Skip to main content
Glama
telegram-notify MCP

telegram-notify MCP

by yybd

English · עברית

telegram-notify MCP

A small, send-only MCP server that lets Claude (or any MCP client) send Telegram notifications to you: a scheduled job finished, a long build failed, a reminder came due.

  • One fixed recipient. The chat is set in configuration. No tool takes a chat id, so the model cannot send anywhere else.

  • Never polls. It calls sendMessage, sendDocument and getMe, and never getUpdates. The same bot can keep serving another tool that polls it (for example the Claude Code Telegram channel plugin) with no 409 Conflict, and nothing expires after 24 hours.

  • Two tools, no Telegram library, two runtime dependencies (the MCP SDK and zod).

Tools

Tool

What it does

notify

Sends text to your chat. Plain text by default; format: "markdown" turns **bold**, _italic_, `code`, code blocks, [links](https://…) and # headings into Telegram HTML, with everything else escaped. Over 4096 characters it is split into several messages. silent: true delivers without a sound

notify_file

Sends a file (up to 50 MB) with an optional caption, only from one folder you allow (TELEGRAM_NOTIFY_FILES_DIR). Paths are resolved to their real location first, so .. and symlinks cannot reach outside it. Without that variable every call is refused

The tools are one-way: replies you type in Telegram never come back to the model.

Related MCP server: telegram-bot

Setup

1. A bot. In Telegram, open @BotFather, send /newbot, and copy the token. An existing bot works too, even one another tool already polls.

2. Your chat id. Open a chat with your bot and press Start (a bot may only message people who started it). Then get your numeric id from a bot such as @userinfobot. A group's id is negative; a channel can be given as @channelname once the bot is an admin there.

3. Save it, either way:

npx -y @yybd/telegram-notify-mcp setup

This asks for the token (hidden) and the chat id, checks the token, writes ~/.telegram-notify/config.json with 600 permissions and sends a test message. Add --files-dir <folder> to allow notify_file. TELEGRAM_NOTIFY_HOME moves the folder.

Or pass environment variables to the server, which override the file:

Variable

TELEGRAM_BOT_TOKEN

required

TELEGRAM_CHAT_ID

required; the only recipient

TELEGRAM_NOTIFY_FILES_DIR

optional; the only folder notify_file may read. Unset = file sending off

Check it any time:

npx -y @yybd/telegram-notify-mcp test

Connect your clients

Claude Code

Recommended: run setup first (see above), then add the server with no secrets on the command line:

claude mcp add telegram-notify -s user -- npx -y @yybd/telegram-notify-mcp

The token then stays in ~/.telegram-notify/config.json (mode 600) and out of ~/.claude.json.

Or with environment variables instead of setup. Replace the example values with yours and keep the quotes. Don't type angle brackets such as <token>: the shell reads < as "read from a file" and the command fails with no such file or directory.

claude mcp add telegram-notify -s user -e TELEGRAM_BOT_TOKEN="123456789:AAExampleTokenFromBotFather" -e TELEGRAM_CHAT_ID="987654321" -- npx -y @yybd/telegram-notify-mcp

This stores the token in ~/.claude.json.

New sessions pick up the server; one that is already open doesn't.

To send without a permission prompt each time, allow the tool in ~/.claude/settings.json: "permissions": { "allow": ["mcp__telegram-notify__notify"] }. That is safe because of the fixed recipient: the worst a confused model can do is message you.

Claude Desktop

One click (recommended): download telegram-notify-<version>.mcpb from the latest release and double-click it, or drag it onto Settings → Extensions in Claude Desktop. Desktop asks for the bot token (stored as a secret), the chat id and, optionally, the folder for files, then installs it. Nothing else is needed: Desktop runs the extension with its own Node.js, and you don't need setup.

Or by hand: in ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "telegram-notify": {
      "command": "npx",
      "args": ["-y", "@yybd/telegram-notify-mcp"]
    }
  }
}

Add "env": { "TELEGRAM_BOT_TOKEN": "…", "TELEGRAM_CHAT_ID": "…" } if you didn't run setup. Then restart Claude Desktop. If it can't find npx, use its full path (which npx).

How it compares

Checked on 2026-11-07 against each project's source code, with star counts from that day.

Option

Recipient

Reads updates (getUpdates)

Shares a bot with a poller

Tools

Files

telegram-notify (this)

fixed in config; no tool parameter

never

yes

2

one allowed folder, symlink-safe; off by default

ParthJadhav/telegram-notify-mcp (7 ⭐)

found by username in getUpdates

yes, on every process start

no

3

any local path

aahl/mcp-notify (29 ⭐)

TELEGRAM_DEFAULT_CHAT, but every Telegram tool takes a chat_id the model can override

no

yes

20+ (Telegram, WeCom, Home Assistant, others)

by URL

antonio-castellon/mcp-telegram-bridge (0 ⭐)

chat_id per call

yes, a telegram_get_updates tool

no

6

no

Official Claude channel plugins (Telegram)

whoever pairs

yes, continuously

it is the poller

—

yes

Why that matters:

  • ParthJadhav/telegram-notify-mcp is the closest in shape, but it learns your chat id from getUpdates each time it starts. Telegram keeps updates for only 24 hours, so a day after you last messaged the bot, it can no longer find you. Its getUpdates call also fails with 409 Conflict while another process polls the same bot.

  • aahl/mcp-notify works with a default chat, but the model may pass any chat_id, and it registers about twenty tools across many platforms.

  • mcp-telegram-bridge is two-way by design: it reads inbound messages, so it cannot be send-only and has the same polling conflict.

  • Channel plugins poll the bot to receive messages and belong to the one session that runs them; they are not a way for every session and client to notify you.

