Slack MCP server security: the scopes each tool needs, and the ones to leave out

The short answer

Slack’s official MCP server, at https://mcp.slack.com/mcp, acts with a user token, and each tool needs specific OAuth scopes on that token.¹ Request only the scopes the agent’s job needs. For a research agent that searches and reads, that means the search:read.* and *:history scopes and nothing with write. Leaving out chat:write and files:write removes the agent’s two easiest ways to send data somewhere. And replace @modelcontextprotocol/server-slack if you still run it: that reference server was archived in May 2025.²

How Slack’s server is built

A few design choices shape the risk, all from Slack’s overview page:¹

• User tokens. Tools act as the person who completed OAuth, so an agent can read every channel that person can.
• Admin approval. MCP client apps go through Slack’s standard app approval, so workspace admins can approve and manage them.
• Only listed apps. Only apps published in the Slack Marketplace and internal apps can use MCP; unlisted apps are prohibited.
• Audit logs. Slack points to its audit logs for MCP activity.

That last point is worth acting on. If you’re the admin, find MCP activity in the audit logs before you need it.

The scope map

Slack documents the scope each tool needs.¹ Sorted by what the scope lets the agent do:

Note the private ones. search:read.private, groups:history and im:history reach private channels and direct messages. An agent rarely needs your DMs.

Three minimal sets

A research agent that answers “what did we decide about X?”:

Code What the screen or file shows, copied as is.

search:read.public  channels:history  channels:read

Public channels only. Add search:read.private and groups:history only if the answer lives in private channels the agent should see.

A standup summarizer that reads one channel and posts one message:

Code What the screen or file shows, copied as is.

channels:history  channels:read  chat:write

chat:write is back, so keep the client’s approval prompt on for “send message”, and check the channel name in each request.

An incident helper that drafts a canvas from a channel:

Code What the screen or file shows, copied as is.

channels:history  channels:read  canvases:read  canvases:write

No chat:write and no files:write. It writes a canvas a person can read and share.

Why the write scopes matter most

Simon Willison’s “lethal trifecta” is private data, exposure to untrusted content and the ability to communicate externally.³ Slack can supply all three by itself. Private channels are the data. Any message from anyone, including external people in Slack Connect channels, is untrusted content. And chat:write or files:write is a way out: post a summary of a private channel into a shared one, or upload a file to a conversation an outsider can see.

Slack’s own advice points the same way: be careful about connecting the Slack server alongside other MCP servers, since each has its own security characteristics.¹ An agent with Slack read scopes and a separate tool that can reach the internet has the trifecta even without chat:write.

So the rule of thumb: an agent that reads widely shouldn’t write at all, and an agent that writes should read narrowly.

The archived reference server

@modelcontextprotocol/server-slack is one of the reference servers moved to modelcontextprotocol/servers-archived, created and archived on 28 May 2025.² Its README had you paste a bot token (xoxb-) into the config as SLACK_BOT_TOKEN, and it’s unmaintained.² Moving to Slack’s own server also moves you to OAuth, admin approval and audit logs.

What a config scanner sees

In our run of deedglass 0.13.0’s scan, the archived Slack server in the sample config added no write paths and no finding.⁴ The scanner didn’t flag the bot token written into the file either. If your configs still carry SLACK_BOT_TOKEN in an env block, find it with a search, rotate the token, and remove the entry:

Code Commands typed in a terminal. The text around it says what happens.

grep -rn "server-slack\|SLACK_BOT_TOKEN" .mcp.json .cursor .vscode ~/.cursor 2>/dev/null

A checklist

• No @modelcontextprotocol/server-slack in any config.
• The MCP client app is approved by a workspace admin.
• Scopes match the agent’s job; no *.im or *.mpim scopes unless needed.
• Agents that read widely don’t hold chat:write or files:write.
• Send-message and upload tools ask before each call.
• Someone knows where MCP activity shows up in the audit logs.

Questions people ask

Does the Slack MCP server use bot tokens or user tokens?

User tokens. Each tool needs specific scopes on the user token, and the agent acts as the user who signed in.¹

Which scope lets a Slack MCP agent send messages?

chat:write, for both sending and scheduling messages. Leave it out for agents that only read.¹

Is @modelcontextprotocol/server-slack still maintained?

No. It was archived on 28 May 2025 with the other retired reference servers.²

Related reading: the lethal trifecta, prompt injection, the same review for Notion’s MCP server, and the general MCP security checklist and ten-minute config audit.

To see what the rest of your agent setup can change, run npx deedglass scan in the repository (what the grade means), or watch the checks in the playground.

Written with AI assistance and checked against our claims register.