Slack MCP Server: Setup, Scopes and Security (Oct 2026)

The Slack MCP server is Slack's own hosted server at https://mcp.slack.com/mcp. It lets an agent search and read messages, files and canvases, and post messages as you. TrustedMCP grades it A. Use it instead of the old @modelcontextprotocol/server-slack, which is archived and has an unfixed data-leak CVE.

What it connects

Slack's MCP server overview lists these tool groups:

• Search: messages and files (filter by date, user and content type), users, channels and custom emoji.
• Channels: list your channels by type, name prefix and workspace.
• Messages: send, schedule and draft messages, read full channel histories and threads, create channels, group DMs and DMs, and add or read emoji reactions.
• Canvases: create, update and export canvases as markdown.
• Users: read profiles (including custom fields and status) and list channel members.
• Files: read files, and upload in two steps (slack_get_file_upload_url, then slack_complete_file_upload).
• Lists: create and read lists, and update their columns and records.

It runs over Streamable HTTP only. Slack says SSE and Dynamic Client Registration are not supported, so every client needs a registered Slack app with a fixed client ID. Slack also says only apps published in the Slack Marketplace and internal apps can use MCP; unlisted apps can't.

Setup

Before you start, a workspace admin must have approved the MCP integration. Slack lists this as a prerequisite on every connect page.

Claude Code (plugin). From Slack's Claude connect page:

claude plugin install slack

Or inside a Claude Code session, /plugin install slack. Slack's harness guide gives the full name as /plugin install slack@claude-plugins-official. The plugin sets up the server with this config, and you then sign in with OAuth:

{
  "mcpServers": {
    "slack": {
      "type": "http",
      "url": "https://mcp.slack.com/mcp",
      "oauth": {
        "clientId": "1601185624273.8899143856786",
        "callbackPort": 3118
      }
    }
  }
}

The harness guide also shows a plain CLI route. Run /mcp in a session afterwards to finish OAuth:

claude mcp add --transport http --scope local slack https://mcp.slack.com/mcp

Claude Desktop. From the same Claude page: open the sidebar to reach Customize, click Connectors, click + and add Slack, then complete the OAuth flow.

Cursor. From Slack's Cursor connect page, open Cursor Settings, go to the MCP tab and add:

{
  "mcpServers": {
    "slack": {
      "url": "https://mcp.slack.com/mcp",
      "auth": {
        "CLIENT_ID": "3660753192626.8903469228982"
      }
    }
  }
}

Save it, then click the connect button that appears to sign in.

Codex. From the harness guide:

codex mcp add --transport http slack https://mcp.slack.com/mcp
codex mcp login slack

Slack's overview also lists Claude.ai and Perplexity as partner clients.

Security notes

Scopes are per tool. The server uses user tokens: you go through OAuth consent and the app acts as you. Slack documents the scope each tool needs, for example:

Tool	Scopes
Search messages and channels	search:read.public, search:read.private, search:read.mpim, search:read.im
Read a channel or thread	channels:history, groups:history, mpim:history, im:history
Send or schedule a message	chat:write
Create a channel or DM	channels:write, groups:write, im:write, mpim:write
Create or update a canvas	canvases:read, canvases:write
Read profiles and email	users:read, users:read.email
Upload a file	files:write

The full list is on the overview page.

Admins stay in control. Slack says workspace admins can approve and manage all MCP client integrations, and MCP activity shows up in Slack's audit logs. If your Slack app has an IP allowlist, MCP requests must come from allowed IPs.

Messages are untrusted input. The agent reads what other people wrote, including in shared channels. A message can carry instructions aimed at the model. Because the server can post, create channels and upload files as you, keep tool approval on in your client, and read every outgoing message before you approve it. Be extra careful with any message that contains a link you didn't ask for.

See the 5-minute safety check for the general process.

Warning: the old server-slack is unsafe

Many older guides point to @modelcontextprotocol/server-slack, Anthropic's reference server. Its repo, modelcontextprotocol/servers-archived, was archived on May 29, 2025 and is read-only.

It has CVE-2025-34072, rated 9.3 (critical, CVSS 4.0) by VulnCheck. The server's post and reply functions don't turn off link unfurling. A prompt injection can make the agent post a link with private data in the URL, such as a recent message or a .env file. Slack's preview bots then fetch that link, which sends the data to the attacker with no click needed. Embrace The Red's advisory reports that Anthropic does not plan to fix archived servers.

If you still run server-slack (npm) or mcp/slack (Docker) with an xoxb- bot token, remove it, revoke that token, and move to Slack's official server.

Why it grades A

• Authentication: 30 of 30. OAuth user tokens with per-tool scopes, plus workspace admin approval and audit logs.
• Maintenance: 18 of 25. Slack's docs and changelog are active, but the server is closed source, so we score one band lower.
• Known CVEs: 25 of 25. None on record for Slack's official server. The CVE above is in the archived reference server, not this one.
• Transport: 20 of 20. Hosted by Slack over HTTPS, with no local process.

Full breakdown on the Slack MCP listing; the method is in how TrustedMCP scores servers.

Frequently asked questions

Is the Slack MCP server free, and which plans can use it?

Slack's MCP docs don't list a price or a plan requirement. In practice, access depends on your workspace admin approving the integration. Ask your admin, and check Slack's own plan pages before you count on it.

What's the Slack MCP server URL?

https://mcp.slack.com/mcp. It only speaks Streamable HTTP, not SSE.

Does my admin need to approve it?

Yes. Every Slack connect page lists admin approval as a prerequisite, and admins can manage all MCP client integrations.

Is the old server-slack safe?

No. @modelcontextprotocol/server-slack is archived and has an unfixed data-exfiltration CVE (CVE-2025-34072). Migrate to the official server.

Can it post as me?

Yes. It uses a user token, so messages you send through it come from your account. That is why tool approval should stay on.

More: MCP security news, October 2026 · Collaboration category