M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
S

Slack MCP Server

Community
Slack for your AI agent — session tokens, not OAuth. 21 tools, no admin approval.
How to install ↓ Compare GitHub source repository ↗
Category
Collaboration #20 of 55
Stars
★ 32 Popular
Transport
stdio (local process) · Streamable HTTP
Runtime
Node.js 20+ · Docker
Credentials
API key / credential required
License
MIT
Last commit
Tools
21
57FMRS · C

An honest, well-documented unofficial Slack MCP server that sidesteps OAuth approval via browser session tokens, with 21 tools spanning read, write, and workflows. Security practices (chmod 600, Keychain storage, npm provenance signing) are solid. Main caveats: terms-of-service gray area and the 1–2 week token rotation.

Strongest · Documentation 16/20 Weakest · Reliability 8/20

Reliability
8/20
Security and permissions
8/20
Maintenance
13/20
Documentation
16/20
Setup experience
12/20
Why each score
Reliability 8/20
Only the README and server.json were supplied — no actual CI workflow file content or committed test code was provided, only a CI badge as a claimed signal that cannot be independently verified here. The Contributing section only asks contributors to run `node --check` (syntax-only) on touched files, with no mention of a unit or integration test suite, so the key paths (token extraction, four-layer fallback, Chrome decryption, write-path tools) lack verifiable automated coverage. The tool table is internally consistent and the manifest version matches the npm package version, with no contradictions found. Per the static calibration rule, reliability cannot exceed 12 without verifiable CI+test evidence, so it is scored 8.
Security and permissions 8/20
The server's core mechanism extracts and decrypts the user's own Slack session tokens (xoxc-/xoxd-) from local Chrome storage (LevelDB, cookie SQLite) using a Keychain-derived key — this automates the user's own already-authenticated session rather than stealing a third party's credentials, and the docs disclose this fairly candidly (the 'Is this against Slack's terms?' FAQ). Credential storage shows some good practice: chmod 600 token file, atomic writes, mutex-locked concurrent refresh, an optional macOS Keychain-only mode claiming zero plaintext on disk, and fail-closed behavior on an unrecognized storage mode. However, real gaps remain: the four write-path tools (send message, add/remove reaction, mark read) rely solely on the MCP 'destructive' annotation to signal risk to the client — the server itself describes no enforced confirmation step or rate limiting, so actual gating depends entirely on client behavior; the optional hosted 'brain' sends workspace data to a third-party domain (mcp.revasserlabs.com) with no data-handling detail available in the supplied material; and the project markets 'invisible to admins / no approval needed' as a selling point, which objectively bypasses normal organizational oversight even though it claims not to affect backend compliance exports. No red-line issue was found (no malware, no covert exfiltration, no real secrets in examples, no unconfirmed irreversible default actions), so it does not fall into the 0-4 band, but confirmation and scope controls are incomplete, warranting a score of 8.
Maintenance 13/20
The repo is MIT-licensed and not archived; the npm package ships with provenance signing, and a 5.0.0 version number indicates multiple iterations. The README credits an external contributor's patch (#143 by @rvandam, landed in 4.4.0), showing some community contribution and version tracking. However, the supplied material contains no concrete commit dates, release history, or issue-response-time evidence, and the contribution guidance is minimal (just run node --check). Overall scored 13.
Documentation 16/20
The README itself is thorough, covering installation (config snippets for 8 clients), a full table of the 21 tools with safety annotations, the four-layer token storage fallback, how Chrome extraction works, multi-workspace setup, token-expiry handling, and rate/pricing details, with links to layered docs (SETUP.md, API.md, ARCHITECTURE.md, TROUBLESHOOTING.md, etc.). Documentation quality is generally high, with concrete examples and disclosed limitations (e.g., no auto-refresh on Windows/Linux, extra payload cost of rich_message_fields). However, since only the README text was provided and not the content of these referenced sub-documents, their accuracy could not be verified in this static review, warranting some deduction. Scored 16.
Setup experience 12/20
The installation flow is described concisely (a single npx command plus per-client config snippets), covers most mainstream clients plus Docker, and shows a versioned CI badge. However, the static calibration rule caps setup at 15 without verifiable CI/test evidence backing the execution path. Setup is also fragmented across platforms: automatic token extraction and refresh work only on macOS with Chrome, while Windows/Linux users must manually obtain and paste xoxc-/xoxd- tokens into config, adding real-world complexity and failure points. Scored 12.

Static review · not runListed 2026-09-07

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account data

Best for

  • Developers blocked by OAuth app registration or admin approval
  • Users across Claude Code, Cursor, Copilot, Windsurf, Gemini CLI, and Codex CLI
  • Self-hosters who want tokens and data kept local

Not for

  • Workspaces whose acceptable-use policy forbids unofficial clients (consider the OAuth hosted tier)
  • Compliance-sensitive environments uncomfortable reusing personal browser session credentials
  • Teams needing official Slack support (not affiliated with Slack Technologies)

Required permissions

  • Requires Slack browser session token (xoxc-) and cookie (xoxd-); the agent's footprint equals your browser session exactly
  • On macOS, Chrome auto-extraction reads Chrome's local LevelDB and the Chrome Safe Storage key from the Keychain
  • Write tools (send, react, mark read) carry MCP destructive annotations so clients can gate them

Risks and side effects

  • Automating your own session is a gray area under Slack's terms — this is an unofficial client
  • No app install appears in the admin panel, but traffic is still subject to workspace compliance exports, DLP, and retention
  • Session tokens expire roughly every 1–2 weeks, requiring re-extraction or the hosted OAuth tier
  • Tokens equate to your full Slack session; a leak means a session leak

