# slack-mcp-server

> Session-based Slack MCP for Claude and MCP clients: local-first workflows, secure-default HTTP.

- **URL**: https://www.freshcrate.ai/projects/slack-mcp-server
- **Author**: jtalk22
- **Category**: MCP Servers
- **Latest version**: `v4.3.0` (2026-05-12)
- **License**: MIT
- **Source**: https://github.com/jtalk22/slack-mcp-server
- **Homepage**: https://mcp.revasserlabs.com
- **Language**: JavaScript
- **GitHub**: 22 stars, 14 forks
- **Registry**: github
- **Tags**: `ai-agents`, `automation`, `claude`, `claude-code`, `claude-desktop`, `cli`, `developer-tools`, `javascript`, `llm`, `model-context-protocol`

## Description

Session-based Slack MCP for Claude and MCP clients: local-first workflows, secure-default HTTP.

## Recent releases

| Version | Date | Urgency | Changes |
| --- | --- | --- | --- |
| `v4.3.0` | 2026-05-12 | High | ## Added  - **`--refresh-tokens` CLI flag** — `npx -y @jtalk22/slack-mcp --refresh-tokens` now runs the Chrome auto-extract path (equivalent to `npm run tokens:auto`). Closes the gap between the wizard-only `--setup` flag and the unscheduled-by-default token-refresh capability. Designed to be called from a LaunchAgent, cron, or CI to keep tokens fresh while Claude is closed for weeks at a time. - **Token-refresh LaunchAgent docs** (`docs/SETUP.md`) — Optional macOS LaunchAgent template that runs |
| `v4.2.2` | 2026-04-26 | High | **Patch release. Hardens the shell-exec surface to clear AgentScore advisory [AGENTSCORE-2026-0016](https://dev.to/) (90→80, LOW→MODERATE).**  ## Why this exists  AgentScore flagged v4.2.0 for `command_injection: shell execution with template literal input`. Two surfaces matched:  \| File \| Line \| Variable \| Source \| \|---\|---\|---\|---\| \| `scripts/token-cli.js` \| 146-147 \| `KEYCHAIN_SERVICE` \| Hardcoded `"slack-mcp-server"` (lib/token-store.js:18) \| \| `lib/handlers.js` \| 58 \| `tempPath` \| Internal |
| `v4.1.0` | 2026-03-31 | Medium | ## Chrome DB Decryption. Stealth Mode. Zero OAuth.  **v4.1.0** reads Slack session cookies directly from Chrome's encrypted SQLite store — PBKDF2 + AES-128-CBC via macOS Keychain. No DevTools. No manual copy-paste. No OAuth app install.  ### What's New  - **Chrome DB decryption** — `npm run tokens:auto` extracts the `d` cookie from Chrome's encrypted cookie jar. The `d` cookie is HttpOnly (invisible to `document.cookie`), so this is the only path that doesn't require manual intervention. - **Ste |
| `v4.0.0` | 2026-03-30 | Medium | 16 tools, one-command setup, works where Slack's official MCP server doesn't.  Slack's official MCP requires a registered app and admin approval, and [doesn't work with Claude Code or GitHub Copilot](https://github.com/anthropics/claude-code/issues/30564) due to OAuth/DCR incompatibility. This server uses your browser session instead — no app registration, no admin, no OAuth.  ### What you get  - **16 tools** — search, messages, threads, DMs, reactions, unreads, user lookup, send messages. |
| `v3.2.5` | 2026-03-12 | Low | ## v3.2.5 — metadata, discovery, and company-led Cloud routing Align public metadata, release proof, and hosted buyer-routing around the current company-led Slack MCP Cloud surface.  ### Improved - aligned `package.json`, `package-lock.json`, `server.json`, and `glama.json` on `3.2.5` - refreshed public README, Pages, and docs so Cloud routing points to pricing, workflows, Gemini CLI, readiness, procurement, deployment review, and support - added a checked distribution ledger for MCP Registry, G |
| `v3.2.4` | 2026-03-11 | Low | ## v3.2.4 — Distribution Parity and Support Paths  `v3.2.4` restores version parity across the shipped runtime, Docker smoke path, registry metadata, and current public trust surfaces while aligning support paths for self-hosted and managed deployment modes.  ```bash npx -y @jtalk22/slack-mcp@latest --version npx -y @jtalk22/slack-mcp@latest --doctor ```  ### Improved  - **Runtime version integrity** — CLI, setup wizard, HTTP transport, web mode, and Docker smoke output now derive their release |
| `v3.2.3` | 2026-03-11 | Low | Replace personal email with role-based `@revasserlabs.com` addresses across all customer-facing surfaces.  ### Changes - Author/support email → `support@revasserlabs.com` - Privacy/GDPR/CCPA contact → `privacy@revasserlabs.com` - Social preview card: email → URL (`mcp.revasserlabs.com`)  ### What's NOT changed - CI/attribution scripts — structural git identity - Historical release notes — frozen records - All MCP tools and API behavior unchanged  ```bash npx -y @jtalk22/slack-mcp@3.2.3 --version |
| `v3.2.2` | 2026-03-10 | Low | ## What's Changed  ### Security - Patched 5 npm audit vulnerabilities (3 high, 1 moderate, 1 low)   - hono 4.12.2 → 4.12.7 (cookie injection, SSE injection, arbitrary file access)   - @hono/node-server 1.19.9 → 1.19.11 (auth bypass via encoded slashes)   - express-rate-limit 8.2.1 → 8.3.1 (IPv4-mapped IPv6 rate limit bypass)   - ajv 8.17.1 → 8.18.0 (ReDoS)   - qs 6.14.1 → 6.14.2 (DoS)  ### Registry & Ecosystem - Homepage URL → `mcp.revasserlabs.com` (canonical cloud landing page) - server.json, |
| `v3.2.0` | 2026-03-10 | Low | ## v3.2.0 — Reactions, Unreads, User Search  `v3.2.0` adds 5 new tools across all three transports: emoji reactions, mark-as-read, unread inbox, and user search. Tool count moves from 11 to 16.  ```bash npx -y @jtalk22/slack-mcp@latest --version npx -y @jtalk22/slack-mcp@latest --doctor ```  ### New Tools  \| Tool \| Purpose \| \|------\|---------\| \| `slack_add_reaction` \| Add emoji reactions to messages \| \| `slack_remove_reaction` \| Remove emoji reactions from messages \| \| `slack_conversations_mark` |
| `v3.1.0` | 2026-03-10 | Low | ## v3.1.0 — Cloud + Key Delivery  `v3.1.0` adds the Cloud product surface and post-checkout key delivery page.  ```bash npx -y @jtalk22/slack-mcp@latest --version npx -y @jtalk22/slack-mcp@latest --doctor ```  ### What Changed  - **Cloud landing page** — `cloud.html` introduces Slack MCP Cloud: a hosted MCP endpoint with one URL, 13 tools, encrypted token storage, and zero local config. Solo ($19/mo) and Team ($49/mo) plans with Stripe checkout. - **Post-checkout key delivery** — `success.html` |

## Citation

- HTML: https://www.freshcrate.ai/projects/slack-mcp-server
- Markdown: https://www.freshcrate.ai/projects/slack-mcp-server.md
- Dependencies JSON: https://www.freshcrate.ai/api/projects/slack-mcp-server/deps

_Generated by freshcrate.ai. Indexes github releases for AI-agent ecosystem packages._