Slack is a collaboration platform for channels, messages, users, and workflows. Its MCP setup uses a Slack app and OAuth v2; do not substitute a copied user or owner token.
This guide prepares Slack for an MCP client. The Slack agent template is a separate deployment of the Dome workspace and agent configuration.
Choose a connection method
Slack MCP uses a Slack app with OAuth v2; copied user, owner, or bot tokens are not a supported substitute for this connection. See Slack's OAuth v2 guide and scope reference before configuring the app.
For Slack's complete MCP configuration, approval, and scope guidance, see the official Slack MCP server guide.
Recommended: Slack App with OAuth v2
Create a dedicated Slack app rather than connecting an owner's personal token. Start with a test workspace or a private test channel. Slack MCP uses a user token, so add the scopes under User scopes, not Bot scopes.
- Create an app in Slack API, choose Pick features, and select the target workspace.
- In the app's left sidebar, open Agents and turn on the Slack Model Context Protocol (MCP) Server feature. Without this, Slack does not publish an MCP tool catalog to the client.
- In OAuth & Permissions, add the exact redirect URL requested by the MCP client. For Dome, use
https://api.domesystems.ai/oauth/callback. - Under User scopes, add the read-only scope set below. Do not add Bot scopes,
chat:write, channel-management, file-write, canvas-write, or admin scopes. - When the creation flow asks which events the app should respond to, add no events and continue. The template queries Slack through MCP; it does not receive or react to Slack events.
- Install the app to the test workspace. A workspace admin must approve the installation if Slack's app-approval policy requires it.
- Copy the app's client ID and client secret for the MCP client, then authorize as the intended test identity.
Recommended read-only User scopes
Add these scopes only when you want the corresponding read capability:
- Search:
search:read.public,search:read.private,search:read.mpim,search:read.im,search:read.files,search:read.users - Channel and conversation history:
channels:history,groups:history,im:history,mpim:history - Channel and conversation metadata:
channels:read,groups:read,im:read,mpim:read - People and emoji:
users:read,emoji:read - Canvases and lists:
canvases:read,lists:read
For the Dome read-only Slack template, use the complete set above: it is the smallest scope set that supports all of the template's approved search, channel, thread, user, emoji, and list tools. If you need a narrower test, omit the matching tool from the governed gateway as well; never grant a scope merely because a tool is available.
For example, create a private #mcp-test channel containing a message such as “MCP test: the launch owner is Alex.” After authorization, ask the managed agent “What does #mcp-test say about the launch owner?” This tests search and conversation reads without adding write access or Slack event subscriptions.
Slack MCP requires an internal or directory-published app; unlisted apps cannot use it. Slack's MCP server documentation is authoritative when its scopes or approval requirements change.
Verify Slack MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Slack MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Slack boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
not_in_channel means the app has not been invited to the channel; it is not fixed by adding broad workspace scopes. A redirect mismatch must be corrected in the Slack app before starting OAuth again.
Next steps
Deploy the Slack agent template to create a governed agent in Dome that can work with the approved workspace and channels, with the template's included model, tools, and rules.
