{"id":"d387d91c-8724-4dd0-9f37-bde2b6f98209","slug":"flowgent-labs-telegram-mcp","kind":"mcp","name":"telegram-mcp","summary":"An enhanced Enterprise-grade Telegram MCP server.","owner":"flowgent-labs","repoUrl":"https://github.com/flowgent-labs/telegram-mcp","license":"Apache-2.0","licenseTier":"permissive","trust":"community","stars":1,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-07-15T15:42:14.000Z","addedAt":"2026-10-21T21:32:56.216Z","logoUrl":"https://avatars.githubusercontent.com/u/281867050?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["communication","cloud-infra"],"tags":[],"runtime":"go","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-26T09:13:22.196Z","sample":false,"url":"https://conduits.dev/tools/flowgent-labs-telegram-mcp","language":"Shell","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"<!-- Generated by https://github.com/flowgent-labs/mcpfather -->\n\n# telegram-mcp\n\n[![Go](https://img.shields.io/badge/go-1.26.0+-00ADD8?logo=go)](https://go.dev/)\n[![MCP](https://img.shields.io/badge/protocol-MCP-blue)](https://modelcontextprotocol.io/)\n[![Prometheus](https://img.shields.io/badge/metrics-Prometheus-E6522C?logo=prometheus)](https://prometheus.io/)\n[![OpenTelemetry](https://img.shields.io/badge/tracing-OTel-5C4EE5?logo=opentelemetry)](https://opentelemetry.io/)\n[![OIDC](https://img.shields.io/badge/auth-OIDC-CB3837?logo=openid)](https://openid.net/connect/)\n[![Helm](https://img.shields.io/badge/deploy-Helm-0F1689?logo=helm)](https://helm.sh/)\n\n> The Enterprise-grade MCP server generated by [mcpfather](https://github.com/flowgent-labs/mcpfather), specifically designed for AI to call Telegram MTProto API APIs, generated from MCPFather — exposes **395 native tools**. Each API operation becomes an AI-callable tool with typed schemas and customized aggregate virtual tools, auth forwarding, and observability built-in, and even use as regular CLI.\n\n## Quick Start\n\n```sh\nmake\n\n# Or with OpenTelemetry distributed tracing (gRPC or HTTP)\nmake build-with-otel-grpc   # OTLP gRPC exporter\nmake build-with-otel-http   # OTLP HTTP/protobuf exporter\n```\n\n### Start in `HTTP` mode (example)\n\n```sh\n# Configure your upstream API\nexport MCP__UPSTREAM__DEFAULT__ENDPOINT=https://api.example.com\nexport MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN=your-token\n\n./bin/telegram-mcp --transport http --port 8080 &\n```\n\n- Inspection MCP Server Authentication (OAuth2.1).\n\n```bash\nexport MCP__SERVER__AUTH__OIDC__ENABLED=true\nexport MCP__SERVER__AUTH__OIDC__ISSUER=\"https://keycloak.example.com/realms/master\"\nexport MCP__SERVER__AUTH__OIDC__AUDIENCE=\"telegram-mcp\"\n./bin/telegram-mcp -v 10 --transport http --port 8080\n\n# Obtain the OAuth2.1 metadata.\ncurl -s https://iam.example.com/realms/master/.well-known/openid-configuration\n\ncurl -s localhost:8080/.well-known/oauth-protected-resource\n#{\"resource\":\"telegram-mcp\",\"authorization_servers\":[\"https://keycloak.example.com/realms/master\"],\"bearer_methods_supported\":[\"header\"]}\n```\n\n### Run in `CLI` mode (example)\n\n```sh\n./bin/telegram-mcp -v 1 -t cli list\n./bin/telegram-mcp -v 1 -t cli <tool-name> [OPTIONS]\n```\n\n#### Request body (`--body`)\n\nUse `--body` to send a JSON request body to the upstream API. Query/path\nparameters are passed as regular `--key value` flags.\n\n```sh\n# JSON body\n./bin/telegram-mcp -v 1 -t cli uploadScanReport --scanId 12345 \\\n  --body '{\"note\":\"quarterly\"}'\n```\n\n#### File uploads (fileRef URL)\n\nFor file upload tools, pass file fields as normal tool arguments. Values starting\nwith `@file:///`, `@https://`, or `@http://` are fileRef URLs: the server downloads\nthe file to the TFS temp cache and forwards it to upstream. Other multipart\nfields are passed as regular `--key value` flags.