telegram-bot-api

Rules for implementing and validating methods in a Kotlin Telegram Bot API library. The Telegram Bot API is the set of methods that bots use to send messages, upload files, and perform other actions.

In plain words
What is it for?
Use it when adding API actions, naming methods, excluding items from validation, uploading files, or transforming request data before sending it.
Why use it?
It explains how to map library code to Telegram's API and how to handle files and request-time changes correctly. This reduces mismatches between the library and Telegram.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/vendelieu/telegram-bot/telegram-bot-api
Clone the repo
git clone --depth 1 https://github.com/vendelieu/telegram-bot

Made for: Cursor.

Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 1,114 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01114
Opus 5 $0.00000 $0.00557
Sonnet 5 $0.00000 $0.00223
Haiku 4.5 $0.00000 $0.00111

Measured 2d ago against content hash 9df1ea7e2127, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

telegram-bot-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/telegram-bot-api.mdc · 99 lines

How it starts

The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Telegram Bot API Rules

TgAPI Annotation

  • Mark Action classes and top-level API functions with @TgAPI (required for api-sentinel validation)
  • Use @TgAPI.Name("methodName") on the method property when the Kotlin name differs from the Telegram API method (e.g. sendMessage vs message)
  • Use @TgAPI.Ignore on params/classes to exclude from validation

beforeReq

  • protected open val beforeReq = {} runs right before the request (in doRequest / doRequestReturning)
  • Override when you need to process data at request time (e.g. multipart, transform files)
  • Use for: uploading files from Options (thumbnail, certificate), transforming nested ImplicitFile in complex types (InputProfilePhoto, InputStoryContent)
  • beforeReq runs after init; it has access to parameters, multipartData, and options
override val beforeReq: () -> Unit = {
    handleImplicitFile(options::thumbnail)  // optional file from Options
}

ImplicitFile Handling

  • ImplicitFile = FileId (String file_id) or FileData (InputFile for upload)
  • Use handleImplicitFile(file, "paramName") in init for required media params
  • For optional media in Options (thumbnail, cover): handleImplicitFile(options::thumbnail) in beforeReq
  • transform(multipartData): FileData -> uploads to multipart, returns FileId with attach://filename
  • Convert: String.toImplicitFile(), InputFile.toImplicitFile(), ByteArray.toImplicitFile("name.ext")
  • Complex types (InputProfilePhoto, InputStoryContent): use file.transform(multipartData) in beforeReq, then replace file with result and encode

Action Hierarchy

  • TgAction (base) -> Action (chat-based: send(to, via)) or SimpleAction (no chat: send(via))
  • Use Action when the method requires chat_id (messages, media, etc.)
  • Use SimpleAction when no chat context (getMe, getUpdates, setWebhook, etc.)
  • MediaAction extends Action; overrides entitiesFieldName = "caption_entities"
  • Extensions: BusinessActionExt (business connection), InlineActionExt (inline message ID)

Read the full file on GitHub · 99 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 99 lines · 1,114 tokens per session scan A 9df1ea7e2127

Subscribe to this mod's changes

telegram-bot-api is a cursor rule published in the GitHub repository vendelieu/telegram-bot (248 stars, last pushed 5d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,114 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.