
Security News
Risky Biz Podcast: Making Reachability Analysis Work in Real-World Codebases
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
An MCP (Model Context Protocol) server that enables AI assistants to ask questions to humans via Slack and wait for their responses. This allows AI systems to request human input when they need clarification, confirmation, or access to information only humans can provide.
npm install -g hitlslack
Or use directly with npx:
npx hitlslack
Create a Slack App:
Enable Socket Mode:
socket-mode
(or any name you prefer)connections:write
xapp-1-
)SLACK_APP_TOKEN
Configure OAuth & Permissions:
chat:write
- Send messages as @yourappchannels:history
- View messages and other content in public channelschannels:read
- View basic information about public channelsusers:read
- View people in a workspacexoxb-
)SLACK_BOT_TOKEN
Enable Event Subscriptions:
message.channels
- Listen for messages in public channelsAdd Bot to Channel:
/invite @YourBotName
(replace with your app's name)Create a .env
file or set these environment variables:
# Required
SLACK_BOT_TOKEN=xoxb-your-bot-token
SLACK_APP_TOKEN=xapp-your-app-token
SLACK_CHANNEL_ID=C1234567890 # Channel where questions will be posted
SLACK_USER_ID=U1234567890 # User to mention and accept responses from
# Optional
RESPONSE_TIMEOUT_MS=300000 # Response timeout (default: 5 minutes)
LOG_LEVEL=info # Log level (default: info)
Alternatively:
...member/U1234567890
claude mcp add slack-human \
-s user \
-e SLACK_BOT_TOKEN='xoxb-your-bot-token' \
-e SLACK_APP_TOKEN='xapp-your-app-token' \
-e SLACK_CHANNEL_ID='C1234567890' \
-e SLACK_USER_ID='U1234567890' \
-- npx -y hitlslack@latest
Add to your claude_desktop_config.json
:
{
"mcpServers": {
"slack-human": {
"command": "npx",
"args": ["hitlslack"],
"env": {
"SLACK_BOT_TOKEN": "xoxb-your-bot-token",
"SLACK_APP_TOKEN": "xapp-your-app-token",
"SLACK_CHANNEL_ID": "C1234567890",
"SLACK_USER_ID": "U1234567890"
}
}
}
}
Set environment variables:
export SLACK_BOT_TOKEN="xoxb-your-bot-token"
export SLACK_APP_TOKEN="xapp-your-app-token"
export SLACK_CHANNEL_ID="C1234567890"
export SLACK_USER_ID="U1234567890"
Configure in Claude Code settings
ask_human
Ask a question to a human via Slack and wait for their response.
Parameters:
question
(string, required): The question to ask the humanExample:
AI: "I need to ask a human something"
Tool: ask_human({ question: "What environment should I deploy to?" })
Slack: "@user What environment should I deploy to?"
User: "Deploy to staging first"
Response: "Deploy to staging first"
reset_thread
Reset the conversation thread to start a new topic.
Parameters: None
Example:
Tool: reset_thread()
Response: "Thread reset. Next question will start a new conversation."
# Clone the repository
git clone https://github.com/mkusaka/hitlslack
cd hitlslack
# Install dependencies
pnpm install
# Build the project
pnpm run build
# Run tests
pnpm test
# Run tests with coverage
pnpm run test:coverage
# Watch mode
pnpm run test:watch
# Run in development mode
pnpm run dev
# Build and run
pnpm run build
pnpm start
# Type checking
pnpm run typecheck
# Linting
pnpm run lint
ask_human
tool with a questionconnections:write
scopexoxb-
and app token with xapp-
message.channels
event is subscribedMIT
Contributions are welcome! Please feel free to submit a Pull Request.
FAQs
MCP server that enables AI assistants to ask questions to humans via Slack
The npm package hitlslack receives a total of 0 weekly downloads. As such, hitlslack popularity was classified as not popular.
We found that hitlslack demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.