\n\n```sh\n# Local file, for the conventional multipart field named \"file\"\n./bin/telegram-mcp -v 1 -t cli uploadScanReport --scanId 12345 \\\n  --file /tmp/report.pdf\n\n# Remote URL (server downloads, then forwards to upstream)\n./bin/telegram-mcp -v 1 -t cli uploadScanReport --scanId 12345 \\\n  --file @https://cdn.example.com/reports/q1.pdf\n\n# Named file field\n./bin/telegram-mcp -v 1 -t cli configSaml \\\n  --identityProviderXml @file:///tmp/idp.xml \\\n  --samlConfiguration '{\"enabled\":true}'\n```\n\nThe same flag syntax works in HTTP mode via `mcpclient.sh`:\n\n```sh\n./mcpclient.sh call uploadScanReport --scanId 12345 \\\n  --file /tmp/report.pdf\n```\n\n## Options\n\n| Flag | Default | Description |\n|------|---------|-------------|\n| `-t, --transport` | `stdio` | `stdio` / `http` / `cli` |\n| `-p, --port` | `8080` | HTTP server port |\n| `--metrics-port` | `0` | Override mgmt port (0 = use config) |\n| `-v, --verbose` | `0` | Log verbosity (0–10) |\n| `-V, --version` | — | Print version and exit |\n| `--print-default-config` | — | Print default config.yaml to stdout |\n\n## Authentication\n\nAuth is split into two independent layers — neither shares credentials with the other:\n\n| Layer | Config YAML path | Env var prefix | Role |\n|---|---|---|---|\n| **Server** | `server.auth.oidc` | `MCP__SERVER__AUTH__OIDC__*` | Validates AI agent bearer tokens (inbound) |\n| **Upstream OIDC** | `upstream.default.auth.oidc` | `MCP__UPSTREAM__DEFAULT__AUTH__OIDC__*` | Server's own OIDC client_credentials for upstream APIs |\n| **Upstream Static** | `upstream.default.auth.static` | `MCP__UPSTREAM__DEFAULT__AUTH__STATIC__*` | Server's own static token/cookie for upstream APIs |\n\n**Server (inbound)** — validates bearer tokens presented by AI agents (MCP clients).\nOnly applies to `--transport http`; stdio has no network boundary. Standard OIDC JWT\nbearer validation per RFC 9728 / MCP Authorization spec.\n\n**Upstream (outbound)** — credentials the MCP server uses to call upstream APIs.\nToken priority (first available wins):\n\n1. **OIDC** client_credentials grant (`upstream.default.auth.oidc.*`)\n2. **Static** web token (`upstream.default.auth.static.web_token`)\n\nThe AI agent's inbound token is **never** forwarded upstream (MCP spec: Token Passthrough Prohibition).\nCookie-based auth is also available via `upstream.default.auth.static.cookie_token`.\n\n## Configuration\n\nCreate `~/.telegram-mcp/config.yaml` (run `--print-default-config` for a full template):\n\n```yaml\n# ---- Server (inbound) ----\n# Validates bearer tokens presented by MCP clients (AI agents).\n# Resource Server role per RFC 9728 / MCP Authorization spec.\n# Only enforced on the http transport; stdio has no network boundary.\nserver:\n  # HTTP server timeouts in seconds. 0 = disabled.\n  # write_timeout_seconds must be 0 for SSE (Streamable HTTP) transport.\n  read_timeout_seconds: 30\n  write_timeout_seconds: 0\n  idle_timeout_seconds: 120\n  auth:\n    oidc:\n      enabled: false\n      issuer: \"\"            # e.g. https://idp.example.com/realms/myrealm\n      jwks_uri: \"\"          # optional override (auto-discovered from issuer if empty)\n      audience: \"\"          # expected JWT \"aud\" claim; also published as the RFC 9728 protected-resource identifier\n      # When true, validated JWT claims (sub, email) are forwarded upstream\n      # as X-MCP-Client-Token-Sub and X-MCP-Client-Token-Email headers.\n      enable_client_token_claim_forward: true\n      # Additional JWT claims to forward as X-MCP-Client-Token-<Header-Name> headers.