Slack connector

Index Slack channels and threads. Two flavours: Slack App OAuth (recommended for workspaces) and Bot token (for managed Slack Enterprise Grid orgs that don't allow the OAuth flow).

Option A — Slack App OAuth (recommended)

1. In the OrgMCP admin console, open Connectors → Add → Slack.
2. Click Add to Slack. You will be bounced to your workspace's Slack OAuth consent screen. Approve the requested scopes:
   • channels:read, groups:read — list channels.
   • channels:history, groups:history — read message history (RAG ingest).
   • users:read, users:read.email — resolve user ids and emails. Existing workspace installs must reinstall the Slack app to pick up users:read.email.
   Do not expect search:read on this screen. That scope is user-token only — Slack has no bot equivalent, and requesting it on a tenant install fails with "Invalid permissions requested". Live slack_search_messages needs a personal Slack connector. Indexed channel history is searched via search_company_rag after you invite the bot.
3. Slack returns you to /api/oauth/slack/callback; the credential is stored KMS-encrypted in the per-tenant connector_credentials row.
4. Invite the OrgMCP bot to each channel you want indexed: in Slack, type/invite @OrgMCP in that channel.

Rotation: the OAuth refresh-token flow keeps the bot token fresh automatically. Disconnecting the connector revokes the install on the Slack side.

Option B — Bot token paste

1. Install your Slack App manually (via theapi.slack.com/apps/<app>/install-on-team page) and copy the resulting xoxb-… bot token.
2. In the OrgMCP admin console, paste the token under Connectors → Add → Slack → bot token paste.
3. Optionally pin a SLACK_TEAM_ID when the same app spans multiple workspaces under one credential.

Channel allowlist

The optional allowlist constrains which channel ids the connector exposes to MCP tools and the RAG crawler. Empty = every channel the bot is a member of. Format is comma-separated channel ids (C…); copy them from the Slack URL of each channel.

Verify the connection

After connecting, hit Test connection. It authenticates (auth.test) and reports how many channels the bot can see and how many it is actually a member of. A bot that is a member of zero channels fails the test on purpose — it can read nothing until you invite it with /invite @OrgMCP. Agents can run the same probe via the slack_diagnose MCP tool. If a channel sync indexes nothing, the source's sync warning names the reason (bot not in channel, archived channel, or an empty lookback window).

What gets indexed

• Top-level channel messages from the last 365 days (configurable lookback), up to 1000 messages per channel. Older or extra messages are skipped with a Partial sync warning.
• Thread replies, when the parent message is in scope.
• User permalinks, so RAG-search results can deep-link the answer back to the source message.

What does not get indexed

• Direct messages or group DMs (private to the participants).
• Channels the bot is not a member of (workspace-wide listing is intentionally out of scope for v1).
• Slack files / attachments (the message text is indexed; binary content is not).
• Channels containing user PII that you exclude via the allowlist or have not invited the bot to.

Audience visibility

Each channel can be configured as a separate knowledge source with its own audience. Public engineering channels typically map to a Group: Engineering audience; the all-hands channel maps to Whole tenant; an executive channel might be Group: Leadership.

For personal-OAuth installs (DM-style "my own Slack"), the audience is fixed to user:<you> — see Personal connectors.