Slack MCP Server

Set it up, then register it with your client.

npx -y @jtalk22/slack-mcp --setup

claude mcp add slack -- npx -y @jtalk22/slack-mcp

Check where your credentials are stored and how old they are, or run it read-only so your agent can read Slack but never post.

npx -y @jtalk22/slack-mcp --doctor --security

npx -y @jtalk22/slack-mcp --read-only

On Enterprise Grid, Slack can end a session it sees being automated. Use Slack's official MCP server there.

Claude Code Claude Desktop Cursor Copilot Windsurf Gemini CLI Codex CLI any stdio MCP client

What’s new in 5.1 · ▶ the whole morning in three minutes · interactive walkthrough · setup guide

If your workspace is on Slack's free plan

Checked against Slack's published plans and pricing on 2026-10-07.

A free workspace keeps 90 days of message history, allows 10 app integrations, and gets only Slack's basic AI. The AI people actually want — AI search across the workspace, channel recaps, Slackbot acting as an agent, AI workflow generation — starts on Business+ at $15 per user per month on annual billing ($18 month to month). Pro, at $7.25, buys unlimited history and unlimited apps, not the advanced AI. So a ten-person free workspace that wants an AI it can ask about its own Slack is looking at $1,800 a year, and the cheaper upgrade does not get them there.

This package gives that workspace an agent over the same Slack for nothing, running on the AI subscription its people already pay for. Three things follow from how it works:

• It installs no Slack app, so it uses none of your 10 app slots. If your workspace is already at the cap, this is the only way left to add an integration at all.
• It needs no admin approval, because it is not an app anyone has to approve. It reads Slack through your own browser session, with exactly the access you already have and nothing more.
• It can export what you can still see. On a free plan, history older than 90 days stops being reachable — Slack's own free export covers public channels only and is admin-only, so DMs and private channels are not in it. slack_get_full_conversation writes them out with their threads while they are still inside the window. It cannot retrieve anything already past the line; nothing can.

The browser-session route is not a workaround to apologise for. For a workspace Slack's own AI does not serve, it is the only route there is.

Two ways into Slack

Slack's official MCP server is an app your workspace admin approves and controls. Use it when your organisation wants a sanctioned integration. This server uses the browser session already in Chrome instead, so there is no app to install and no admin to ask, and it runs as a local command for any stdio MCP client. It acts as you, with exactly your access.

Install

Node 22 or 24 recommended. Node 20+ is supported and CI-tested.

npx -y @jtalk22/slack-mcp --setup

Prefer a persistent CLI: npm install -g @jtalk22/slack-mcp then slack-mcp --setup.

Then:

1. Copy the stdio command --setup prints when it finishes.
2. Paste it into your client, or run the claude mcp add line it prints.
3. Fully restart the client.
4. Ask the agent to run slack_health_check.
5. A workspace name in the response means the connection is live.

Per-client configuration keys are in the setup guide.

Use the same server command everywhere:

{  "command": "npx",  "args": ["-y", "@jtalk22/slack-mcp"]}

On macOS, setup can extract from Chrome and persist the selected storage backend. On other platforms, provide SLACK_TOKEN and SLACK_COOKIE through the client's environment configuration. Docker, HTTP, and detailed client examples live in docs/SETUP.md and docs/DEPLOYMENT-MODES.md.

20 tools: read, act, automate

Read channels, DMs, threads and search; act with a reply, a reaction or a read-state change; run the catch-up and typed workflows locally. The surface is 20 tools today: 13 read-only operations, 4 write-path tools that each carry an MCP destructive annotation so clients can gate workspace writes, and 3 local workflow tools. One of the reads is slack_session_report, which reads nothing from Slack: it returns what this process has done, as counts. Every tool does its work here — reads Slack or local state — and none is a placeholder for something you would have to pay for. Four read tools accept include_rich_message_fields: true to surface attachments, blocks, files, reactions, and metadata—complete inputs and response contracts live in docs/API.md.

Speaks MCP 2026-07-28 and every 2025 revision from the same binary — era-negotiated over stdio, stateless per request over HTTP (no Mcp-Session-Id; GET/DELETE answer 405). The claim is a test, not a sentence: test/mcp-era.test.js drives the real SDK client at both eras against the real entry points.

Advertising fewer tools. Every tool the server advertises sends its schema to the model on every turn, before you ask anything. SLACK_MCP_TOOLS=essentials advertises six (unread, history, search, thread, user lookup, send); SLACK_MCP_TOOLS=read the 13 read-only operations; --tools=slack_x,slack_y an explicit set. The default is all 20. Filtering changes what is advertised, not what is callable.