Setup

Before you start

Runtime：Node.js 20+ · Docker

SLACK_TOKEN optionalsecret
SLACK_COOKIE optionalsecret
SLACK_MCP_HTTP_AUTH_TOKEN optionalsecret
Other optional settings (5)
SLACK_MCP_TOKEN_STORAGE optional
SLACK_MCP_PROFILE optional
SLACK_MCP_CHROME_PROFILE optional
SLACK_MCP_HTTP_ALLOWED_ORIGINS optional
SLACK_MCP_NO_UPSELL optional

Requires Node.js 20+. Run npx -y @jtalk22/slack-mcp --setup to extract and validate tokens; register in your client config (e.g. Claude Desktop's claude_desktop_config. with {"mcpServers":{"slack":{"command":"npx","args":["-y","@jtalk22/slack-mcp"]}}}), restart the client, then call slack_health_check to verify. On macOS, tokens auto-extract from Chrome; elsewhere pass SLACK_TOKEN (xoxc-) and SLACK_COOKIE (xoxd-) via env. A Docker image (ghcr.io/jtalk22/slack-mcp-server) is also available.

.mcp.json 
{"mcpServers":{"slack":{"command":"npx","args":["-y","@jtalk22/slack-mcp"]}}}

Shown for Claude Code. Other clients may use a different file or key (VS Code uses "servers") — the configurator below converts it.

.vscode/mcp.json
{
  "servers": {
    "slack": {
      "command": "npx",
      "args": [
        "-y",
        "@jtalk22/slack-mcp"
      ]
    }
  }
}

Goes in your project's .vscode/mcp.json (VS Code uses a "servers" key).

Terminal
claude mcp add slack -- npx -y @jtalk22/slack-mcp

Run it in a terminal; replace any <…> placeholders with your own values first.

Generate and validate client config

Check that it works

Register the server with your client, restart it, then ask your agent to run slack_health_check — a workspace name in the reply means you're live.

Troubleshooting

  1. Tokens expired: re-run npx -y @jtalk22/slack-mcp --setup, or use slack_refresh_tokens on macOS
  2. DMs not showing: call slack_list_conversations with discover_dms=true
  3. Client not seeing tools: check config JSON syntax and fully restart the client (MCP servers snapshot at launch)
  4. Chrome extraction failures: check named failure codes (keychain_timeout, no_slack_cookie_row, cookie_decrypt_failed, etc.)

Things to try

Once connected, you can ask your AI assistant things like:

  • List all my channels and DMs with unread messages
  • Search the workspace for messages about the project deadline and summarize the key discussion
  • Add a 👍 reaction to the latest message in #general
  • Save a workflow profile of kind exec_bound... actually exec_brief bound to my chosen channels

Tools 21

slack_health_check read-only
Verify token validity and workspace info
slack_token_status read-only
Token age, health, and cache stats (read-only)
slack_refresh_tokens read-only
Auto-extract fresh tokens from Chrome (writes local token file only)
slack_list_conversations read-only
List DMs and channels
slack_conversations_history read-only
Get messages from a channel or DM (supports rich message fields)
slack_get_full_conversation read-only
Export full history with threads (supports rich message fields)
slack_search_messages read-only
Search across the workspace (supports rich message fields)
slack_get_thread read-only
Get thread replies (supports rich message fields)
Show 13 more tools
slack_users_info read-only
Get user details
slack_list_users read-only
List workspace users (paginated, 500+)
slack_users_search read-only
Search users by name, display name, or email
slack_conversations_unreads read-only
Get channels/DMs with unread messages
slack_send_message destructive
Send a message to any conversation (destructive)
slack_add_reaction destructive
Add an emoji reaction to a message (destructive)
slack_remove_reaction destructive
Remove an emoji reaction from a message (destructive)
slack_conversations_mark destructive
Mark a conversation as read (destructive)
slack_workflow_save writes
Save a workflow profile to ~/.slack-mcp-workflows. (local write)
slack_workflows read-only
List saved workflow profiles (read-only)
slack_smart_search read-only
Semantic search across indexed channels (hosted stub)
slack_catch_me_up read-only
AI-summarized digest of unreads + priority threads (hosted stub)
slack_triage read-only
Prioritized action queue across channels (hosted stub)

Use cases

Have your agent summarize unreads into a morning briefing
Search workspace history for decisions and discussions
Export full threads for archiving or analysis
Use workflow profiles (incident_room, exec_brief, support_inbox, etc.) to turn Slack into a typed data source
Let an agent send messages, add reactions, or mark conversations read

Supported clients

Claude Code
Claude Desktop
Cursor
VS Code
Windsurf
Gemini CLI
Codex

Listed from the project's documentation, not tested by this site.

Overview

Slack MCP Server is an open-source (MIT) MCP server that lets AI agents read and act on your Slack workspace directly. Instead of Slack's official OAuth app-registration flow, it reuses the xoxc- token and xoxd- cookie your browser already holds to call Slack's own API — no app to register, no scope review, no admin approval, and nothing appears in the workspace admin panel. It exposes 21 tools: 12 read-only tools (unreads, history, threads, search, users), 4 write-path tools annotated as destructive (send message, reactions, mark read), 2 local workflow-profile tools, and 3 hosted AI-summary stubs. Runs via npx (Node.js 20+), Docker, or self-hosted HTTP; an optional hosted tier (mcp.revasserlabs.com) adds permanent OAuth and AI summarization. Token storage has a four-layer fallback (env vars, file with chmod 600, macOS Keychain, Chrome auto-extraction) with expiry detection and auto-refresh. Note: automating your own session is a gray area under Slack's terms — check your workspace's acceptable-use policy first.

Similar servers

Compare with other MCP servers

Source revision fa2bedac114d Data synced 2026-10-19 Read the FMRS scoring method