Slack Messages — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Slack Messages (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fuzzy search and browse Slack messages from the command line or as an MCP server.
npm install -g @cardmagic/slack-messagesgit clone https://github.com/cardmagic/slack-messages.git
cd slack-messages
pnpm install
pnpm build
npm linkYou need a User OAuth Token (starts with xoxp-), NOT a Bot token.
Important: Bot tokens (xoxb-...) only see the bot's own empty DMs. You must use a User token (xoxp-...) to access your messages.
Add these under "User Token Scopes" (not "Bot Token Scopes"):
| Scope | Purpose |
|---|---|
channels:history | Read public channel messages |
groups:history | Read private channel messages |
im:history | Read DM messages |
mpim:history | Read group DM messages |
users:read | Get user display names |
channels:read | List public channels |
groups:read | List private channels |
im:read | List DMs |
mpim:read | List group DMs |
channels:historychannels:readgroups:historygroups:readim:historyim:readmpim:historympim:readusers:readxoxp- - USE THIS ONExoxb- - don't use thisxoxp- token slack-messages auth
# Paste your token when prompted (input is hidden)After adding your token, verify it's correct:
slack-messages indexIf you see "Messages: 0" but you know you have messages, you likely used a Bot token by mistake. Go back to step 5 and get the User OAuth Token.
~/.slack-messages/config.json# Add your Slack workspace (token is prompted securely)
slack-messages auth
# Build the search index (fetches all messages)
slack-messages index
# For incremental updates later
slack-messages index --update#### Browse Commands
# Show most recent messages
slack-messages recent
# List users by recent activity
slack-messages contacts --limit 10
# List channels/DMs with message counts
slack-messages conversations
# Show recent messages from someone
slack-messages from "John Smith"
# Show full conversation in a channel
slack-messages thread "general" --after 2024-12-01#### Search Commands
# Search for messages
slack-messages search "quarterly report"
# Filter by sender
slack-messages search "project update" --from "Sarah"
# Filter by date
slack-messages search "meeting" --after 2024-01-01
# Adjust result count and context
slack-messages search "deadline" --limit 20 --context 5
# Show index statistics
slack-messages stats#### Workspace Management
# List configured workspaces
slack-messages workspaces
# Remove a workspace
slack-messages remove T0123456789| Option | Description |
|---|---|
-f, --from <sender> | Filter by sender name |
-a, --after <date> | Only messages after date (YYYY-MM-DD) |
-l, --limit <n> | Max results (default: 10) |
-c, --context <n> | Messages before/after (default: 2) |
Run as an MCP server for Claude Code integration:
slack-messages --mcp
# or
slack-messages mcpAdd to your Claude Code configuration:
claude mcp add --transport stdio slack-messages -- slack-messages --mcpOr manually in your MCP config:
{
"mcpServers": {
"slack-messages": {
"command": "npx",
"args": ["-y", "@cardmagic/slack-messages", "--mcp"]
}
}
}Available MCP Tools:
| Tool | Description |
|---|---|
search_messages | Search messages with fuzzy matching |
recent_messages | Get most recent messages |
list_contacts | List users by activity |
list_conversations | List channels/DMs with counts |
get_thread | Get conversation in a channel |
get_message_stats | Get index statistics |
~/.slack-messages/:config.json - Workspace tokensindex.db - SQLite FTS5 databasefuzzy.json - MiniSearch index for typo tolerancestats.json - Index statistics and cursors for incremental updatesusers.json - Cached user informationThe Slack API has rate limits. The tool uses the official @slack/web-api client which handles retries automatically. For large workspaces, initial indexing may take a while.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.