io.github.crunchtools/slack
Secure read-only MCP server for Slack workspaces
- Created
- 7 months ago
- Last commit
- 2 days ago
- Latest release
- v0.4.02 days ago
Security Findings
Tools out of server's stated scope2×
MaliciousScannerslack_send_message: Server is described as a 'Secure read-only MCP server for Slack workspaces,' but this tool sends/schedules messages — a write operation that contradicts the stated read-only scope.
slack_cancel_scheduled_message: Server is described as a 'Secure read-only MCP server for Slack workspaces,' but this tool cancels scheduled messages — a write/delete operation that contradicts the stated read-only scope.
Missing permission declaration
SuspiciousScannerServer declares no permissions across 17 tools
pull_request_target with secrets
MaliciousLineage[.github/workflows/ashigaru.yml] pull_request_target with secrets
Tools
17 tools exposed by this MCP server
slack_cancel_scheduled_message
Cancel a scheduled Slack message before it sends. Args: channel_id: Channel ID the message was scheduled in scheduled_message_id: The scheduled_message_id returned by slack_send_message Returns: Confirmation with scheduled_message_id
slack_send_message
Send or schedule a Slack message. When SLACK_ADD_MESSAGE_DELAY is set (default: 3m), the message is scheduled via chat.scheduleMessage, giving a cancellation window before delivery. Use slack_cancel_scheduled_message with the returned scheduled_message_id to cancel. Set SLACK_ADD_MESSAGE_DELAY=0 to post immediately. Args: channel_id: Channel ID (starts with C, D, or G) text: Message text (Markdown supported) thread_ts: Parent message timestamp to reply in-thread Returns: scheduled_message_id + post_at (if scheduled) or ts (if immediate)
slack_auth_test
Test Slack authentication and get info about the token owner. Returns the authenticated user's ID, team ID, team name, username, and workspace URL. Use this to verify the connection is working.
slack_get_channel_history
Get message history from a Slack channel. Args: channel_id: Channel ID (starts with C, D, or G) limit: Max messages to return, 1-1000 (default: 100) cursor: Pagination cursor from previous response oldest: Only messages after this timestamp (e.g., 1234567890.123456) latest: Only messages before this timestamp inclusive: Include messages at oldest/latest boundary Returns: List of messages with pagination metadata
slack_get_channel_info
Get detailed information about a Slack channel. Args: channel_id: Channel ID (starts with C, D, or G) Returns: Channel details including name, topic, purpose, member count
slack_get_file_info
Get metadata about a Slack file (no content download). Args: file_id: File ID (starts with F) count: Number of comments per page (default: 100) page: Page of comments (default: 1) Returns: File metadata, comments, and pagination info
slack_get_reactions
Get reactions for a specific Slack message. Args: channel_id: Channel ID (starts with C, D, or G) timestamp: Message timestamp (e.g., 1234567890.123456) full: If true, return complete reaction list for each emoji Returns: Message with its reactions
slack_get_thread_replies
Get replies in a Slack message thread. Args: channel_id: Channel ID (starts with C, D, or G) thread_ts: Timestamp of the parent message limit: Max replies to return, 1-1000 (default: 100) cursor: Pagination cursor from previous response oldest: Only replies after this timestamp latest: Only replies before this timestamp inclusive: Include messages at oldest/latest boundary Returns: List of thread messages with pagination metadata
slack_get_user_info
Get information about a Slack user. Args: user_id: User ID (starts with U, W, or B) Returns: User details including name, email, status, timezone
slack_get_user_profile
Get a Slack user's profile information. Args: user_id: User ID (starts with U, W, or B) include_labels: Include custom profile field labels Returns: User profile with display name, status, image URLs, custom fields
slack_list_channel_members
List members of a Slack channel. Args: channel_id: Channel ID (starts with C, D, or G) limit: Max members to return, 1-1000 (default: 200) cursor: Pagination cursor from previous response Returns: List of member user IDs with pagination metadata
slack_list_channels
List channels in the Slack workspace. Args: types: Comma-separated channel types: public_channel, private_channel, mpim, im exclude_archived: Exclude archived channels (default: true) limit: Max results per page, 1-1000 (default: 200) cursor: Pagination cursor from previous response Returns: List of channels with pagination metadata
slack_list_files
List files in the Slack workspace (metadata only, no content download). Args: channel_id: Filter by channel ID user_id: Filter by uploader's user ID types: Filter by types (comma-separated: spaces, snippets, images, gdocs, zips, pdfs, all) count: Results per page, 1-100 (default: 100) page: Page number (default: 1) ts_from: Filter files created after this Unix timestamp ts_to: Filter files created before this Unix timestamp Returns: File metadata list with pagination info
slack_list_reactions
List reactions made by a user. Args: user_id: User ID to list reactions for (default: authenticated user) count: Results per page, 1-100 (default: 100) page: Page number (default: 1) full: If true, return complete reaction list Returns: Reaction items with pagination info
slack_list_stars
List starred items for the authenticated user. Args: count: Results per page, 1-100 (default: 100) page: Page number (default: 1) cursor: Pagination cursor from previous response Returns: Starred items with pagination info
slack_list_users
List users in the Slack workspace. Args: limit: Max users to return, 1-1000 (default: 200) cursor: Pagination cursor from previous response Returns: List of workspace members with pagination metadata
slack_search_messages
Search messages in the Slack workspace. Supports Slack search modifiers: from:user, in:channel, has:link, before:date, after:date, during:month. Args: query: Search query string sort: Sort by "timestamp" or "score" (default: timestamp) sort_dir: Sort direction "asc" or "desc" (default: desc) count: Results per page, 1-100 (default: 20) page: Page number (default: 1) Returns: Matching messages with total count and pagination info
Versions
1- 0.1.2Scanned Oct 22, 2026, 04:18 AMHigh