October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk5 min

I Built a Telegram AI Agent That Can Actually Use Tools

Hexzie’s author describes a Telegram AI assistant that routes model tool requests through a Node.js/Telegraf backend and Go runner, with important caveats around group privacy and host access.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Hexzie (also called HexTelegram) is a Telegram AI assistant project designed to do more than generate replies: its application can pass tool definitions to a model, execute requested tools, and return their results for the model to use. In the author’s account, Telegram is the chat interface, Node.js and Telegraf handle the bot and orchestration, and a separate Go runner handles lower-level system and web tools. The project is actively in development; these are author-reported design and feature claims, not an independent code or security review.

How can a Telegram AI agent use tools?

A Telegram bot does not gain the ability to run code just because it uses an AI model. Tool use is an application-managed exchange: the application tells the model which tools are available, receives a request to use one, runs the corresponding code, and sends the result back so the model can continue. OpenAI’s function-calling guide describes this general pattern. The application—not the model—defines and executes the tool implementations.

As an Amazon Associate I earn from qualifying purchases.

  1. Receive a Telegram update. Telegram delivers a message to the bot’s backend.
  2. Build context and ask the model. The application applies its authentication and conversation logic, then sends the relevant conversation and tool definitions to the model API.
  3. Dispatch any requested tool. If the model requests a tool, application code routes it to an implementation, such as a Telegram-specific handler or a separate runner.
  4. Return the result to the model. The application adds the tool output to the conversation and asks the model to continue. The model can then answer or request another tool.
  5. Send the response to Telegram. The backend returns the final answer through Telegram’s API.

The Hexzie article says its agent permits up to eight rounds of this exchange. That is a reported project configuration, not a limit imposed on all AI agents or a performance measure.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What Hexzie’s architecture and tools include

In the author’s described design, Node.js with Telegraf receives and orchestrates Telegram interactions, while a Go tool runner handles lower-level system and web tools. That split is one implementation choice; a Telegram agent could use other runtimes or keep its tools in one process.

The project article reports these tool categories and features. They have not been independently validated here, and an active-development project may change:

  • System and file operations: shell execution, file reading and writing, and directory listing.
  • Web and utility operations: search and fetch, website checks, screenshots, time, calculator, and system information.
  • Telegram actions: sending, editing, deleting, forwarding, and pinning messages, as well as sending documents or photos.
  • Conversation handling: streaming progress messages, recent per-chat history with summaries for older turns, cancellation of stale requests, and API endpoint failover.

The account also describes group triggers such as commands, prefixes, mentions, and replies. These are application behaviors, not evidence that Telegram sends every group message to the bot.

Rank #2
MixPad Free Multitrack Recording Studio and Music Mixing Software [Download]
  • Create a mix using audio, music and voice tracks and recordings.
  • Customize your tracks with amazing effects and helpful editing tools.
  • Use tools like the Beat Maker and Midi Creator.
  • Work efficiently by using Bookmarks and tools like Effect Chain, which allow you to apply multiple effects at a time
  • Use one of the many other NCH multimedia applications that are integrated with MixPad.

What Telegram provides—and what the backend must do

Telegram is the messaging interface, not the agent’s execution environment. The bot needs backend code to receive updates, apply the application’s logic, call a model, and make Bot API requests. Telegram’s Bot FAQ explains the bot-to-backend model, and its Bot API accepts HTTPS requests in the form https://api.telegram.org/bot<token>/METHOD_NAME.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

To create a bot, Telegram directs users to @BotFather, which issues a token. Telegram warns that anyone who has the token can control the bot, so keep it private and share it only with people who need access.

Group privacy controls which messages arrive

Telegram’s group privacy rules mean a privacy-enabled bot does not receive a full stream of ordinary group conversation by default. Telegram says administrators and bots with privacy mode disabled receive a broader set of messages, subject to exceptions. Only after Telegram delivers an update can the application decide whether it matches a project trigger. Put simply: Telegram determines which updates reach the bot; the project’s trigger logic determines which received updates start the agent.

Why shell access changes the risk

A model-requested tool call can have real consequences when application code connects it to a host operation. The Hexzie author says the shell and filesystem tools can access paths from / by default and writes: “That is extremely powerful and also extremely dangerous.” The author describes user-ID allowlisting, owner-only management commands, and optional controls including a configured working directory, timeout, output-length limit, and blocked command patterns. The account also says only the owner and explicitly allowed users can use the bot.

Rank #4
MixPad Multitrack Recording Software for Sound Mixing and Music Production Free [Mac Download]
  • Mix an audio, music and voice tracks
  • Record single or multiple tracks simultaneously
  • Intuitive tools to split, trim, join, and many other editing features
  • Loaded with audio effects including EQ, compression, reverb, and more.
  • Load an audio file and export to all popular audio formats from studio quality wav to high compression formats

These are controls reported by the project author, not proof of a secure sandbox. The available material does not establish an independent security audit, threat model, or test results. A working-directory setting or blocked-command pattern should not be treated as a guarantee that arbitrary shell access cannot harm the host.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Do not expose a tool-enabled bot to users who should not be able to invoke its tools; use narrow access controls and review who can administer it.
  • Keep Telegram and model API credentials out of public code and logs. In particular, possession of the Telegram token gives someone control of the bot.
  • Prefer narrowly scoped tool implementations over broad shell or filesystem access when the task allows it. The project account does not establish how effectively its controls constrain host access.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Which design choices are still open?

The project account documents choices, not a measured comparison of alternatives. If you are building a similar bot, treat these as decisions to make for your deployment rather than proven winners:

  • Runtime: Node.js and Telegraf are the author’s choice; other Telegram bot runtimes are possible.
  • Tool execution: a separate Go runner can divide orchestration from lower-level tools, while a single-process design avoids that split. The available account provides no benchmark to establish which is better.
  • Update delivery: polling and webhooks are alternative ways to receive updates; the cited project account does not provide an empirical comparison.
  • Tool scope: task-specific tools can limit what the application is able to do, whereas broad shell and filesystem access increase the potential consequences of a mistake or misuse.

The project is described as being in active development. Its feature list should therefore be read as the author’s account of the project, not a guarantee of stable availability. Telegram and OpenAI documentation explain the platform and tool-calling mechanism; neither verifies Hexzie’s implementation.

Quick Recap

Bestseller No. 2
MixPad Free Multitrack Recording Studio and Music Mixing Software [Download]
MixPad Free Multitrack Recording Studio and Music Mixing Software [Download]
Create a mix using audio, music and voice tracks and recordings.; Customize your tracks with amazing effects and helpful editing tools.
Bestseller No. 4
MixPad Multitrack Recording Software for Sound Mixing and Music Production Free [Mac Download]
MixPad Multitrack Recording Software for Sound Mixing and Music Production Free [Mac Download]
Mix an audio, music and voice tracks; Record single or multiple tracks simultaneously; Intuitive tools to split, trim, join, and many other editing features

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.