\n      # e.g. [\"given_name\", \"family_name\", \"preferred_username\"]\n      # additional_client_token_claim_forward: []\n  # ---- Temporary File System (TFS) Data Plane ----\n  # Built-in REST API for binary file transfer, separate from the\n  # JSON-RPC 2.0 control plane at /mcp.\n  # Files stored under ~/.<service-name>/tfs/{download,upload}/\n  tfs:\n    enabled: true\n    # Empty means auto-detect from the inbound /mcp request Host/X-Forwarded-* headers.\n    base_uri: \"\"\n    # Download URLs are one-shot: after a successful GET from /_/tfs/download/{id},\n    # the temporary file is immediately removed. Files that are never downloaded\n    # are removed by the background clean job after this TTL.\n    clean-job-ttl-seconds: \"5m\"\n\nlogging:\n  level: 0\n  auth_verbose: false\n\n# ---- Upstream (outbound) ----\n# Credentials the server uses to call upstream APIs.\n# The two auth layers are independent — the inbound token is never reused outbound\n# (see MCP Authorization spec: Token Passthrough Prohibition).\nupstream:\n  default:\n    endpoint: \"\"               # upstream API base URL (e.g. https://api.example.com)\n    enable_mcp_session_forward: true\n    auth:\n      oidc:\n        enabled: true\n        issuer: https://idp.example.com/realms/myrealm\n        client_id: my-client\n        client_secret: \"${MCP__UPSTREAM__DEFAULT__AUTH__OIDC__CLIENT_SECRET}\"\n        scopes: openid\n        # token_url: \"\"   # auto-discovered from issuer /.well-known\n\n      # Static credentials for legacy / simple APIs\n      static:\n        web_token: \"${MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN}\"   # or set cookie_token\n\n# Reusable policies selected by HTTP-node `spec.pool` and `spec.retry`.\n# Omitted references use pool limits 32/32/32, request_timeout 0s, and 0 retries.\nmiddleware:\n  http_client_pool:\n    large:\n      max_idle_conns: 128          # reusable idle connections across all upstream hosts\n      max_idle_conns_per_host: 32  # reusable idle connections retained per upstream host\n      max_conns_per_host: 64       # hard cap: active + dialing + idle connections per host\n      dial_timeout: 10s            # TCP connection establishment timeout\n      request_timeout: 60s         # complete attempt, including response-body reads\n    medium:\n      max_idle_conns: 64\n      max_idle_conns_per_host: 16\n      max_conns_per_host: 32\n      dial_timeout: 5s\n      request_timeout: 30s\n    small:\n      max_idle_conns: 16\n      max_idle_conns_per_host: 4\n      max_conns_per_host: 8\n      dial_timeout: 3s\n      request_timeout: 15s\n  retry:\n    reliable:\n      max_retries: 4               # extra attempts after the first request\n      max_elapsed_time: 30s        # hard budget for all attempts and backoff\n    standard:\n      max_retries: 2\n      max_elapsed_time: 15s\n    besteffort:\n      max_retries: 0               # no automatic retry; max_elapsed_time is unnecessary\n\n# QoS-style names communicate retry intent without promising application success.\n\nnative_tools:\n  expose:\n    register_all_tools_by_default: true   # expose all native tools\n    # includes: [Tool1, Tool2]            # or whitelist specific tools\n    # excludes: [Tool3]                   # hide noisy tools\n```\n\nAll values can be set via `MCP__`-prefixed environment variables (e.g. `MCP__UPSTREAM__DEFAULT__AUTH__OIDC__CLIENT_ID`).\n\n## Management — Metrics, Tracing, Pprof\n\n```yaml\nmgmt:\n  enabled: true\n  host: 0.0.0.0\n  port: 9991\n\n  otel:\n    enabled: false\n    endpoint: localhost:4317\n    protocol: grpc\n    sample_rate: 1.0\n\n  metrics:\n    enabled: true\n    prometheus: true\n    export_interval: 30s\n\n  pprof:\n    enabled: false\n    server_bind: 0.0.0.0:6669\n```\n\n```sh\n./bin/telegram-mcp --transport http --port 8080\ncurl http://localhost:9991/metrics    # Prometheus endpoint\ncurl http://localhost:9991/health     # health check\n```\n\nTrace spans are named `mcp.tool.