Mcp Client Slack — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Client Slack (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP Server that listens for Slack @mentions and publishes them as events to the KĀDI event bus for real-time processing by template-agent-typescript.
This server is part of the KĀDI Slack bot architecture. It:
Slack @mention → Socket Mode → Event Validation → KĀDI Event Bus
↓
Topic: slack.app_mention.{BOT_USER_ID}
↓
Agent_TypeScript
↓
Claude API + Reply via mcp-server-slackThis server implements a publish-subscribe pattern using KĀDI's RabbitMQ infrastructure:
SlackMentionEvent to topic slack.app_mention.{BOT_USER_ID}cd C:\p4\Personal\SD\mcp-client-slack
npm installCreate .env file:
# Slack API Credentials
SLACK_BOT_TOKEN=xoxb-your-bot-token
SLACK_APP_TOKEN=xapp-your-app-token
# Anthropic Claude API (optional, not used in this server)
ANTHROPIC_API_KEY=sk-ant-your-key
# MCP Server Configuration
MCP_LOG_LEVEL=info
# KĀDI Broker Configuration (REQUIRED for event publishing)
KADI_BROKER_URL=ws://localhost:8080
SLACK_BOT_USER_ID=U01234ABCD| Variable | Required | Description | Example |
|---|---|---|---|
SLACK_BOT_TOKEN | ✅ Yes | Slack bot user OAuth token | xoxb-123... |
SLACK_APP_TOKEN | ✅ Yes | Slack app-level token for Socket Mode | xapp-1-A... |
KADI_BROKER_URL | ✅ Yes | WebSocket URL for KĀDI broker | ws://localhost:8080 |
SLACK_BOT_USER_ID | ✅ Yes | Slack bot user ID for event topic routing | U01234ABCD |
MCP_LOG_LEVEL | No | Logging level (debug, info, warn, error) | info |
ANTHROPIC_API_KEY | No | Not used (kept for backward compatibility) | sk-ant-... |
app_mentions:read - Listen for @mentionschat:write - (handled by mcp-server-slack)npm run devnpm run build
npm startAdd to kadi-broker/mcp-upstreams.json:
{
"id": "slack-client",
"name": "Slack Event Listener",
"type": "stdio",
"prefix": "slack_client",
"networks": ["slack"],
"stdio": {
"command": "node",
"args": ["C:/p4/Personal/SD/mcp-client-slack/dist/index.js"],
"env": {
"SLACK_BOT_TOKEN": "xoxb-...",
"SLACK_APP_TOKEN": "xapp-...",
"ANTHROPIC_API_KEY": "sk-ant-..."
}
}
}What Changed:
get_slack_mentions MCP tool (polling-based)Impact:
get_slack_mentionsslack.app_mention.{BOT_USER_ID} events insteadMigration Required:
KADI_BROKER_URL and SLACK_BOT_USER_ID to environment configurationAll KĀDI events follow the standardized topic pattern: `{platform}.{event_type}.{bot_id}`
slack, discord, etc.)app_mention, mention, etc.)Why bot_id is required:
Validation: Topics are automatically validated by @agents/shared package. Invalid patterns will log warnings but still publish.
See TOPIC_PATTERN.md for complete documentation.
slack.app_mention.{BOT_USER_ID}Published when the bot is @mentioned in Slack.
Event Payload (SlackMentionEvent):
{
id: string; // Unique mention ID (Slack event timestamp)
user: string; // Slack user ID who mentioned the bot
text: string; // Message text (with @bot mention removed)
channel: string; // Slack channel ID
thread_ts: string; // Thread timestamp for replies
ts: string; // Event timestamp from Slack
bot_id: string; // Slack bot user ID (routing identifier)
timestamp: string; // ISO 8601 datetime when event was published
}Example:
{
"id": "1234567890.123456",
"user": "U12345",
"text": "What's the weather today?",
"channel": "C12345",
"thread_ts": "1234567890.123456",
"ts": "1234567890.123456",
"bot_id": "U01234ABCD",
"timestamp": "2025-01-16T10:30:00.000Z"
}Agent_TypeScript subscribes to real-time events:
import { SlackMentionEventSchema } from './types/slack-events.js';
// Subscribe to Slack mention events
client.subscribeToEvent(`slack.app_mention.${botUserId}`, async (event: unknown) => {
// Validate event payload
const validationResult = SlackMentionEventSchema.safeParse(event);
if (!validationResult.success) {
console.error('Invalid event:', validationResult.error);
return;
}
const mention = validationResult.data;
// Process mention with Claude API
// Reply using mcp-server-slack tools
});⚠️ No longer supported - Update to event subscription:
// ❌ OLD (v1.x) - No longer works
const result = await client.getBrokerProtocol().invokeTool({
targetAgent: 'slack-client',
toolName: 'slack_client_get_slack_mentions',
toolInput: { limit: 5 },
timeout: 10000
});Step 1: Update Environment Variables
Add to .env:
KADI_BROKER_URL=ws://localhost:8080
SLACK_BOT_USER_ID=U01234ABCD # Get from Slack app settingsStep 2: Update Agent Code
Remove polling logic:
// ❌ Remove this
setInterval(async () => {
const result = await invokeTool({
targetAgent: 'slack-client',
toolName: 'slack_client_get_slack_mentions',
...
});
}, 10000);Add event subscription:
// ✅ Add this
import { SlackMentionEventSchema } from './types/slack-events.js';
client.subscribeToEvent(
`slack.app_mention.${process.env.SLACK_BOT_USER_ID}`,
async (event: unknown) => {
const mention = SlackMentionEventSchema.parse(event);
// Your existing processing logic
}
);Step 3: Update Dependencies
Install Zod for schema validation (if not already installed):
npm install zodStep 4: Test Event Flow
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.