Table of contents
Is there an official Slack MCP server? Yes - since 17 February 2026, Slack has run its own remote MCP server at mcp.slack.com/mcp, alongside a Real-Time Search API that gives connected AI agents live, permission-aware access to workspace conversations. If you’ve been searching for a way to let Claude, Cursor or another AI assistant read and post to Slack without cobbling together a bot token yourself, this is the connection Slack wants you to use.
This information is correct as of August 2026.
We cover an MCP server for one part of the martech stack most weeks on this blog - GA4, Google Ads, Figma, GitHub - and Slack has been a conspicuous gap. That’s not because nobody wanted it. It’s because for the best part of a year, the only options were a deprecated Anthropic reference server with a serious security hole, or a capable but unofficial community project. Slack’s own server changes that calculus.
What changed: Slack’s MCP server went GA in February 2026
Slack (now part of Salesforce) first previewed its Model Context Protocol server and Real-Time Search (RTS) API at Dreamforce in October 2025, then took both to general availability on 17 February 2026. In the four months between limited release and GA, tool calls against the two grew 25x, and more than 50 partners, including Anthropic, Google, OpenAI and Perplexity, built agents on top of it.
The official server:
- Is remote and hosted by Slack itself, so there’s nothing to deploy or maintain on your side
- Authenticates with user-token OAuth 2.0, behind a workspace admin approval step before any app can connect
- Inherits the authenticating user’s own Slack permissions, rather than granting a separate service account broad access
- Pairs with the Real-Time Search API, so agents query live conversational data rather than a stale export
In practice, this means a marketing team using Claude or Cursor can now ask an AI assistant to search a channel, summarise a thread, or post an update, and have that request flow through Slack’s own infrastructure and permission model rather than a third party’s.
Slack MCP server options compared
Three distinct servers now sit under the “Slack MCP” umbrella, and they’re not interchangeable:
| Slack’s official server | korotovsky/slack-mcp-server (community) | Anthropic’s reference server | |
|---|---|---|---|
| Status | Actively maintained, GA since Feb 2026 | Actively maintained, MIT licensed | Archived May 2025, will not be patched |
| Hosting | Remote, hosted by Slack | Self-hosted (Docker, Stdio, SSE, HTTP) | Self-hosted |
| Auth | User-token OAuth 2.0, admin approval required | User, bot or browser-session (“stealth mode”) tokens | Bot token |
| Permissions | Inherits the authenticating user’s own Slack permissions | Configurable; stealth mode needs no admin approval | Bot scopes set at install |
| Write access | Yes, within user permissions | Yes, opt-in per channel | Yes |
| Known security issue | None reported at GA | Stealth mode bypasses Slack’s audit trail | CVE-2025-34072, data exfiltration via link unfurling |
| Best for | Most teams, especially anyone needing admin oversight | Teams wanting self-hosting, GovSlack, or capabilities beyond the official tool set | Nobody - do not use |
For nearly every marketing team, the official server is the right starting point: it’s the option that comes with Slack’s own audit trail and admin approval flow already built in.
Security considerations
The starkest illustration of what can go wrong is Anthropic’s own original Slack server. Security researchers disclosed CVE-2025-34072 in May 2025: a prompt-injection attack could instruct the connected AI agent to embed stolen data (API keys, private message content) as a URL parameter and post it to a Slack channel. Slack’s own link-unfurling bots would then silently fetch that URL, sending the embedded data straight to an attacker’s server, with nothing visible in the channel itself. Anthropic archived the repository two days after the report and has said it won’t be patched.
That’s a specific, disclosed vulnerability in a specific, now-dead server, not a knock against MCP or Slack’s own implementation. But it’s a useful reminder of the general risk: any Slack MCP server, official or community, returns whatever the connected account can see, and Slack workspaces are often where the messiest, most sensitive first-party data in a company lives - PII, credentials, source code, deal terms. That’s why several enterprise vendors now offer a dedicated DLP layer that inspects MCP tool responses before they reach the model, sitting on top of either the official or community server rather than replacing it. If your workspace holds regulated data, that extra layer is worth evaluating before you connect any AI client at scale, official server or not.
