|
| 1 | +# Telepath — your Telegram, readable by ZCode |
| 2 | + |
| 3 | +[中文文档](./README_CN.md) |
| 4 | + |
| 5 | +Telepath connects **your own Telegram account** to ZCode through a hosted MCP |
| 6 | +server. Not another chat channel for talking to an assistant — it gives the |
| 7 | +assistant access to the conversations you already have: search the archive, read |
| 8 | +the documents, photos and transcribed voice inside it, and reply as yourself. |
| 9 | + |
| 10 | +It runs on Telegram's official business-bot API — a bot you add to your own |
| 11 | +account — not on an MTProto user session. Nothing here logs in as you. |
| 12 | + |
| 13 | +## What it adds |
| 14 | + |
| 15 | +One MCP server, `telepath`, reached over HTTP at |
| 16 | +`https://telepath.lemma.company/mcp`. Its tools cover: |
| 17 | + |
| 18 | +- full-text search across your archived chats, captions and voice transcripts; |
| 19 | +- reading a chat's recent messages, or a specific message and its context; |
| 20 | +- opening attachments by content — PDFs, spreadsheets, documents, photos; |
| 21 | +- sending, editing and reacting in your own chats, as yourself; |
| 22 | +- a small markdown notes store scoped to your account. |
| 23 | + |
| 24 | +Which of these exist in a session depends on the capabilities you leave enabled; |
| 25 | +every one of them is a switch you control from the Telegram bot. |
| 26 | + |
| 27 | +## Setup |
| 28 | + |
| 29 | +1. In Telegram: **Settings → My Account → Chat automation**, add |
| 30 | + **@lemma_telepath_bot**, and choose which conversations it may access. This |
| 31 | + entry is open to every account — **Telegram Premium is not required**. |
| 32 | +2. Install this plugin. ZCode registers the remote MCP server and asks you to |
| 33 | + authorize it. |
| 34 | +3. Sign in with Telegram when the browser opens. That is the whole of the |
| 35 | + authentication; there is no API key and nothing to paste into chat. |
| 36 | + |
| 37 | +From that moment, new messages in the chats you picked are archived and become |
| 38 | +searchable from ZCode. Nothing older is imported unless you ask for it. |
| 39 | + |
| 40 | +Walkthrough with screenshots: https://telepath.lemma.company/start |
| 41 | + |
| 42 | +## Network access |
| 43 | + |
| 44 | +The plugin itself ships no code — only this manifest and documentation. Every |
| 45 | +request goes to one domain: |
| 46 | + |
| 47 | +| Endpoint | Why | |
| 48 | +|---|---| |
| 49 | +| `https://telepath.lemma.company/mcp` | the MCP server itself (streamable HTTP) | |
| 50 | +| `https://telepath.lemma.company/authorize`, `/token`, `/register` | OAuth 2.1 with PKCE and dynamic client registration | |
| 51 | +| `https://telepath.lemma.company/oauth/login` | the sign-in page, which loads the Telegram Login widget from `oauth.telegram.org` | |
| 52 | + |
| 53 | +No `curl | bash`, no downloaded executables, no `postinstall` step, no hooks, no |
| 54 | +commands, no local file writes. |
| 55 | + |
| 56 | +## Permissions and side effects |
| 57 | + |
| 58 | +- **It reads your messages.** Only the chats you chose in Telegram, only from the |
| 59 | + moment you connected the bot. |
| 60 | +- **It can send and edit messages as you**, if you leave that capability on. |
| 61 | + This is a real side effect in the world: a tool call reaches an actual person. |
| 62 | + Telegram allows it only in private chats that received an incoming message |
| 63 | + within the last 24 hours. |
| 64 | +- **Voice transcription is optional and paid.** When enabled, audio is sent to |
| 65 | + Mistral (Voxtral, EU) to be turned into text; it is not reused for training, |
| 66 | + and no copy is kept once the transcript is stored. Everything else stays on |
| 67 | + our server. |
| 68 | +- **Group archiving, history import and bringing your own bot** are optional and |
| 69 | + off by default. |
| 70 | + |
| 71 | +Turn any of this off, or erase everything, from the bot: `/settings`, |
| 72 | +`/deletedata`. |
| 73 | + |
| 74 | +## Honest limits |
| 75 | + |
| 76 | +Telepath is a **hosted service**, and it is **not end-to-end encrypted** — to |
| 77 | +search and transcribe for you, our servers process your messages, so we can |
| 78 | +technically access them. We say so plainly rather than implying otherwise. |
| 79 | + |
| 80 | +Each account gets a physically separate database, the disk is encrypted at rest |
| 81 | +(LUKS full-disk), and credentials are encrypted or hashed on top. If you need a |
| 82 | +guarantee that no operator can ever read it, the connector is also available to |
| 83 | +self-host, single-tenant, as the same code. |
| 84 | + |
| 85 | +- Privacy policy: https://telepath.lemma.company/privacy |
| 86 | +- Terms: https://telepath.lemma.company/terms |
| 87 | +- Support: https://telepath.lemma.company/support |
| 88 | + |
| 89 | +## Licensing and provenance |
| 90 | + |
| 91 | +This plugin package is **MIT** — see the |
| 92 | +[source repository](https://github.com/Lemma-Company/telepath-plugin). It |
| 93 | +contains manifests and documentation only; none of the server's code is in it. |
| 94 | +The hosted service it points at is operated by Lemma under the terms linked |
| 95 | +above. Telepath is not affiliated with Telegram or Z.ai. |
0 commit comments