Nomos Slack Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Nomos Slack Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that lets AI agents read and write Slack messages as you — not as a bot. Messages, reactions, and status updates appear exactly as if you typed them yourself.
Built for Claude Code and any MCP-compatible client. Supports multiple Slack workspaces with independent authentication.
Existing Slack integrations send messages as a bot with an APP badge. This uses Slack user tokens (xoxp-) so your agent operates as you — indistinguishable from you being at the keyboard.
#channel-name, @username, or raw channel IDs~/.nomos/slack/config.json with 0600 permissionsFor each workspace you want to connect:
slack-app-manifest.yml (or use the JSON version)[!TIP] The manifest pre-configures all required User Token Scopes and the OAuth redirect URL. No manual scope configuration needed.
git clone https://github.com/project-nomos/nomos-slack-mcp.git
cd nomos-slack-mcp
pnpm install
pnpm buildOption A: OAuth flow (recommended)
pnpm add-workspaceYou'll be prompted for:
work, side-project)The script opens your browser for OAuth authorization and stores the user token automatically.
Option B: Manual token
pnpm add-workspace -- --manualPaste your xoxp- token directly. Find it in your Slack App under OAuth & Permissions → User OAuth Token.
Repeat for each workspace.
claude mcp add nomos-slack -- node /path/to/nomos-slack-mcp/dist/src/index.jsOr add to your MCP config manually:
{
"mcpServers": {
"nomos-slack": {
"command": "node",
"args": ["/path/to/nomos-slack-mcp/dist/src/index.js"]
}
}
}| Tool | Description |
|---|---|
slack_list_workspaces | List configured workspaces and which is default |
slack_list_channels | Browse channels, DMs, groups — filter by type or name |
slack_read_messages | Read recent messages from any channel or DM |
slack_read_thread | Read all replies in a thread |
slack_send_message | Send a message as you |
slack_reply_thread | Reply in a thread as you |
slack_search | Search messages with Slack operators (from:, in:, before:, etc.) |
slack_list_users | List or search workspace members |
slack_set_status | Set your status emoji and text |
slack_react | Add a reaction to a message |
All tools that accept a channel parameter understand:
#general — public/private channel by name@john — opens a DM with that userC0123ABCDEF — raw Slack channel IDEvery tool accepts an optional workspace parameter. Omit it to use your default workspace.
"Read my DMs in the side-project workspace"
→ slack_read_messages({ workspace: "side-project", channel: "@alice" })Config is stored at ~/.nomos/slack/config.json:
{
"workspaces": {
"work": {
"token": "xoxp-...",
"teamId": "T01ABC123",
"teamName": "Acme Corp",
"userId": "U01XYZ789",
"addedAt": "2026-03-26T10:00:00Z"
},
"side-project": {
"token": "xoxp-...",
"teamId": "T02DEF456",
"teamName": "Side Project",
"userId": "U02UVW012",
"addedAt": "2026-03-26T11:00:00Z"
}
},
"defaultWorkspace": "work"
}File permissions are set to 0600 (owner read/write only).
All scopes are User Token Scopes (not Bot Token Scopes). The included app manifest configures these automatically.
| Scope | Purpose |
|---|---|
channels:history | Read messages in public channels |
channels:read | List public channels |
groups:history | Read messages in private channels |
groups:read | List private channels |
im:history | Read direct messages |
im:read | List direct messages |
mpim:history | Read group DMs |
mpim:read | List group DMs |
chat:write | Send messages as you |
users:read | List workspace members |
users:read.email | See member emails |
search:read | Search messages |
users.profile:write | Set your status |
reactions:write | Add reactions |
reactions:read | Read reactions |
# Install dependencies
npm install
# Build
npm run build
# Type-check without emitting
pnpm check
# Watch mode
pnpm devsrc/
├── index.ts # MCP server entry point (stdio transport)
├── config/
│ ├── config-manager.ts # Read/write ~/.nomos/slack/config.json
│ └── types.ts # TypeScript interfaces
├── slack/
│ ├── client-manager.ts # Per-workspace WebClient instances + channel/user resolution
│ └── formatters.ts # Format Slack API responses for LLM consumption
├── tools/
│ ├── index.ts # Tool registry
│ ├── list-workspaces.ts
│ ├── list-channels.ts
│ ├── read-messages.ts
│ ├── read-thread.ts
│ ├── send-message.ts
│ ├── reply-thread.ts
│ ├── search.ts
│ ├── list-users.ts
│ ├── set-status.ts
│ └── react.ts
├── oauth/
│ ├── flow.ts # OAuth 2.0 token exchange
│ └── server.ts # Local callback server for OAuth
scripts/
└── add-workspace.ts # CLI for adding workspaces~/.nomos/slack/config.json with 0600 file permissionsxoxp-"No workspaces configured" Run pnpm add-workspace to add a workspace.
"Token must be a user token (xoxp-...)" You're using a bot token (xoxb-). Go to your Slack App → OAuth & Permissions → copy the User OAuth Token, not the Bot User OAuth Token.
"Channel #foo not found" The user token can only see channels you've joined. Join the channel in Slack first.
"missing_scope" errors Your Slack App is missing required scopes. Re-create the app using the provided manifest or manually add the missing scope under OAuth & Permissions → User Token Scopes, then reinstall the app.
Rate limiting The Slack SDK handles 429 responses with automatic retry. If you hit persistent rate limits, reduce the frequency of requests. History endpoints are Tier 2 (~20 req/min), most others are Tier 3 (~50 req/min).
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.