<name>`. W3C `traceparent` is propagated to upstream calls.\n\n## Available Tools (395)\n\n| Tool | Description |\n|------|-------------|\n| `AccountAcceptauthorization` | Invoke account.acceptAuthorization - MTProto RPC method: account.acceptAuthorization  Returns: Bool |\n| `AccountCancelpasswordemail` | Invoke account.cancelPasswordEmail - MTProto RPC method: account.cancelPasswordEmail  Returns: Bool |\n| `AccountChangephone` | Invoke account.changePhone - MTProto RPC method: account.changePhone  Returns: User |\n| `AccountCheckusername` | Invoke account.checkUsername - MTProto RPC method: account.checkUsername  Returns: Bool |\n| `AccountConfirmpasswordemail` | Invoke account.confirmPasswordEmail - MTProto RPC method: account.confirmPasswordEmail  Returns: Bool |\n| `AccountConfirmphone` | Invoke account.confirmPhone - MTProto RPC method: account.confirmPhone  Returns: Bool |\n| `AccountCreatetheme` | Invoke account.createTheme - MTProto RPC method: account.createTheme  Returns: Theme |\n| `AccountDeclinepasswordreset` | Invoke account.declinePasswordReset - MTProto RPC method: account.declinePasswordReset  Returns: Bool |\n| `AccountDeleteaccount` | Invoke account.deleteAccount - MTProto RPC method: account.deleteAccount  Returns: Bool |\n| `AccountDeletesecurevalue` | Invoke account.deleteSecureValue - MTProto RPC method: account.deleteSecureValue  Returns: Bool |\n| `AccountFinishtakeoutsession` | Invoke account.finishTakeoutSession - MTProto RPC method: account.finishTakeoutSession  Returns: Bool |\n| `AccountGetaccountttl` | Invoke account.getAccountTTL - MTProto RPC method: account.getAccountTTL  Returns: AccountDaysTTL |\n| `AccountGetallsecurevalues` | Invoke account.getAllSecureValues - MTProto RPC method: account.getAllSecureValues  Returns: Vector<SecureValue> |\n| `AccountGetauthorizationform` | Invoke account.getAuthorizationForm - MTProto RPC method: account.getAuthorizationForm  Returns: account.AuthorizationForm |\n| `AccountGetauthorizations` | Invoke account.getAuthorizations - MTProto RPC method: account.getAuthorizations  Returns: account.Authorizations |\n| … | *380 more tools not shown* |\n\n## Virtual Tools\n\nCompose native tools via a declarative pipeline DSL:\n\n```yaml\nvirtual_tools:\n  - name: MyVirtualTool\n    description: Chain multiple native tools together\n    input_schema:\n      type: object\n      properties:\n        appId: { type: string }\n      required: [appId]\n    pipeline:\n      - id: getApp\n        kind: call\n        spec: { tool: GetApplication, args: { applicationId: \"$input.appId\" } }\n      - id: appName\n        kind: jq\n        spec: { from: \"$getApp\", expr: .name }\n      - id: done\n        kind: return\n        spec: { from: \"$appName\" }\n```\n\nPipeline kinds: `call`, `jq`, `foreach`, `emit`, `return`.\n\n## Agent Integration\n\n### OpenCode\n\n- `~/.config/opencode/opencode.json`:\n\n```json\n{\n  \"mcp\": {\n    \"telegram-mcp\": {\n      \"type\": \"local\",\n      \"command\": [\"bash\", \"-c\", \"/path/to/telegram-mcp\"],\n      \"args\": [\"--transport\", \"stdio\"],\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      },\n      \"enabled\": true\n    }\n  }\n}\n```\n\n### Claude Code\n\n- `~/.claude.