Update Slack MCP integration to Slack's official hosted MCP server (replace zencoderai/slack-mcp-server)

Start with integrations/catalog/slack.json, the Slack catalog entry identified in the issue, and read how its existing hosted and stdio options are described. Update the entry to document Slack’s hosted MCP setup prerequisites and the maintained OSS fallback with the stated token and production caveats. Run npm run build:integrations and the catalog tests named in the acceptance criteria; done when the entry and generated catalog meet those criteria.

Summary

Slack now offers an official hosted MCP server (https://mcp.slack.com/mcp). Our Slack integration's Customize pane currently links to the third-party zencoderai/slack-mcp-server, which is effectively abandoned. This issue documents the official option and recommends we update the integration to point to it.

This came out of partner feedback (Alianza): while reviewing our Slack MCP integration, they flagged the linked server as production-unfriendly and worked around it with a custom server.

Problem with the currently-linked server

zencoderai/slack-mcp-server:

• Single release v0.0.1, last repo push July 16, 2025 (~16 months stale)
• Non-standard license (NOASSERTION), ~75 stars / 39 forks, 6 open issues with no maintainer activity
• npm package @zencoderai/slack-mcp-server published once (2025-07-16), never updated

Slack's official hosted MCP server

• Docs: https://docs.slack.dev/ai/mcp-server/
• Endpoint: https://mcp.slack.com/mcp — JSON-RPC 2.0 over Streamable HTTP (SSE not supported; no Dynamic Client Registration)
• Capabilities: search (messages, files, users, channels, emoji), send/schedule messages, read channels & threads, create conversations, add/get reactions, canvases (create/read/update), user profiles, channel members, file uploads, Slack lists
• Auth: confidential OAuth 2.0 with user tokens; RFC 8414 metadata discovery (https://mcp.slack.com/.well-known/oauth-protected-resource, .../oauth-authorization-server); PKCE supported
• Governance (important for enterprise/partner trust):
  • Workspace admins must approve and manage MCP client integrations
  • Only Marketplace-published or internal apps may use MCP; unlisted apps are prohibited
  • MCP clients must be backed by a registered Slack app with a fixed, hardcoded app ID
  • Audit logs apply; per-tool rate limits (Tier 2–4); app IP allowlists are honored
• Turnkey clients: Claude.ai, Claude Code, Perplexity, Cursor (no coding required)
• Official companion: slackapi/slack-skills-plugin — actively maintained plugin that wires the hosted server into Claude Code / Cursor / Codex (published on the official Claude & Cursor marketplaces)

Recommendation

Update the Slack integration (Customize pane link + any docs) to use Slack's official hosted MCP server as the default:

1. Point the Customize pane entry for Slack MCP to https://docs.slack.dev/ai/mcp-server/ / https://mcp.slack.com/mcp
2. Document the setup path: register/choose a Slack app (internal or Marketplace), admin approval, OAuth via user tokens
3. Note the caveat that workspace admin approval is required before users can authenticate
4. Optionally keep an OSS fallback documented for self-hosted needs: korotovsky/slack-mcp-server (v1.3.0, May 2026, MIT, ~1.9k★) — with a warning to avoid its "stealth mode" (browser d-cookie auth) in production and prefer its OAuth mode
5. Reach back out to Alianza confirming the change

Acceptance criteria

• Slack MCP card/link no longer references zencoderai/slack-mcp-server
• Official hosted Slack MCP server documented in the integrations catalog
• Setup instructions cover app registration, admin approval, and OAuth scopes
• OSS alternative (korotovsky) documented with production caveats, if we choose to keep a self-hosted option

This issue was created by an AI agent (OpenHands) on behalf of the user.

OpenHands AI triage

The following comments and acceptance criteria were added by the OpenHands AI agent.

Triage

The Slack integration in this registry is the hand-authored catalog entry integrations/catalog/slack.json; the Customize pane renders it from the @openhands/extensions package, so a single-file catalog edit plus npm run build:integrations is the authoritative mechanism. The entry already carries a hosted-MCP OAuth option pointing at https://mcp.slack.com/mcp (endpoint verified live: reachable, auth enforced), but its docsUrl, notes, installHint, and non-OAuth fallback still reference the abandoned zencoderai/slack-mcp-server. The customer-support label and the Alianza report in this issue record real partner pain, so this is prioritized medium rather than low.

Scope: update integrations/catalog/slack.json only. Point the entry metadata and the hosted option at Slack's official MCP server per https://docs.slack.dev/ai/mcp-server/, state the documented setup prerequisites (internal or Marketplace Slack app, workspace-admin approval before users can connect, OAuth user tokens), and replace the stale stdio fallback with the maintained OSS server (slack-mcp-server, korotovsky/slack-mcp-server, MIT, actively released) using real app-token auth only.

Non-goals: shipping stealth/browser-cookie auth (SLACK_MCP_XOXC_TOKEN/SLACK_MCP_XOXD_TOKEN) anywhere in the entry; adding in-app Slack app registration or admin-approval flows; changing Agent Canvas UI; contacting Alianza (human follow-up); migrating previously saved Slack stdio connections in client apps; publishing setup guides outside the catalog entry.

Acceptance Criteria

• integrations/catalog/slack.json contains no reference to zencoderai/slack-mcp-server: the entry's docsUrl, notes, installHint, and every connection option resolve to Slack's official MCP server or the documented OSS fallback (verifiable by searching the file and loading the entry through the package read functions).
• The Slack entry documents Slack's official hosted MCP server: docsUrl resolves to Slack's official MCP server documentation, and the hosted connection option's transport URL is https://mcp.slack.com/mcp.
• The entry states the hosted server's setup prerequisites from Slack's docs: an internal or Marketplace Slack app backing the MCP client, workspace-admin approval required before users can connect, and OAuth user-token auth.
• The non-OAuth connection option runs the maintained OSS server (slack-mcp-server, korotovsky/slack-mcp-server) with env fields for a real Slack app bot or user token (e.g., SLACK_MCP_XOXB_TOKEN / SLACK_MCP_XOXP_TOKEN) and no stealth/browser-cookie fields (SLACK_MCP_XOXC_TOKEN / SLACK_MCP_XOXD_TOKEN).
• The entry notes the OSS fallback's production caveat: prefer the official hosted server, and prefer the OSS server's OAuth/user-token mode over unapproved stealth/browser-token use.
• npm run build:integrations leaves no drift in integrations/catalog-index.js, and the repo's integration-catalog tests pass (schema validation against integrations/catalog.schema.json plus tests/test_catalogs.py, tests/test_catalog_schema.py, tests/test_integration_catalog_in_sync.py under uv run pytest -q), with any test asserting Slack specifics updated to the new entry.
• Live validation of the changed entry follows the existing tests/test_live_integration_smoke.py pattern: the updated Slack smoke tests pass against a real Slack token (tool list plus at least one read-only call), or the PR documents the attempted live check and its outcome if credentials are unavailable.