Slack MCP server icon

Slack

by Slack

HIPAA CompliantSOC2 ReadyISO 27001 Ready
Productivity11 tools

Search a Slack workspace and send messages, reactions and canvases from an AI agent. Anthropic lists 11 tools; Slack's own docs describe 15 and a connected client shows 18. Confidential OAuth on a user token, 30 named scopes.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect Slack via MCP

https://mcp.slack.com/mcp

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

Slack Tools & Capabilities (11)

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • The tool list is not fixed and no published count is authoritative. Slack states the server returns tool descriptions matching the token provided. Anthropic lists 11, Slack's docs describe 15, a connected client showed 18. Read your own client's list after connecting.
  • Four tools in Slack's own documentation are absent from Anthropic's listing, two of which are outbound: adding a reaction and creating a conversation or channel, both described by Slack as acting "on behalf of the authenticated user".
  • Three tools observed in a live client appear in no Slack documentation — schedule_message, send_message_draft and get_reactions. schedule_message sends at a future time, which makes an undocumented tool an outbound one.
  • Writes are attributed to you, not to an app. There is no bot badge and no way to mark a message as agent-authored. Slack's as_user parameter is documented as classic-apps-only.
  • chat:write bundles send with edit and delete. No tool exposes deletion today; the permission is nonetheless inside the grant.
  • Two advertised scopes match no documented tool — lists:read/lists:write and files:write. We could not determine what, if anything, uses them.
  • No Dynamic Client Registration and no SSE. Clients need a pre-registered client_id and client_secret. Only Marketplace-published or internal Slack apps may use MCP at all.
  • Rate limits are per tool, not per server. Reading a channel or thread is Tier 3 (50+/min); searching users, channels or emoji is Tier 2 (20+/min); reading files, user profiles and channel members is Tier 4 (100+/min). Search adds a user-level ceiling near 10 requests per minute. Exceeding any returns HTTP 429 with Retry-After.
  • We could not read tool schemas or safety annotations. The endpoint returned 401 to an anonymous request on 2026-08-22, so no parameter-level detail is published here, and the read/write classification above is ours rather than the server's.
  • Some MCP administration requires an Enterprise plan. Slack marks the admin.apps.mcp.servers.* methods as available only to workspaces on an Enterprise plan, so centralised approval controls are plan-gated even though the connector itself is not.
  • Do not confuse this with the Slackbot MCP client. Slack ships MCP in both directions: this server exposes Slack *to* an AI client, while the Slackbot MCP client connects *other* MCP servers into Slack. They are different products with different scopes.

Frequently asked questions

As you. Slack's authorization server issues user tokens through the oauth/v2_user/authorize endpoint, and Slack's token documentation states that write actions with user tokens are performed as if by the user themselves. A message the agent sends carries your name and avatar, and colleagues cannot tell it came from an agent.

Yes, immediately and irreversibly by you. The send message tool posts to any conversation type in Slack — public channel, private channel, group DM or one-to-one DM — under your identity. Slack's audit log records it as mcp_slack_send_message_tool_called. There is no draft-then-approve step enforced by the server itself.

It depends on your granted scopes, so no single number is right. Anthropic's directory lists 11, Slack's rate-limit table describes 15, and a connected client showed 18 on 2026-08-22. Slack's MCP overview states the server responds with tool descriptions that match the token provided, so your list is a function of consent.

Only if you grant those scopes and consent in the Slack client. Search across direct messages needs search:read.im, and Slack's scope documentation states users must consent inside the Slack client before the API can search with it, and may revoke consent afterwards. Public-channel search needs only search:read.public.

No tool listed deletes one, but the scope that sends messages also permits deletion. Slack's chat:write scope documentation lists chat.delete, chat.update and chat.scheduleMessage as compatible methods alongside chat.postMessage. Granting send therefore grants edit and delete at the API level, even though no current tool name exposes them.

Thirty named Slack scopes, not an identity blanket. The server's RFC 9728 descriptor advertised scopes including chat:write, channels:history, search:read.private, canvases:write and users:read.email on 2026-08-22. Read and write are genuinely separable here, so you can grant channel history without also granting the ability to post a message.

Yes, in most workspaces. Slack's connect-to-Claude guide lists access to a workspace with the MCP integration approved by your workspace admin as a prerequisite. Slack also states that only Marketplace-published apps and internal apps may use MCP, so unlisted apps are prohibited regardless of user consent.

Yes, enforced per tool against the same Web API tiers. Slack documents reading a channel or thread at Tier 3, meaning 50 or more requests per minute, and searching users, channels or emoji at Tier 2, meaning 20 or more. Search carries an extra user-level limit of roughly 10 requests per minute.

Yes, by design. Reading a channel or thread and searching messages return prose authored by colleagues and by anyone in a Slack Connect channel. That text arrives in the agent's context alongside tools that can post as you, which makes it a direct prompt-injection surface. Treat retrieved messages as data, never as instructions.

Sources

Use in Agentman

Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio

Resources

Server Info

Category
Productivity
Developer
Slack
Tools
11
Domain
mcp.slack.com

Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.

Similar MCP Servers for Productivity

Asana logo

Asana

by Asana

Coming Soon
Productivity42 tools
View detailsConnect
Atlassian logo

Atlassian

by Atlassian

Coming Soon
Productivity25 tools
View detailsConnect
ClickUp logo

ClickUp

by ClickUp

Coming Soon
Productivity9 tools
View detailsConnect

Related Resources

Browse All MCP ServersClaude & ChatGPT Setup GuideBrowse AI Skills