Slack

Search a Slack workspace and send messages, reactions and canvases.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Slack connector does

The Slack MCP server connects a Slack workspace to Claude, ChatGPT and any MCP-compatible agent. Anthropic's directory lists 11 tools that search messages, channels and people, read channel and thread history, and send messages and canvases. Sign-in is confidential OAuth on a user token, so anything the agent writes appears under your own name.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Slack tools (11)

  • slack_send_message
  • slack_search_public_and_private
  • slack_search_users
  • slack_search_channels
  • slack_search_public
  • slack_read_channel
  • slack_read_thread
  • slack_create_canvas
  • slack_update_canvas
  • slack_read_canvas
  • slack_read_user_profile

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • The tool list is not fixed and no published count is authoritative. Slack states the server returns tool descriptions matching the token provided. Anthropic lists 11, Slack's docs describe 15, a connected client showed 18. Read your own client's list after connecting.
  • Four tools in Slack's own documentation are absent from Anthropic's listing, two of which are outbound: adding a reaction and creating a conversation or channel, both described by Slack as acting "on behalf of the authenticated user".
  • Three tools observed in a live client appear in no Slack documentation — schedule_message, send_message_draft and get_reactions. schedule_message sends at a future time, which makes an undocumented tool an outbound one.
  • Writes are attributed to you, not to an app. There is no bot badge and no way to mark a message as agent-authored. Slack's as_user parameter is documented as classic-apps-only.
  • chat:write bundles send with edit and delete. No tool exposes deletion today; the permission is nonetheless inside the grant.
  • Two advertised scopes match no documented tool — lists:read/lists:write and files:write. We could not determine what, if anything, uses them.
  • No Dynamic Client Registration and no SSE. Clients need a pre-registered client_id and client_secret. Only Marketplace-published or internal Slack apps may use MCP at all.
  • Rate limits are per tool, not per server. Reading a channel or thread is Tier 3 (50+/min); searching users, channels or emoji is Tier 2 (20+/min); reading files, user profiles and channel members is Tier 4 (100+/min). Search adds a user-level ceiling near 10 requests per minute. Exceeding any returns HTTP 429 with Retry-After.
  • We could not read tool schemas or safety annotations. The endpoint returned 401 to an anonymous request on 2026-08-22, so no parameter-level detail is published here, and the read/write classification above is ours rather than the server's.
  • Some MCP administration requires an Enterprise plan. Slack marks the admin.apps.mcp.servers.* methods as available only to workspaces on an Enterprise plan, so centralised approval controls are plan-gated even though the connector itself is not.
  • Do not confuse this with the Slackbot MCP client. Slack ships MCP in both directions: this server exposes Slack *to* an AI client, while the Slackbot MCP client connects *other* MCP servers into Slack. They are different products with different scopes.

Frequently asked questions

Does the Slack MCP server post messages as me or as a bot?

As you. Slack's authorization server issues user tokens through the oauth/v2_user/authorize endpoint, and Slack's token documentation states that write actions with user tokens are performed as if by the user themselves. A message the agent sends carries your name and avatar, and colleagues cannot tell it came from an agent.

Can the Slack connector send a message that other people see?

Yes, immediately and irreversibly by you. The send message tool posts to any conversation type in Slack — public channel, private channel, group DM or one-to-one DM — under your identity. Slack's audit log records it as mcp_slack_send_message_tool_called. There is no draft-then-approve step enforced by the server itself.

How many tools does the Slack MCP server actually have?

It depends on your granted scopes, so no single number is right. Anthropic's directory lists 11, Slack's rate-limit table describes 15, and a connected client showed 18 on 2026-08-22. Slack's MCP overview states the server responds with tool descriptions that match the token provided, so your list is a function of consent.

Can the Slack connector read my private channels and DMs?

Only if you grant those scopes and consent in the Slack client. Search across direct messages needs search:read.im, and Slack's scope documentation states users must consent inside the Slack client before the API can search with it, and may revoke consent afterwards. Public-channel search needs only search:read.public.

Can the Slack connector delete a message?

No tool listed deletes one, but the scope that sends messages also permits deletion. Slack's chat:write scope documentation lists chat.delete, chat.update and chat.scheduleMessage as compatible methods alongside chat.postMessage. Granting send therefore grants edit and delete at the API level, even though no current tool name exposes them.

What OAuth permissions does the Slack MCP server request?

Thirty named Slack scopes, not an identity blanket. The server's RFC 9728 descriptor advertised scopes including chat:write, channels:history, search:read.private, canvases:write and users:read.email on 2026-08-22. Read and write are genuinely separable here, so you can grant channel history without also granting the ability to post a message.

Do I need admin approval to connect Slack to Claude?

Yes, in most workspaces. Slack's connect-to-Claude guide lists access to a workspace with the MCP integration approved by your workspace admin as a prerequisite. Slack also states that only Marketplace-published apps and internal apps may use MCP, so unlisted apps are prohibited regardless of user consent.

Are there rate limits on the Slack MCP server?

Yes, enforced per tool against the same Web API tiers. Slack documents reading a channel or thread at Tier 3, meaning 50 or more requests per minute, and searching users, channels or emoji at Tier 2, meaning 20 or more. Search carries an extra user-level limit of roughly 10 requests per minute.

Is text written by other people fed into my agent?

Yes, by design. Reading a channel or thread and searching messages return prose authored by colleagues and by anyone in a Slack Connect channel. That text arrives in the agent's context alongside tools that can post as you, which makes it a direct prompt-injection surface. Treat retrieved messages as data, never as instructions.

Sources

More Productivity connectors

  • 6sense

    Ask an AI agent about 6sense account insights, buying signals and keyword trends.

  • Adobe Workfront

    Find, create, update and delete Workfront work items from an AI agent.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Slack to work.

Connect Slack once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio