Giving Claude access to your Telegram: the two setups, and why the difference matters

Short summary

A comparison of two Telegram MCP server setups for Claude: Bot API (limited, revocable, safe) versus MTProto (full account access, session file risks). The article includes config snippets for Claude Desktop, Cursor, Windsurf, and Codex CLI, and warns that MTProto session files grant full account access with no expiry, creating both theft and prompt-injection attack surfaces. The key takeaway: choose deliberately, not by default.

• •Bot API servers are safe — limited to chats the bot was added to, token revocable from BotFather
• •MTProto servers log in as you — every DM, group, and contact becomes reachable by the agent
• •Session files don't expire and enable prompt-injection attacks via crafted messages, making MTProto a deliberate choice not a default

Generated with AI, which can make mistakes.