
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@sigmacomputing/slack-mcp-server
Advanced tools
Fork of zencoderai/slack-mcp-server — customized for read-only access to the Sigma Slack workspace.
This is a Sigma-specific fork of the Zencoder Slack MCP server. It is tailored for reading and searching content in the Sigma Slack workspace from Cursor IDE, with no write access (no posting messages or replying to threads). The fork adds tools for file downloads, full-text search, pins, bookmarks, and reactions that the upstream project does not provide.
This project includes code originally developed by Anthropic and released under the MIT License. Substantial modifications and new functionality have been added by For Good AI Inc. (dba Zencoder Inc.), and are licensed under the Apache License, Version 2.0. Additional modifications in this fork are by Sigma.
A read-oriented Model Context Protocol (MCP) server for interacting with the Sigma Slack workspace. This server provides tools to list channels, read messages, search content, manage reactions, download files, view pins and bookmarks, and browse user profiles.
slack_list_channels
limit (number, default: 100, max: 200): Maximum number of channels to returncursor (string): Pagination cursor for next pageslack_join_channel
channel_id (string): The ID of the public channel to joinslack_get_channel_history
channel_id (string): The channel IDlimit (number, default: 10): Number of messages to retrieveslack_get_thread_replies
channel_id (string): The channel containing the threadthread_ts (string): Timestamp of the parent messageslack_add_reaction
channel_id (string): The channel containing the messagetimestamp (string): Message timestamp to react toreaction (string): Emoji name without colonsslack_remove_reaction
channel_id (string): The channel containing the messagetimestamp (string): Message timestampreaction (string): Emoji name to remove (without colons)slack_get_reactions
channel_id (string): The channel containing the messagetimestamp (string): Message timestampslack_get_users
cursor (string): Pagination cursor for next pagelimit (number, default: 100, max: 200): Maximum users to returnslack_get_user_profile
user_id (string): The user's IDslack_download_file
file_id (string): The Slack file ID (e.g., F0123456789) found in the files array of messages from slack_get_channel_historyslack_list_files
channel_id (string): Filter files by channel IDuser_id (string): Filter files by user IDcount (number, default: 20, max: 100): Number of files to returnslack_search_messages
query (string): Search query (supports Slack modifiers like in:#channel, from:@user, before:2024-01-01, has:link, has:reaction, etc.)count (number, default: 20, max: 100): Number of results to returnsort (string, default: "timestamp"): Sort by timestamp or scoresort_dir (string, default: "desc"): Sort direction asc or descslack_search_files
query (string): Search query (supports Slack modifiers like in:#channel, from:@user, type:pdf, etc.)count (number, default: 20, max: 100): Number of results to returnsort (string, default: "timestamp"): Sort by timestamp or scoresort_dir (string, default: "desc"): Sort direction asc or descslack_list_pins
channel_id (string): The channel IDslack_list_bookmarks
channel_id (string): The channel IDTo use this MCP server, you need to create a Slack app and configure it with the necessary permissions:
Navigate to "OAuth & Permissions" and add these scopes:
bookmarks:read - View bookmarks in channelschannels:history - View messages and other content in public channelschannels:join - Join public channels in the workspacechannels:read - View basic channel informationfiles:read - Access file content and metadata shared in channelspins:read - View pinned items in channelsreactions:read - View emoji reactions on messagesreactions:write - Add and remove emoji reactionssearch:read.files - Search files across the workspacesearch:read.public - Search messages in public channelsusers:read - View users and their basic informationusers.profile:read - View detailed profiles about usersxoxb-Get your Team ID (starts with a T) by following this guidance
For the bot to access private channels or to post messages, you may need to invite it to specific channels using /invite @your-bot-name
npm install
npm run build
npm install -g @zencoderai/slack-mcp-server
# Build the Docker image locally
docker build -t slack-mcp-server .