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"telegram-mcp\": {\n      \"command\": \"/path/to/telegram-mcp\",\n      \"args\": [\"--transport\", \"stdio\"],\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      }\n    }\n  }\n}\n```\n\n### Codex CLI\n\n- `~/.codex/config.toml`:\n\n```toml\n[mcp_servers.telegram-mcp]\nurl = \"http://localhost:8080/mcp\"\nweb_token_env_var = \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\"\n```\n\n### Cursor\n\n- `~/.cursor/mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"telegram-mcp\": {\n      \"command\": \"/path/to/telegram-mcp\",\n      \"args\": [\"--transport\", \"stdio\"],\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      }\n    }\n  }\n}\n```\n\n### OpenCode (Remote)\n\n- `~/.config/opencode/opencode.json`:\n\n```json\n{\n  \"mcp\": {\n    \"telegram-mcp\": {\n      \"type\": \"remote\",\n      \"url\": \"http://localhost:8080/mcp\",\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      }\n    }\n  }\n}\n```\n\n### Claude Code (Remote)\n\n- `~/.claude.json` (User MCPs):\n\n```json\n{\n  \"mcpServers\": {\n    \"telegram-mcp\": {\n      \"url\": \"http://localhost:8080/mcp\",\n      \"env\": {\n        \"MCP__UPSTREAM__DEFAULT__ENDPOINT\": \"https://api.example.com\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\": \"your-token\",\n        \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN_FILE\": \"/path/to/fallback/.credentials\"\n      }\n    }\n  }\n}\n```\n\n### Codex CLI (Remote)\n\n- `~/.codex/config.toml`:\n\n```toml\n[mcp_servers.telegram-mcp]\nurl = \"http://localhost:8080/mcp\"\nweb_token_env_var = \"MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN\"\n```\n\n### Cursor (Remote)\n\n- `~/.cursor/mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"telegram-mcp\": {\n      \"url\": \"http://localhost:8080/mcp\"\n    }\n  }\n}\n```\n\n## Deployment — Docker\n\n### Build\n\n```sh\nmake build-image\n```\n\nOr manually:\n\n```sh\ndocker build -t ghcr.io/<YOUR_ORG>/telegram-mcp:latest -f deploy/docker/Dockerfile .\ndocker push ghcr.io/<YOUR_ORG>/telegram-mcp:latest\n```\n\n### Run\n\nPull the pre-built image from GitHub Container Registry:\n\n```sh\ndocker pull ghcr.io/<YOUR_ORG>/telegram-mcp:latest\n```\n\nFirst generate a default config, then mount it when running:\n\n```sh\n  docker run --rm ghcr.io/<YOUR_ORG>/telegram-mcp:latest --print-default-config > ~/.telegram-mcp/config.yaml\n```\n\n- **Static web token**\n\n```sh\n  docker run -d --name telegram-mcp \\\n    -p 8080:8080 -p 9991:9991 \\\n    -e MCP__UPSTREAM__DEFAULT__ENDPOINT=\"https://api.example.com\" \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__STATIC__WEB_TOKEN=\"YOUR_WEB_TOKEN\" \\\n    -v ~/.telegram-mcp:/home/mcp/.telegram-mcp \\\n    ghcr.io/<YOUR_ORG>/telegram-mcp:latest \\\n    --transport http --port 8080\n  ```\n\n- **OIDC upstream auth**\n\n```sh\n  docker run -d --name telegram-mcp \\\n    -p 8080:8080 -p 9991:9991 \\\n    -e MCP__UPSTREAM__DEFAULT__ENDPOINT=\"https://api.example.com\" \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__OIDC__ENABLED=true \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__OIDC__ISSUER=\"https://idp.example.com/realms/myrealm\" \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__OIDC__CLIENT_ID=\"my-client\" \\\n    -e MCP__UPSTREAM__DEFAULT__AUTH__OIDC__CLIENT_SECRET=\"YOUR_CLIENT_SECRET\" \\\n    -v ~/.telegram-mcp:/home/mcp/.telegram-mcp \\\n    ghcr.io/<YOUR_ORG>/telegram-mcp:latest \\\n    --transport http --port 8080\n  ```\n\n### Test with mcpclient.sh\n\nAfter the container starts, use the bundled `mcpclient.sh` to verify.\n\n> **Note:** `mcpclient.sh` only supports **upstream static** token auth. If the server requires\n> **server OIDC** authentication, use a real AI-agent MCP client instead.