---
name: iblai-connect-slack
description: "Read and write Slack data through the Slack Web API and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with Slack data, or to set up a Slack MCP connection on ibl.ai."
metadata:
  kind: guide
---

# Slack connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/slack — not part of the iblai/vibe repository. Checked against Slack's documentation on October 20, 2026; test it against your own Slack setup before you rely on it.

Slack holds a workspace's channels, direct messages, threads, files, canvases, lists and member profiles.

## Auth & conventions

- **API:** Slack Web API (REST). HTTP methods named by object.action (conversations.history, chat.postMessage) for reading channel history, posting and scheduling messages, searching, managing users, files, canvases and lists.
- **Base URL:** https://slack.com/api/{method}
- **Access:** Public, self-serve. Create a Slack app, request OAuth scopes and install it to a workspace. New commercial apps not approved for the Slack Marketplace get reduced conversations.history limits.
- **Auth:** OAuth 2.0 (OAuth v2 install); Bot token (xoxb); User token (xoxp); App-level token (xapp). OAuth v2 install returns tokens. Bot tokens act as the app with granular scopes and survive the installer leaving; user tokens act as a member with that member's access. App-level tokens cover the app across an organization.
- **Limits:** Tiered per method per workspace: Tier 1 1+/min, Tier 2 20+/min, Tier 3 50+/min, Tier 4 100+/min. Posting about 1 message/second per channel. 429 with Retry-After. New non-Marketplace apps: conversations.history 1 request/min, 15 objects.
- Keep Slack credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Channel history** — GET conversations.history; scopes channels:history, groups:history, im:history, mpim:history. Tier 3.
- **Threads** — conversations.replies returns the messages in a thread.
- **Search** — Search messages, files, users and channels (available as tools on the Slack MCP server).
- **Users and members** — Fetch user profiles and channel member lists.

## Writes

- **Post message** — POST chat.postMessage with chat:write; thread_ts posts a reply. About 1 message per second per channel. **Confirm with the user first.**
- **Schedule or draft message** — Schedule messages or create drafts (Slack MCP server tools). **Confirm with the user first.**
- **Canvases** — Create, read and update canvases.
- **Files** — Upload files to channels. **Confirm with the user first.**

## Expose it to an ibl.ai agent (MCP)

Slack publishes an official MCP server, Slack MCP server (https://docs.slack.dev/ai/mcp-server/). Register it below as-is, or host your own server that wraps the calls in this skill.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - For an API key or service credential use `auth_type=token` with `auth_scope=platform` for one key across the organization, or scope it to a single agent for one key per agent.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "Summarize what was decided in #launch-planning this week"
- "Find the thread where we discussed the Q3 pricing change and link it"
- "Post a status update to #eng-standup with today's open incidents"
- "Who on the support team mentioned the SSO outage yesterday?"

## Guardrails

- Messages and files hold confidential business communications and personal data; channels may contain regulated content depending on the organization.
- Request the narrowest Slack scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Respect the documented limits above: page through results and back off on rate-limit responses instead of retrying in a loop.

## References

- Slack MCP server: https://docs.slack.dev/ai/mcp-server/
- Web API rate limits: https://docs.slack.dev/apis/web-api/rate-limits
- Token types: https://docs.slack.dev/authentication/tokens
- Slack MCP server: https://docs.slack.dev/ai/mcp-server/
- This connector on ibl.ai: https://ibl.ai/developer/connectors/slack
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections