How to use Claude to audit a Telegram MCP service
Claude audited a Telegram REST and MCP project; its owner restricted CI triggers, added approval before channel joins, and documented one remaining risk.
linkedin.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Audit my Telegram REST and MCP service, focusing on CI agent triggers, commenter trust, token scopes, external-message handling, channel auto-joins, and secret storage. Reproduce and triage candidates before editing. Propose collaborator gates and a human approval queue, then list fixed findings, remaining accepted risks, and audit cost.
Reach people exploring AI agents
See placements →What happened
The author reports eight of nine findings fixed, including CI trigger restrictions and human approval before channel joins; one privilege gap remained.
Reported by Dylan E. — LinkedInHow the agent did it
- Dylan pointed Claude Code Security at his own TeleScraper REST and MCP codebase.
- He restricted the credentialed CI trigger and changed automatic Telegram joins into human-reviewed candidates.
- He repaired other reported issues while retaining one API-key privilege gap as an explicit limitation.
Where a person stepped in
Dylan reviewed and implemented the findings, retained channel-join approval, and explicitly accepted one unresolved API-key privilege issue.
Dylan E. ran the Claude Code Security plugin against TeleScraper, his Telegram intelligence project with REST and MCP interfaces. He reported nine confirmed findings after the plugin’s candidate review process, then worked through the fixes rather than treating the scan as a clean bill of health.
One issue concerned a GitHub workflow that could launch a credentialed agent from an untrusted commenter’s mention. The repair added a collaborator boundary, restricted tool access, and removed unnecessary identity-token authority. Another concerned automatically joining channels suggested by untrusted messages: candidates were moved into a queue for human approval before a join.
The project also returned external Telegram text through MCP. Wrapping that material as untrusted data made the boundary explicit, but the author did not present it as a complete prompt-injection defense. Other fixes included secret-file permissions and operational handling of API keys.
The account reports eight of the nine findings fixed. An API-key privilege gap remained an accepted limitation. The audit also exhausted usage credits and consumed substantial tokens. The practical result is a set of specific permission and approval changes, with one remaining issue, rather than a claim that the service became immune to malicious input.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: LinkedIn · Dylan E.
Frequently asked questions
Was every reported issue repaired?
No. Eight were fixed and an API-key privilege gap remained.
How did channel joining change?
Untrusted suggestions became candidates requiring human approval.
Does wrapping MCP text prevent every injection?
No. The author treats it as a boundary, not a complete defense.
More details
About this account
Dylan pointed Claude Code Security at his own TeleScraper REST and MCP codebase. He restricted the credentialed CI trigger and changed automatic Telegram joins into human-reviewed candidates.
Author is displayed as Dylan E.; the URL surname is not used as identity evidence. Results and cost are author-reported. Explicitly preserve the remaining privilege gap and incomplete prompt-injection mitigation. Suggested prompt written by Agents In Use; no original task prompt was published in the verified account.
Credit: Dylan E. — LinkedIn
Source published 17 Sept 2026
Source checked 14 Oct 2026
Tools and topics
Claude Code Security · Telegram · MCP · GitHub Actions
prompt injection · CI permissions · human approval
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.