\n\n```sh\n# Point to the mapped host port (include /mcp path)\nexport MCP_SERVER_ENDPOINT=http://localhost:18080/mcp\n# Call any tool (example: AccountAcceptauthorization)\n./mcpclient.sh call AccountAcceptauthorization --param value\n# List all available tools\n./mcpclient.sh list-tools\n```\n\n> **Tip:** Map the host config directory for persistent configuration:\n> `-v ~/.telegram-mcp:/home/mcp/.telegram-mcp`\n\n## Deployment — Kubernetes (Helm)\n\n\nFirst generate a default config, then mount it when running:\n\n```sh\n  docker run --rm ghcr.io/<YOUR_ORG>/telegram-mcp:latest --print-default-config > ~/.telegram-mcp/config.yaml\n```\n\n- **Static web token**\n\n```sh\n  helm upgrade -i telegram-mcp deploy/helm \\\n    --set image.repository=ghcr.io/<YOUR_ORG>/telegram-mcp \\\n    --set image.tag=latest \\\n    --set secret.static.create=true \\\n    --set secret.static.webToken=\"YOUR_WEB_TOKEN\" \\\n    --set config.upstream.default.endpoint=\"https://api.example.com\"\n  ```\n\n- **OIDC authentication**\n\n```sh\n  helm upgrade -i telegram-mcp deploy/helm \\\n    --set image.repository=ghcr.io/<YOUR_ORG>/telegram-mcp \\\n    --set image.tag=latest \\\n    --set secret.static.create=true \\\n    --set secret.static.oidcClientSecret=\"YOUR_OIDC_CLIENT_SECRET\" \\\n    --set config.upstream.default.auth.oidc.enabled=true \\\n    --set config.upstream.default.auth.oidc.issuer=\"https://idp.example.com\" \\\n    --set config.upstream.default.auth.oidc.client_id=\"my-client\" \\\n    --set config.upstream.default.endpoint=\"https://api.example.com\"\n  ```\n\nSee `deploy/helm/values.yaml` for all configurable parameters.\n\n## Contributing\n\nWe welcome contributions! Here's how you can help:\n\n1. **Fork** the repository and create a feature branch\n2. **Make your changes** — add features, fix bugs, or improve documentation\n3. **Add tests** — every new feature or bug fix should include unit tests\n4. **Run the test suite** — `make test` must pass with no regressions\n5. **Submit a Pull Request** — describe what you changed and why\n\n### Development Setup\n\n```sh\ngit clone https://github.com/<YOUR_ORG>/telegram-mcp.git\ncd telegram-mcp\nmake build\nmake test-ut\n```\n\n### Code Style\n\n- Follow standard Go conventions (`go fmt`, `go vet`)\n- Keep functions small and focused\n- Write clear commit messages\n\nPlease read [CONTRIBUTING.md](CONTRIBUTING.md) for detailed guidelines and our [Code of Conduct](CODE_OF_CONDUCT.md).\n\n## License\n\nThis generated MCP server project is licensed under the Apache License 2.0 —\nsee the [LICENSE](LICENSE) file for details.\n\nThe Apache-2.0 license is intentionally permissive for generated server\noutput: commercial use, internal enterprise deployment, modification,\nredistribution, and proprietary integration are allowed subject to the Apache\nLicense 2.0 terms. This generated project is not subject to mcpfather's AGPL\nlicense obligations solely because it was generated by mcpfather.\n\n## Contact\n\nFor questions, suggestions, or support:\n\n- **GitHub Issues**: [Create an issue](../../issues)\n- **Discussions**: [Start a discussion](../../discussions)\n- **Email**: <jameswong1376@gmail.com>\n\n## Acknowledgments\n\nThis MCP server was generated by [MCPFather](https://github.com/flowgent-labs/mcpfather), an enterprise-grade OpenAPI-to-MCP code generator.\n\nBuilt with these excellent open-source projects:\n\n- [mcp-go](https://github.com/mark3labs/mcp-go) — Go SDK for the Model Context Protocol\n- [OpenTelemetry](https://opentelemetry.io/) — observability framework for metrics and tracing\n- [Prometheus](https://prometheus.io/) — metrics collection and alerting\n- [Viper](https://github.com/spf13/viper) — Go configuration management\n- [go-jq](https://github.com/itchyny/gojq) — Pure Go implementation of jq\n- [Keycloak](https://www.keycloak.org/) — Open Source Identity and Access Management\n"}