Slack

npx -y @jtalk22/slack-mcp --setup

It’s Monday, 9:07. Slack has already formed opinions.

You ask “what blew up overnight?” and the agent reads the workspace instead of you. It reconstructs the 2 AM P1 from #incidents—owner, resolution, and the runbook step that is still wrong. It finds the printer PIN that has been waiting in #facilities for five months. Then it closes the handled loops—replies, reactions, read-state changes—only where you approve.

This is not screenshot automation. The agent calls Slack through a real MCP tool surface and receives typed results it can search, summarize, export, or act on.

Built past the demo

The difficult part is not another chat tool. It is the operating layer underneath: browser-session extraction that names its failure stages, a credential lifecycle built for rotation, full-fidelity reads, guarded writes, and typed workflow output. The code is plain JavaScript in this repository—audit it before trusting it with a session.

1. The browser-session engine

--setup turns the Slack identity Chrome already holds into a local MCP server:

• finds the newest xoxc- token in Chrome's on-disk LevelDB;
• snapshots the cookie SQLite database with its WAL sidecars;
• retrieves Chrome Safe Storage from the macOS Keychain;
• runs Chrome-compatible PBKDF2 + AES-128-CBC decryption locally;
• requires no DevTools, clipboard step, browser flag, or live Slack tab;
• names the failed extraction stage—keychain_timeout, no_slack_cookie_row, cookie_decrypt_failed, and more—instead of returning one opaque error.

2. Credential lifecycle, not credential paste

Session credentials rotate. The server is built around that reality:

• auto, keychain-only, and file storage backends;
• owner-only token files and a Keychain-only path with no plaintext credentials on disk;
• atomic file writes, verified Keychain migration, cross-process locks, and refresh mutexes;
• proactive health checks and automatic macOS refresh;
• last-known-good in-memory credentials when persistence is temporarily unavailable;
• isolated profiles for work and personal Slack;
• fail-closed handling for invalid storage or profile configuration.

3. Full-fidelity Slack reads

Read DMs and channels, search the workspace, export complete histories with threads, inspect unread state, and resolve users. Opt into blocks, attachments, files, reactions, metadata, and bot/app markers when text alone is not the real message.

4. The agent can finish the job

Send a reply, add or remove a reaction, and mark a conversation read. Every workspace write path carries an MCP destructive annotation so compatible clients can put approval where it belongs.

5. Slack in, typed JSON out

Save workflow profiles for incident rooms, executive briefs, support inboxes, launch watches, and custom operations. The OSS primitives are local JSON; the optional hosted brain renders them into contract-shaped briefs.

Two ways into Slack

Slack already knows who you are. The official path is a Slack-managed remote integration governed by workspace policy—a strong fit for organization-sanctioned deployments, documented by Slack with integration settings under admin control. This project is the direct local path: session-based auth from the browser session already in Chrome, local stdio, any stdio MCP client, and no Slack app or admin request. Same Slack identity. Same underlying permissions. A radically shorter path from your workspace to your agent.

Treat browser-session automation as an acceptable-use decision for you and your workspace. The server acts as your signed-in Slack identity and cannot read a channel you cannot read or act as another user. It does not evade server-side retention, DLP, compliance exports, or audit controls.

"No admin request" means there is no Slack app installation to approve. It does not mean workspace activity disappears from Slack's systems. If your policy requires a sanctioned OAuth integration, use the official MCP or the optional hosted OAuth path.

Grid, credentials, and caching

Enterprise Grid. Grid runs aggressive session-anomaly detection. Browser-session automation can trip it, which flags the session and kills it, regardless of which tool drives the traffic. Outbound calls are paced by default to stay under burst thresholds (SLACK_MCP_MIN_REQUEST_INTERVAL_MS, default 350; SLACK_MCP_MAX_CONCURRENCY, default 3). Pacing lowers that risk; it does not remove it. On Grid, use the hosted OAuth tier or Slack's official MCP instead.

Credential extraction. --setup reads the newest xoxc- token from Chrome's on-disk LevelDB, snapshots the cookie SQLite database, retrieves Chrome Safe Storage from the macOS Keychain, and runs PBKDF2 + AES-128-CBC decryption locally. It writes the token file, Keychain entries, and non-secret metadata. It transmits nothing — the server talks to Slack and nowhere else.

This is the same access pattern credential stealers use. Chrome App-Bound Encryption exists to make this class of read harder, and infostealer families (Lumma, Vidar, Meduza) bypass it to lift live sessions. The mechanism here is comparable. What differs is that you run it, on your own machine, against your own session, and nothing leaves the host. The source is plain JavaScript in this repository; audit it before handing it a live session.

User cache. One cache exists: user-name lookups, populated on demand, 500 entries maximum, one-hour TTL. No message content, no channel history, and no persistent copy of the workspace is stored.

Install

Node 22 or 24 recommended. Node 20 remains supported for the v4 line.

npx -y @jtalk22/slack-mcp --setup

Prefer a persistent CLI: npm install -g @jtalk22/slack-mcp then slack-mcp --setup.

Then:

1. Pick your client in the setup guide.
2. Register the generated stdio command.
3. Fully restart the client.
4. Ask the agent to run slack_health_check.
5. A workspace name in the response means the connection is live.

Use the same server command everywhere:

{
  "command": "npx",
  "args": ["-y", "@jtalk22/slack-mcp"]
}

On macOS, setup can extract from Chrome and persist the selected storage backend. On other platforms, provide SLACK_TOKEN and SLACK_COOKIE through the client's environment configuration. Docker, HTTP, and detailed client examples live in docs/SETUP.md and docs/DEPLOYMENT-MODES.md.

21 tools: read, act, automate

The local surface ships 21 tools today: 12 read-only Slack operations, 4 write-path tools that each carry an MCP destructive annotation so clients can gate workspace writes, 3 local workflow tools including the catch-up itself, and 2 hosted-intelligence stubs that return a structured upgrade payload without making a Slack call. Four read tools accept include_rich_message_fields: true to surface attachments, blocks, files, reactions, and metadata—complete inputs and response contracts live in docs/API.md.

Advertising fewer tools. A client pays for the tool schema on every turn that carries it. SLACK_MCP_TOOLS=essentials advertises six tools — unread, history, search, thread, user lookup, send — costing roughly 985 estimated tokens of schema per turn against about 3,600 for all 21. SLACK_MCP_TOOLS=read advertises the 12 read-only Slack operations listed

…