Agent ReachoutSAFE
Let Claude Code reach you on Telegram when it finishes work or needs decisions
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Let your Claude Code message you on Telegram when it needs decisions or finishes work, even when you’re away from your desk.
Claude Code → Agent Reachout → Telegram → Human reply → Agent continues
Why?
AI agents are great at doing work, but real workflows still need human judgment.
In practice, agents:
- hit ambiguous decisions
- need approval before destructive actions
- finish long tasks while you’re not watching the terminal
Dashboards assume you go check them. Messaging flips the model — the agent comes to you only when needed.
Agent Reachout turns agent workflows into something asynchronous and interrupt-driven, without babysitting the CLI.
What it does
- Sends notifications to Telegram when an agent:
- finishes a task
- hits a blocker
- needs a decision
- Supports one-way notifications or two-way conversations
- Lets the agent pause → ask → resume
- Designed for human-in-the-loop agent workflows
Currently implemented as a Claude Code plugin.
Why Telegram first?
This started as a personal workflow tool, not a team platform.
Telegram was chosen because:
- it’s already on my phone
- fast setup and low friction
- feels like a push notification, not another dashboard
- works well for solo devs and small setups
The concept is channel-agnostic — Telegram is just the first integration.
What it’s not
- Not a workflow engine
- Not a chatbot framework
- Not a full agent orchestration system
It’s a small bridge between agents and humans.
Use cases
- Approving file changes or deletions
- Answering clarification questions mid-task
- Getting notified when long-running tasks complete
- Running agents asynchronously without monitoring logs
Installation
Prerequisites
- Claude Code CLI installed
- Bun installed (https://bun.com/
a67ae13a6d6dOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agent-reachout --env AGENT_REACHOUT_TELEGRAM_BOT_TOKEN=${AGENT_REACHOUT_TELEGRAM_BOT_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"agent-reachout": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"AGENT_REACHOUT_TELEGRAM_BOT_TOKEN": "${AGENT_REACHOUT_TELEGRAM_BOT_TOKEN}"
}
}
}
}Exposed tools (4)
0 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
continue_conversation | write | Send follow-up message in existing conversation and wait for response |
end_conversation | write | Send final message and end conversation |
notify_user | write | Send one-way notification (no response expected) |
send_message | write | Send a message to user and optionally wait for response |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
console.log("Telete token", token)@modelcontextprotocol/sdk, node-telegram-bot-api, @types/bun, @types/node-telegram-bot-api
Gates applied: no_behavioural_pass.
a67ae13a6d6dfull audit observations/trust-audit/mcp-server/vibe-with-me-tools__agent-reachout.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | a67ae13a6d6d | SAFE | B | 89 | first audit |
Questions
What is the Agent Reachout MCP server?
Let Claude Code reach you on Telegram when it finishes work or needs decisions
What tools does Agent Reachout expose?
4 in total: 0 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Agent Reachout safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Agent Reachout need?
It reads AGENT_REACHOUT_TELEGRAM_BOT_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Agent Reachout run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as agent-reachout at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (a67ae13a6d6d), read on 2026-10-08. The repository is watched and re-audited when it changes.