What telegram-notify gives you: a fixed recipient, no polling, one bot shared with your other tools, two tools, and file sending confined to one folder. What it deliberately doesn't do: receive messages, ask you questions and wait for answers, or send to anyone else.

Security notes

  • The token is never logged, and it is removed from every error message before it reaches the model or your terminal.

  • config.json is written with 600 permissions.

  • The server writes nothing to stdout except the MCP protocol, and talks to api.telegram.org only.

Development

npm test

The tests run offline, with fetch mocked. They check that getUpdates is never called, that a smuggled chat_id is ignored, that the file sandbox rejects .., absolute paths and symlinks, that the token is redacted from errors, and that long text is split.

./scripts/pack-mcpb.sh builds the Claude Desktop extension, telegram-notify-<version>.mcpb, from manifest.json, dist/ and the production dependencies.

Layout:

  • src/config.ts — environment and config file

  • src/telegram.ts — Bot API calls, Markdown → HTML, splitting, the file sandbox

  • src/server.ts — the two tools

  • src/cli.ts — setup and test

  • src/main.ts — the command the package installs

License

MIT

Available Tools

2 tools
notifySend a Telegram notificationA

Sends a message to the owner's Telegram (a fixed chat; you cannot choose the recipient). Messages over 4096 characters are split. Do not use emoji or icons.

NameRequiredDescriptionDefault
textYesThe message
formatNoplain (default) or markdown: **bold**, _italic_, `code`, ```blocks```, [links](https://…), # headings
silentNoDeliver without a notification sound

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish that this is a non-readonly, open-world, non-idempotent, non-destructive write. The description goes beyond that by disclosing the fixed recipient, the 4096-character auto-splitting behavior, and a content restriction on emoji. It omits failure modes, rate limits, and whether delivery is confirmed, which keeps it short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, no filler, and the most important constraint (fixed recipient) is front-loaded in a parenthetical before any formatting rules. Every sentence carries an actionable constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter, single-purpose tool with full schema coverage and no output schema, the description covers recipient, length handling, and content restrictions adequately. What is missing — delivery confirmation, failure behavior, rate limits — is minor given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and each parameter carries its own description, so the baseline is 3. The description's 4096-character split rule is genuinely useful context for the text parameter because the schema only advertises maxLength 40000, but the emoji ban and split threshold are the only added meaning; format and silent are left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ("Sends a message to the owner's Telegram") and immediately scopes the recipient as a fixed chat, which separates it in practice from notify_file. It does not name the sibling explicitly, so the differentiation is inferred from the resource rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"You cannot choose the recipient" rules out an approach an agent might otherwise attempt, and "Do not use emoji or icons" is a usable constraint. However, there is no statement of when to prefer notify_file over notify, and no guidance on when a notification is appropriate at all — usage is implied rather than specified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

notify_fileSend a file over TelegramA

File sending is turned off on this server (TELEGRAM_NOTIFY_FILES_DIR is not set); every call is refused.

NameRequiredDescriptionDefault
pathYesFile path, inside the allowed folder
silentNoDeliver without a notification sound
captionNoCaption; over 1024 characters it is sent as a separate message

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already say the tool is a non-read-only, open-world, non-idempotent write, but nothing in them reveals that it is unusable in this deployment. The description supplies exactly that operational fact, which is the single most important behavioral trait here, though it does not say what the refusal looks like (error vs. empty result).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short sentence that puts the blocking fact first with no filler. Nothing in it could be removed without losing the warning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a deliberately disabled tool with full schema coverage and no output schema, telling the agent it will always be refused is nearly all that is needed. It would be complete if it pointed to the working sibling 'notify' as the fallback path.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and all three parameters are documented in the schema, including the path restriction and the 1024-character caption split. The description adds no parameter meaning beyond that, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description never states what the tool does in active terms; the operation ('File sending') is only mentioned inside a statement that it is disabled. An agent learns the resource but not the verb or outcome, and must fall back on the title 'Send a file over Telegram' for the actual purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an unusually decisive usage rule: every call is refused, so the tool should not be invoked at all. That is explicit when-not-to-use guidance, though it stops short of naming the sibling 'notify' as the alternative for text messages.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.1.2
    • First observednotify
    • First observednotify_file

TDQS

A3.5/5.0

Scored across 2 tools

Disambiguation3/5

notify and notify_file have clearly different nominal purposes (text vs file), but notify_file is permanently disabled, so an agent has a real chance of wasting a call on a dead branch before reading the caveat. With only one functional operation, the distinction is trivial rather than a genuine choice.

Naming Consistency4/5

Both names are lowercase snake_case and share the 'notify' stem, which is predictable. Minor deviation: 'notify' is a bare verb while 'notify_file' adds a noun, so the pattern is more a prefix family than a strict verb_noun scheme.

Tool Count2/5

Effectively one usable tool, since notify_file is refused on every call. For a single-purpose one-way notifier that is defensible, but advertising a non-functional second tool makes the surface feel padded and thin at the same time.

Completeness2/5

The core send-a-message operation exists, but file sending is exposed yet permanently off, and there is no recipient selection, no read/status, and no message formatting options. The surface has a built-in dead end rather than a coverage gap an agent can work around.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables MCP clients to read allowlisted Telegram chats and send messages as a bot, with access control, local secrets, and duplicate send protection.
    1
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables reading and posting messages, attachments, and thread content in allowlisted Discord channels from any local stdio MCP client, with strict scope limits and no channel management or message editing capabilities.
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables MCP clients to send plain-text messages to a preconfigured WeCom group chat bot through a single send tool. It validates content size, restricts delivery to the configured webhook, and returns platform acceptance or error status without retries or persistence.
    1
    1
    MIT