setup-slack-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-slack-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Guide the user step-by-step through setting up the redhat-community-ai-tools/slack-mcp server for Claude Code.
The server uses browser session tokens (xoxc/xoxd) extracted from a logged-in Slack session — no Slack admin approval or OAuth app required.
Check if the plugin is already installed:
cat ~/.claude/plugins/installed_plugins.json 2>/dev/null || echo '{}'If slack-mcp does not appear in the output, the plugin needs to be registered as a marketplace source first. Read ~/.claude/settings.json and add redhat-community-ai-tools under extraKnownMarketplaces (create the key if it doesn't exist, preserve all existing content):
"extraKnownMarketplaces": {
"redhat-community-ai-tools": {
"source": {
"source": "settings",
"name": "redhat-community-ai-tools",
"plugins": [
{
"name": "slack-mcp",
"source": {
"source": "github",
"repo": "redhat-community-ai-tools/slack-mcp"
}
}
]
}
}
}Then tell the user:
I've updated your ~/.claude/settings.json. Please run these two commands in the Claude Code prompt box, then come back:>
1./reload-plugins2./plugin install slack-mcp@redhat-community-ai-tools
>
Once installed, tell me and I'll continue the setup.
Wait for the user to confirm before proceeding.
python3 --version # needs 3.8+
podman --version # or: docker --versionIf podman/docker is missing, tell the user to install it and stop here.
The setup script handles everything from here: venv creation, Playwright install, token extraction, wrapper script generation, and Claude Code registration.
Download and run it in a separate terminal (it cannot run inside Claude Code because it opens a browser window):
python3 <(curl -fsSL https://raw.githubusercontent.com/redhat-community-ai-tools/slack-mcp/main/scripts/setup-slack-mcp.py)Or if the user has already cloned this repo:
python3 /path/to/slack-mcp/scripts/setup-slack-mcp.pyTell the user:
Run the script in a separate terminal. It will:
>
1. Install Playwright and Chromium (one-time, ~2 min) 2. Pull thequay.io/redhat-ai-tools/slack-mcpcontainer image 3. Open a Chromium browser — log in to Slack, then press Enter in the terminal 4. Prompt you for a Slack channel ID to receive server logs (a self-DM or DM with Slackbot works well — navigate there in https://app.slack.com and copy the last segment of the URL) 5. Write the wrapper script and update~/.claude/settings.jsonautomatically
>
Come back here when the script prints "Setup complete!"
Wait for the user to confirm the script finished before proceeding.
Tell the user:
Please fully restart Claude Code now. The slack MCP tools will not be available until the next session.Wait for the user to confirm they have restarted.
The slack MCP server should now appear in the available tools. Suggest they test it by asking: "What channels do I have access to in Slack?"
Tokens expire when the Slack browser session ends (typically weeks to months). When they stop working, run:
python3 /path/to/slack-mcp/scripts/setup-slack-mcp.py --refresh-tokensNo other changes needed — the wrapper script picks up the new tokens automatically.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.