# Or pull from Docker Hub
docker pull zencoderai/slack-mcp:latest
# Or pull a specific version
docker pull zencoderai/slack-mcp:1.0.0
Set the following environment variables:
export SLACK_BOT_TOKEN="xoxb-your-bot-token"
export SLACK_TEAM_ID="your-team-id"
export SLACK_CHANNEL_IDS="channel1,channel2,channel3" # Optional: predefined channels
export AUTH_TOKEN="your-auth-token" # Optional: Bearer token for HTTP authorization (Streamable HTTP transport only)
slack-mcp [options]
Options:
--transport <type> Transport type: 'stdio' or 'http' (default: stdio)
--port <number> Port for HTTP server when using Streamable HTTP transport (default: 3000)
--token <token> Bearer token for HTTP authorization (optional, can also use AUTH_TOKEN env var)
--help, -h Show this help message
# Use stdio transport (default)
slack-mcp
# Use stdio transport explicitly
slack-mcp --transport stdio
# Use Streamable HTTP transport on default port 3000
slack-mcp --transport http
# Use Streamable HTTP transport on custom port
slack-mcp --transport http --port 8080
# Use Streamable HTTP transport with custom auth token
slack-mcp --transport http --token mytoken
# Use Streamable HTTP transport with auth token from environment variable
AUTH_TOKEN=mytoken slack-mcp --transport http
# Use stdio transport (default)
node dist/index.js
# Use stdio transport explicitly
node dist/index.js --transport stdio
# Use Streamable HTTP transport on default port 3000
node dist/index.js --transport http
# Use Streamable HTTP transport on custom port
node dist/index.js --transport http --port 8080
# Use Streamable HTTP transport with custom auth token
node dist/index.js --transport http --token mytoken
# Use Streamable HTTP transport with auth token from environment variable
AUTH_TOKEN=mytoken node dist/index.js --transport http
# Run with stdio transport (default)
docker run --rm \
-e SLACK_BOT_TOKEN="xoxb-your-bot-token" \
-e SLACK_TEAM_ID="your-team-id" \
zencoderai/slack-mcp:latest
# Run with HTTP transport on port 3000
docker run --rm -p 3000:3000 \
-e SLACK_BOT_TOKEN="xoxb-your-bot-token" \
-e SLACK_TEAM_ID="your-team-id" \
zencoderai/slack-mcp:latest --transport http
# Run with HTTP transport on custom port
docker run --rm -p 8080:8080 \
-e SLACK_BOT_TOKEN="xoxb-your-bot-token" \
-e SLACK_TEAM_ID="your-team-id" \
zencoderai/slack-mcp:latest --transport http --port 8080
# Run with custom auth token
docker run --rm -p 3000:3000 \
-e SLACK_BOT_TOKEN="xoxb-your-bot-token" \
-e SLACK_TEAM_ID="your-team-id" \
-e AUTH_TOKEN="mytoken" \
zencoderai/slack-mcp:latest --transport http
Create a docker-compose.yml file:
version: '3.8'
services:
slack-mcp:
# Use published image:
image: zencoderai/slack-mcp:latest
# Or build locally:
# build: .
environment:
- SLACK_BOT_TOKEN=xoxb-your-bot-token
- SLACK_TEAM_ID=your-team-id
- SLACK_CHANNEL_IDS=channel1,channel2,channel3 # Optional
- AUTH_TOKEN=your-auth-token # Optional for HTTP transport
ports:
- "3000:3000" # Only needed for HTTP transport
command: ["--transport", "http"] # Optional: specify transport type
restart: unless-stopped
Then run:
# Start the service
docker compose up -d
# View logs
docker compose logs -f slack-mcp
# Stop the service
docker compose down
When using Streamable HTTP transport, the server supports Bearer token authentication:
--token <token> to specify a custom tokenAUTH_TOKEN=<token> as a fallbackThe command line option takes precedence over the environment variable. Include the token in HTTP requests using the Authorization: Bearer <token> header.
If you encounter permission errors, verify that:
npm run build
npm run watch
When using Streamable HTTP transport, the server exposes the following endpoints:
POST /mcp - Client-to-server communicationGET /mcp - Server-to-client notifications (Server-Sent Events streams)DELETE /mcp - Session terminationFAQs
MCP server for interacting with Slack
We found that @sigmacomputing/slack-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 216 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.