
Product
Introducing Repository Access Permissions and Custom Roles
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.
@mastra/slack
Advanced tools
Affected versions:
Slack integration for Mastra agents with app factory, OAuth, and slash commands
Slack integration for Mastra agents. Handles app creation, OAuth, slash commands, and messaging.
import { Mastra } from '@mastra/core/mastra';
import { Agent } from '@mastra/core/agent';
import { SlackProvider } from '@mastra/slack';
const myAgent = new Agent({
id: 'my-agent',
name: 'My Agent',
model: 'openai/gpt-4.1',
instructions: 'You are a helpful assistant.',
});
const slack = new SlackProvider({
refreshToken: process.env.SLACK_APP_CONFIG_REFRESH_TOKEN,
// For local dev, set SLACK_BASE_URL to your tunnel URL
// In production, this is auto-derived from server config
baseUrl: process.env.SLACK_BASE_URL,
});
const mastra = new Mastra({
agents: { myAgent },
channels: { slack },
});
// Or configure credentials later (e.g., from UI or vault)
// slack.configure({ refreshToken: 'xoxe-1-...' });
// Connect an agent to Slack (creates app, returns OAuth URL)
const { authorizationUrl } = await slack.connect('my-agent', {
name: 'My Bot',
description: 'An AI assistant',
iconUrl: 'https://example.com/my-bot-icon.png',
slashCommands: [
{ command: '/ask', prompt: 'Answer: {{text}}' },
{ command: '/help', prompt: 'List your capabilities.' },
],
});
Get App Configuration Tokens from https://api.slack.com/apps (look for "Your App Configuration Tokens" section)
Set up a tunnel for local development:
cloudflared tunnel --url http://localhost:4111
Add to .env:
SLACK_APP_CONFIG_TOKEN=xoxe.xoxp-...
SLACK_APP_CONFIG_REFRESH_TOKEN=xoxe-1-...
SLACK_BASE_URL=https://abc123.trycloudflare.com
⚠️ Token Rotation: Slack config access tokens expire after 12 hours, but the refresh token does not expire (it's single-use — each rotation returns a new pair). Tokens auto-rotate and are persisted to storage, so the
.envvalues are only used as the initial seed. If you lose your persisted storage (e.g., DB wipe), you'll need fresh tokens from the Slack dashboard.
SlackProvider automatically uses Mastra's storage if configured. Just add storage to your Mastra config:
import { LibSQLStore } from '@mastra/libsql';
const mastra = new Mastra({
agents: { myAgent },
storage: new LibSQLStore({ url: 'file:./mastra.db' }),
channels: {
slack: new SlackProvider({
refreshToken: process.env.SLACK_APP_CONFIG_REFRESH_TOKEN!,
}),
},
});
When Mastra has storage configured, SlackProvider automatically:
Without storage, data is lost on restart and apps are recreated.
SlackProvider on your Mastra instanceslack.connect(agentId) to provision a Slack app and get an OAuth URLCommands use prompt templates with variable substitution:
await slack.connect('my-agent', {
slashCommands: [
{
command: '/ask',
description: 'Ask the AI a question',
prompt: 'Answer this question: {{text}}',
},
{
command: '/summarize',
description: 'Summarize content',
prompt: 'Summarize the following in 2-3 sentences: {{text}}',
},
],
});
Available variables: {{text}}, {{userId}}, {{channelId}}, {{teamId}}
Each agent's Slack app can have its own icon:
await slack.connect('my-agent', {
iconUrl: 'https://example.com/my-bot-avatar.png',
});
The image should be:
The icon is uploaded automatically when the Slack app is created.
await slack.disconnect('my-agent');
This deletes the Slack app and removes the local installation record.
FAQs
Slack integration for Mastra agents with app factory, OAuth, and slash commands
The npm package @mastra/slack receives a total of 906 weekly downloads. As such, @mastra/slack popularity was classified as not popular.
We found that @mastra/slack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.

Product
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.