Typed workflows: Slack in, JSON out

Bind a workflow kind to channels, priority people, retention, and cadence. slack_catch_me_up then reads that scope locally and hands your agent the evidence: which threads went unanswered and for how long, what your priority people said or were pinned on, which conversations actually moved. It does the gathering; your agent writes the summary against the contract below.

There is no server-side model in that path, because there does not need to be one — the client calling this server is already a language model. Hosted adds what needs a server: running the same catch-up on a schedule while your laptop is shut.

npx -y @jtalk22/slack-mcp --apply-template oncall-handoff --channels C012345,C067890

Playbooks for your agent

Three playbooks ship with the server, so an agent learns how to use these tools with nothing installed in the client.

• slack-catch-up walks the agent through finding or creating the right workflow profile, running slack_catch_me_up, and citing the message behind every line. On a narrowed tool profile it builds the same answer from unreads, history and threads.
• slack-workflow-profiles covers choosing the kind, channels, priority people and cadence for a profile, or starting from a template.
• slack-send-safely keeps writes to what you ask for, explains a held send, and points to slack_session_report for what the session did.

Clients get them through the MCP Skills extension (SEP-2640: skills/list, skills/get), as skill://<name>/SKILL.md resources, or as prompts of the same name. A playbook is offered only when its tools are, so a read-only server never offers the sending playbook and the essentials profile never offers profile setup.

Add your team's own with SLACK_MCP_SKILLS_DIR=/path/to/skills, a folder of playbook folders that each hold a SKILL.md. They are checked at startup and served beside the bundled ones. An invalid one, or one that reuses a bundled name, is skipped with a warning on stderr. SLACK_MCP_SKILLS=off turns playbooks off.

Security and provenance

Every message this server returns becomes text in a model's context, next to your own instructions. Slack is a shared bus: a channel can hold Slack Connect participants from another workspace, guests, and apps relaying content from outside Slack entirely — and the same toolset that reads also writes. That adjacency is the risk worth naming.

• Credential files are owner-only; Keychain-only mode keeps plaintext credentials off disk.
• Configuration fails closed for unknown storage modes and invalid profiles.
• Writes are atomic and shared credential state is process-locked.
• The local web server binds to localhost; workspace write tools carry destructive annotations.
• Every release publishes from CI with npm provenance.

[Four authors — you, a colleague, a Slack Connect participant and a relay app — each cross the server’s trust boundary on their own track and are stamped self, internal, external or bot. All four land in one model context beside your own instructions. On the way back out, strict mode holds a send and read-only never registers the write tool.]

npx -y @jtalk22/slack-mcp --read-only          # or SLACK_MCP_READ_ONLY=1

Verify the release

npm audit signatures

A clean result means the package you installed was built and signed by this repository's release workflow. Read the code before giving it your Slack session. Full policy: SECURITY.md.

How it works

Five parts sit under the tools: extraction from Chrome, credential storage, reads, writes, and typed workflow output. All of it is plain JavaScript in this repository.

Credentials

The server checks these in order and uses the first it finds.

Session credentials expire, and how long they last varies: one written on 2026-07-04 still worked on 2026-10-07. slack_token_status shows the age of yours. When Slack rejects it (invalid_auth, not_authed, token_expired, token_revoked, account_inactive or HTTP 401), run npx -y @jtalk22/slack-mcp --setup. On macOS, slack_refresh_tokens or --refresh-tokens refreshes without leaving your client, and the optional LaunchAgent in docs/SETUP.md keeps an idle install working.

{  "mcpServers": {    "slack-work": {      "command": "npx",      "args": ["-y", "@jtalk22/slack-mcp"],      "env": { "SLACK_MCP_PROFILE": "work" }    },    "slack-personal": {      "command": "npx",      "args": ["-y", "@jtalk22/slack-mcp"],      "env": { "SLACK_MCP_PROFILE": "personal" }    }  }}

Local and hosted

The package runs on your machine, talks only to Slack, and is free under the MIT license. The hosted tier runs on a schedule instead, so the brief arrives while your laptop is closed:

• catch-up on a schedule, in your timezone;
• briefs built from your saved workflow profiles;
• profiles shared across a team;
• delivery to Slack or a signed webhook.

The package works without the hosted tier.

Hosted pricing →

Documentation

Setup · API · Architecture · Compatibility · Deployment modes · Recipes · Troubleshooting · Roadmap

Contributing

PRs are welcome. Read CONTRIBUTING.md and run node --check on touched JavaScript before submitting.

License

MIT — see LICENSE.

Disclaimer

Not affiliated with Slack Technologies, Inc. This server uses browser-session credentials. Review your workspace's acceptable-use policy before running it.