
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@kazuph/mcp-slack
Advanced tools
Model Context Protocol (MCP) server for Slack Workspaces. This integration supports both Stdio and SSE transports, proxy settings and does not require any permissions or bots being created or approved by Workspace admins
Model Context Protocol (MCP) server for Slack Workspaces. The most powerful MCP Slack server — supports Stdio and SSE transports, proxy settings, DMs, Group DMs, Smart History fetch (by date or count), may work via OAuth or in complete stealth mode with no permissions and scopes in Workspace 😏.
[!IMPORTANT]
We need your support! Each month, over 30,000 engineers visit this repository, and more than 9,000 are already using it.If you appreciate the work our contributors have put into this project, please consider giving the repository a star.
This feature-rich Slack MCP Server has:
#Name @Lookup: Fetch messages from channels and threads, including activity messages, and retrieve channels using their names (e.g., #general) as well as their IDs. Enhanced user lookup with display name and real name fallback (v1.2.0).conversations_add_message tool is disabled by default for safety. Enable it via an environment variable, with optional channel restrictions.

Get messages from the channel (or DM) by channel_id, the last row/column in the response is used as 'cursor' parameter for pagination if not empty
channel_id (string, required): - channel_id (string): ID of the channel in format Cxxxxxxxxxx or its name starting with #... or @... aka #general or @username_dm.include_activity_messages (boolean, default: false): If true, the response will include activity messages such as channel_join or channel_leave. Default is boolean false.cursor (string, optional): Cursor for pagination. Use the value of the last row and column in the response as next_cursor field returned from the previous request.limit (string, default: "1d"): Limit of messages to fetch in format of maximum ranges of time (e.g. 1d - 1 day, 30d - 30 days, 90d - 90 days which is a default limit for free tier history) or number of messages (e.g. 50). Must be empty when 'cursor' is provided.Get a thread of messages posted to a conversation by channelID and thread_ts, the last row/column in the response is used as cursor parameter for pagination if not empty.
channel_id (string, required): ID of the channel in format Cxxxxxxxxxx or its name starting with #... or @... aka #general or @username_dm.thread_ts (string, required): Unique identifier of either a thread’s parent message or a message in the thread. ts must be the timestamp in format 1234567890.123456 of an existing message with 0 or more replies.include_activity_messages (boolean, default: false): If true, the response will include activity messages such as 'channel_join' or 'channel_leave'. Default is boolean false.cursor (string, optional): Cursor for pagination. Use the value of the last row and column in the response as next_cursor field returned from the previous request.limit (string, default: "1d"): Limit of messages to fetch in format of maximum ranges of time (e.g. 1d - 1 day, 30d - 30 days, 90d - 90 days which is a default limit for free tier history) or number of messages (e.g. 50). Must be empty when 'cursor' is provided.Add a message to a public channel, private channel, or direct message (DM, or IM) conversation by channel_id and thread_ts.
Note: Posting messages is disabled by default for safety. To enable, set the
SLACK_MCP_ADD_MESSAGE_TOOLenvironment variable. If set to a comma-separated list of channel IDs, posting is enabled only for those specific channels. See the Environment Variables section below for details.
channel_id (string, required): ID of the channel in format Cxxxxxxxxxx or its name starting with #... or @... aka #general or @username_dm.thread_ts (string, optional): Unique identifier of either a thread’s parent message or a message in the thread_ts must be the timestamp in format 1234567890.123456 of an existing message with 0 or more replies. Optional, if not provided the message will be added to the channel itself, otherwise it will be added to the thread.payload (string, required): Message payload in specified content_type format. Example: 'Hello, world!' for text/plain or '# Hello, world!' for text/markdown.content_type (string, default: "text/markdown"): Content type of the message. Default is 'text/markdown'. Allowed values: 'text/markdown', 'text/plain'.Search messages in a public channel, private channel, or direct message (DM, or IM) conversation using filters. All filters are optional, if not provided then search_query is required.
