Multi-workspace Slack MCP server with draft+confirm safety, vault auto-export, a

slack-mcp

[License] [GitHub stars] [Last commit] [Open issues] [PyPI version] [PyPI downloads] [Built by Mycelium AI]

Multi-workspace Slack MCP server with draft+confirm safety, vault auto-export, and triple-mode auth.

One process, N workspaces, every write goes through draft → confirm. Built because the existing Slack MCP servers are single-workspace per instance and the Anthropic reference impl was deprecated.

Why use this over the alternatives

Install

Open Claude Code, paste:

/plugin marketplace add adelaidasofia/slack-mcp/plugin install slack-mcp@slack-mcp

Then fill in tokens in .env (see SETUP.md for cookie extraction walkthrough).

git clone https://github.com/adelaidasofia/slack-mcp.git ~/.claude/slack-mcpcd ~/.claude/slack-mcppip3 install --break-system-packages -r requirements.txtcp .env.example .env# fill in tokens — see SETUP.md for cookie extraction walkthrough

{  "mcpServers": {    "slack": {      "command": "python3",      "args": ["-m", "slack_mcp.server"],      "cwd": "/Users/YOU/.claude/slack-mcp"    }  }}

Tools (v0.1.1)

Meta: list_workspaces, healthcheck

Read: list_channels, search_channels, read_channel, read_thread, list_users, search_users, get_user_profile, search_messages

Write (draft+confirm): send_message → confirm_send, send_reply_quote → confirm_send, update_own_message → confirm_send, cancel_draft

Write (low-consequence, immediate): add_reaction, mark_read, delete_own_message

Auth modes

Cookie extraction takes ~3 minutes per workspace. See SETUP.md.

Vault auto-export

Every read_channel call mirrors the channel to <vault>/🤖 AI Chats/Slack/<workspace>/<channel>.md. Idempotent (same channel + day overwrites cleanly). Disable via SLACK_MCP_VAULT_EXPORT=false.

Configuration

All config via env vars (loaded from .env at process start):

• SLACK_WORKSPACES — comma-separated list of aliases (e.g. onde,mycelium)
• SLACK_PRIMARY_WORKSPACE — default workspace when tool calls omit workspace
• Per-workspace: SLACK_WORKSPACE_<ALIAS>_TYPE, _TOKEN, _COOKIE (xoxc only), _TEAM_ID, _LABEL
• SLACK_MCP_VAULT_PATH — vault root for the auto-export mirror (default ~/Documents/Vault)
• SLACK_MCP_VAULT_EXPORT — true/false (default true)
• SLACK_MCP_AUDIT_LOG_PATH — JSONL audit log path
• SLACK_MCP_DRAFT_TTL_SECONDS — draft expiration (default 3600)
• SLACK_MCP_SCRUB_PROMPT_INJECTION — true/false (default true)

Safety patterns

• Draft + confirm. Every send (send_message, send_reply_quote, update_own_message) returns a draft_id. Nothing posts until confirm_send(draft_id) is called. Drafts expire after 1 hour. One-time confirm. update_own_message drafts include a before/after preview so the operator can diff before confirming the edit.
• Workspace required on writes. No global default for sends — every write tool requires workspace to prevent wrong-workspace posts when channel names collide.
• Audit log. Every tool call appends a JSONL record. Tokens are redacted.
• Prompt-injection scrubber. Incoming message text is sanitized for known prompt-injection patterns (zalgo, role-spoof headers, fake fences). Hits are wrapped not deleted so the operator sees the attempt.
• Token redaction. list_workspaces returns redacted profiles only. Tokens never appear in tool responses.

Related MCPs

Same author, same architecture pattern (FastMCP, draft+confirm on writes where applicable, vault auto-export, MIT):

• imessage-mcp - macOS iMessage
• whatsapp-mcp - WhatsApp via whatsmeow
• google-workspace-mcp - Gmail / Calendar / Drive / Docs / Sheets
• apollo-mcp - Apollo.io CRM + sequences
• substack-mcp - Substack writing + analytics
• luma-mcp - lu.ma events
• parse-mcp - markitdown / Docling / LlamaParse router
• rescuetime-mcp - RescueTime productivity data
• graph-query-mcp - vault knowledge graph queries
• investor-relations-mcp - seed-raise pipeline tracker
• vault-sync-mcp - bidirectional vault sync

Telemetry

This plugin sends a single anonymous install signal to myceliumai.co the first time it loads in a Claude Code session on a given machine.

What is sent:

• Plugin name (e.g. slack-mcp)
• Plugin version (e.g. 0.1.0)

What is NOT sent:

• No user identifiers, names, emails, tokens, or API keys
• No file paths, message content, or anything from your work
• No IP address is stored after dedup processing

Why: Helps the maintainer know which plugins people actually install, so attention goes to the ones that get used.

Opt out: Set the environment variable MYCELIUM_NO_PING=1 before launching Claude Code. The hook will skip the network call entirely. Already-pinged installs leave a sentinel at ~/.mycelium/onboarded-<plugin> — delete it if you want to reset state.

License

MIT — see LICENSE.