Practical marketing use cases
Once connected, a Slack MCP server turns your workspace from an archive you have to search manually into something an AI agent can query directly:
- Surfacing decisions from threads: “What did we decide about the Q3 pricing page copy in #website-redesign?” instead of scrolling back through weeks of messages
- Posting campaign summaries: an agent that’s just finished analysing a campaign can post the result straight to your #marketing channel, formatted and ready to discuss
- Onboarding context for new team members: pointing an AI assistant at relevant channels so it can answer “why did we choose this positioning?” from the actual discussion, not a stale wiki page
- Cross-tool workflows: pairing Slack with other connected MCP servers (see the full MCP servers list) so an agent can pull a metric from analytics and post the finding to Slack in one conversational request
Getting started checklist
- Confirm your Slack plan and admin access - connecting any MCP app requires workspace admin approval
- Review the Slack MCP server overview in Slack’s developer docs to see the current tool list (messages, threads, users, channels, canvases)
- Choose an MCP-compatible client that supports Slack’s connector - Claude, Cursor and several others are named directly by Slack
- Have your admin approve the integration and scope which channels it can access
- Decide whether you need a DLP layer on top, based on how sensitive your workspace content is
- Test with a narrow, low-risk channel before rolling access out workspace-wide
If you’d rather not run MCP yourself, see how GA4’s MCP server compares as a lower-stakes starting point, or check whether MCP still has staying power before investing further engineering time.
“Slack’s Real-Time Search and MCP capabilities make it easier for teams to securely surface and apply the insights that live inside Slack.”
Tao Zhang, Co-founder and CPO, Manus
About Growth Method
A Slack MCP server is built for pulling context out of a conversation, a genuinely useful capability when decisions live in threads instead of documents. Growth Method is the agentic marketing platform for B2B teams: plan, launch, and analyse campaigns with pre-built AI agents that work from your live marketing data. Connect your martech stack, including the analytics and CMS tools your Slack conversations reference, and both your team and your AI agents can turn a decision made in Slack into a tracked campaign, not just a summarised thread.
Get started to connect your stack and run your next campaign from the data, not a scrolling channel.
Frequently asked questions
Is there an official Slack MCP server?
Yes. Slack’s own remote MCP server, hosted at mcp.slack.com/mcp, reached general availability on 17 February 2026 alongside Slack’s Real-Time Search API. It authenticates with user-token OAuth behind a workspace admin approval flow and lets MCP-compatible AI clients read and post to Slack within the authenticating user’s existing permissions.
How is Slack’s official server different from the community korotovsky/slack-mcp-server?
Slack’s official server is remote and hosted by Slack, uses standard OAuth, and inherits the authenticating user’s permissions with admin approval required. The community korotovsky/slack-mcp-server is self-hosted, supports user, bot and browser-session tokens including a “stealth mode” that needs no workspace admin approval, and offers a wider tool set, but it bypasses Slack’s own audit trail and its export terms carry legal risk at workspace scale.
What happened to Anthropic’s original Slack MCP server?
Anthropic published a reference Slack MCP server when it launched MCP in November 2024. Security researchers reported a data-exfiltration vulnerability in May 2025 (CVE-2025-34072, CVSS 9.3), where link unfurling could silently leak private data to an attacker’s server. Anthropic archived the repository on 29 May 2025 and it will not be patched.
Is the Slack MCP server free to use?
Connecting to Slack’s official server is free - you’re authorising an existing AI client against your own Slack account and permissions, though a workspace admin must approve the integration. The community server is also free and open-source (MIT licensed), but self-hosting it carries your own infrastructure costs.
Is it safe to connect an AI agent to Slack via MCP?
It depends on the server and what you connect it to. Slack’s official server honours Slack’s permission model, but any MCP server that reads Slack still surfaces whatever the connected account can see, including sensitive messages and files, so many enterprise teams add a dedicated DLP layer on top rather than relying on the base connection alone.