search_query (string, optional): Search query to filter messages. Example: marketing report.filter_in_channel (string, optional): Filter messages in a specific channel by its ID or name. Example: C1234567890 or #general. If not provided, all channels will be searched.filter_in_im_or_mpim (string, optional): Filter messages in a direct message (DM) or multi-person direct message (MPIM) conversation by its ID or name. Example: D1234567890 or @username_dm. If not provided, all DMs and MPIMs will be searched.filter_users_with (string, optional): Filter messages with a specific user by their ID or display name in threads and DMs. Example: U1234567890 or @username. If not provided, all threads and DMs will be searched.filter_users_from (string, optional): Filter messages from a specific user by their ID or display name. Example: U1234567890 or @username. If not provided, all users will be searched.filter_date_before (string, optional): Filter messages sent before a specific date in format YYYY-MM-DD. Example: 2023-10-01, July, Yesterday or Today. If not provided, all dates will be searched.filter_date_after (string, optional): Filter messages sent after a specific date in format YYYY-MM-DD. Example: 2023-10-01, July, Yesterday or Today. If not provided, all dates will be searched.filter_date_on (string, optional): Filter messages sent on a specific date in format YYYY-MM-DD. Example: 2023-10-01, July, Yesterday or Today. If not provided, all dates will be searched.filter_date_during (string, optional): Filter messages sent during a specific period in format YYYY-MM-DD. Example: July, Yesterday or Today. If not provided, all dates will be searched.filter_threads_only (boolean, default: false): If true, the response will include only messages from threads. Default is boolean false.cursor (string, default: ""): Cursor for pagination. Use the value of the last row and column in the response as next_cursor field returned from the previous request.limit (number, default: 20): The maximum number of items to return. Must be an integer between 1 and 100.Get list of channels
channel_types (string, required): Comma-separated channel types. Allowed values: mpim, im, public_channel, private_channel. Example: public_channel,private_channel,imsort (string, optional): Type of sorting. Allowed values: popularity - sort by number of members/participants in each channel.limit (number, default: 100): The maximum number of items to return. Must be an integer between 1 and 1000 (maximum 999).cursor (string, optional): Cursor for pagination. Use the value of the last row and column in the response as next_cursor field returned from the previous request.Create a new public channel
name (string, required): Name of the channel to create. Must be 80 characters or less.Rename a public channel
channel_id (string, required): ID of the channel to rename in format Cxxxxxxxxxx or its name starting with #... aka #generalname (string, required): New name for the channel. Must be 80 characters or less.Invite users to a public channel
channel_id (string, required): ID of the channel in format Cxxxxxxxxxx or its name starting with #... aka #generalusers (string, required): Comma-separated list of user IDs (U1234567890) or usernames (@username) to inviteSet the topic/description of a public channel
channel_id (string, required): ID of the channel in format Cxxxxxxxxxx or its name starting with #... aka #generaltopic (string, required): New topic/description for the channelResolve a user by their username, display name, real name, or email with Unicode normalization support. This tool handles invisible characters (zero-width spaces) that may appear in user names and automatically falls back to real name when display name is empty.
query (string, required): The search query (username, display name, real name, or email). Can start with @ but it's not required. Supports Unicode normalization for invisible characters.search_type (string, optional, default: auto): Type of search to perform. Options:
username: Search by Slack username onlydisplay_name: Search by display name (falls back to real name if display name is empty)real_name: Search by real name onlyemail: Search by email address onlyauto: Searches all fields with priority: username exact → display name exact → real name exact → email exact → partial matchesNote: User resolution improvements in v1.2.0 also enhance the conversations_invite and conversations_add_message tools, which now support user lookup by display name and real name in addition to username.
| Variable | Required? | Default | Description |
|---|---|---|---|
SLACK_MCP_XOXC_TOKEN | Yes* | nil | Slack browser token (xoxc-...) |
SLACK_MCP_XOXD_TOKEN | Yes* | nil | Slack browser cookie d (xoxd-...) |
SLACK_MCP_XOXP_TOKEN | Yes* | nil | User OAuth token (xoxp-...) — alternative to xoxc/xoxd |
SLACK_MCP_XOXB_TOKEN | Yes* | nil | Bot token (xoxb-...) — alternative to xoxp. Note: Bot tokens have limited access (invited channels only, no search) |
SLACK_MCP_PORT | No | 13080 | Port for the MCP server to listen on |
SLACK_MCP_HOST | No | 127.0.0.1 | Host for the MCP server to listen on |
SLACK_MCP_SSE_API_KEY | No | nil | Bearer token for SSE transport |
SLACK_MCP_PROXY | No | nil | Proxy URL for outgoing requests |
SLACK_MCP_USER_AGENT | No | nil | Custom User-Agent (for Enterprise Slack environments) |
SLACK_MCP_SERVER_CA | No | nil | Path to CA certificate |
SLACK_MCP_SERVER_CA_INSECURE | No | false | Trust all insecure requests (NOT RECOMMENDED) |
SLACK_MCP_ADD_MESSAGE_TOOL | No | nil | Enable message posting via conversations_add_message by setting it to true for all channels, a comma-separated list of channel IDs to whitelist specific channels, or use ! before a channel ID to allow all except specified ones, while an empty value disables posting by default. |
SLACK_MCP_USERS_CACHE | No | OS cache dir* | Path to the users cache file. Used to cache Slack user information to avoid repeated API calls on startup. |
SLACK_MCP_CHANNELS_CACHE | No | OS cache dir* | Path to the channels cache file. Used to cache Slack channel information to avoid repeated API calls on startup. |
*Cache files are stored in the OS-specific cache directory: ~/Library/Caches/slack-mcp-server/ (macOS), ~/.cache/slack-mcp-server/ (Linux), or %LocalAppData%/slack-mcp-server/ (Windows).
*You need one of: xoxp (user), xoxb (bot), or both xoxc/xoxd tokens for authentication.
# Run the inspector with stdio transport
npx @modelcontextprotocol/inspector go run mcp/mcp-server.go --transport stdio
# View logs
tail -n 20 -f ~/Library/Logs/Claude/mcp*.log
Licensed under MIT - see LICENSE file. This is not an official Slack product.
FAQs
Model Context Protocol (MCP) server for Slack Workspaces. This integration supports both Stdio and SSE transports, proxy settings and does not require any permissions or bots being created or approved by Workspace admins
We found that @kazuph/mcp-slack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.