKEN` | OAuth token, scopes `telemost-api:conferences.create` / `.read` / `.update` |
| `YANDEX_MESSENGER_BOT_TOKEN` | Bot token from the Yandex 360 admin panel |
| `YANDEX_ORG_ID` | Organization id — only `telemost_org_settings` needs it |
| `YANDEX_READ_ONLY=1` | Every mutating tool refuses, with a clear message |
| `YANDEX_ALLOW_DELETE=1` | Required *on top of* write access for the delete tools |

Each token is independent and optional. Tools for an unconfigured service are
still registered but fail with a message naming the variable to set, so the
server stays healthy while you roll credentials out one service at a time.

One OAuth app at <https://oauth.yandex.ru/client/new> can carry both the Disk
and Telemost scopes. The Messenger bot token comes from the Yandex 360 admin
panel under Messenger → Bots.

## Safety

Deletes are off unless you set `YANDEX_ALLOW_DELETE=1` — write access alone is
not enough. `disk_publish` is treated as a write, not a read, because it mints
a link anyone can open.

## Notes and limits

- **Telemost and Messenger need a Yandex 360 organization account.** Neither
  works with a personal Yandex account.
- **A Messenger bot can only post in chats it belongs to,** and cannot DM users
  who disallow it in their privacy settings.
- **Disk has no server-side name search.** `disk_find` pages the flat file list
  and filters locally, so narrow it with `media_type` on a large Disk.
- Download links returned by the Disk API expire within minutes.

## License

MIT