Slack

Connect Cosmo to your Slack workspace to search messages, read channels, send messages, and manage canvases.

Cosmo's Slack integration connects to Slack's official hosted MCP server (mcp.slack.com) — the same pattern as Atlassian and Pylon. There is no binary to install. Each user authorizes with their own Slack account, so the AI accesses only what that user can see.

How it works

Desktop / CLI
  └── RemoteOAuthProvider (staticClientId + staticClientSecret)
        └── StreamableHTTPClientTransport
              └── https://mcp.slack.com/mcp   ← Slack-hosted MCP server

Tokens are stored locally on each user's device (~/.cosmo/mcp-tokens/<instanceId>.json). They are never uploaded to the Cosmo server.

Unlike Atlassian (which supports Dynamic Client Registration), Slack requires a registered Slack App with a fixed Client ID and Client Secret. These are stored on the Cosmo server at seed time and passed to the OAuth flow as static credentials.

What Cosmo can do

Tool	Capability	Required scopes
Search messages & files	Full-text search across the workspace	`search:read`
Search users	Find users by name or email	`search:read`, `users:read`
Search channels	Find channels by name or topic	`search:read`, `channels:read`
Send message	Post to a channel or DM	`chat:write`
Read a channel	Fetch recent messages	`channels:history`, `groups:history`
Read a thread	Fetch all replies in a thread	`channels:history`, `groups:history`
Create a canvas	Create a new Slack canvas	`canvases:write`
Update a canvas	Edit an existing canvas	`canvases:write`
Read a canvas	Read canvas content	`canvases:read`
Read a user profile	Look up profile details	`users:read`

Prerequisites (self-hosted setup)

1 — Create a Slack App

Go to api.slack.com/apps → Create New App → From scratch.
Name the app (e.g., Cosmo) and select your workspace.
The app must be an internal app or directory-published app — Slack does not permit unlisted distributed apps to use the MCP server.

2 — Add user token scopes

Under OAuth & Permissions → Scopes → User Token Scopes (not bot token scopes), add:

search:read, channels:history, channels:read, groups:history, groups:read, im:history, im:read, mpim:history, mpim:read, chat:write, users:read, users:read.email, canvases:read, canvases:write

3 — Register the redirect URL

Under OAuth & Permissions → Redirect URLs, add the callback URL that matches your environment. The desktop app uses a local callback server — register http://localhost (Slack allows wildcard ports for localhost).

4 — Set server environment variables

COSMO_SLACK_CLIENT_ID=your-slack-app-client-id
COSMO_SLACK_CLIENT_SECRET=your-slack-app-client-secret

5 — Seed the provider

pnpm -C packages/server seed:providers

This registers Slack in the ConnectorProvider table with authMode: REMOTE_OAUTH and mcpUrl: https://mcp.slack.com/mcp. The seed is idempotent — safe to re-run.

Setup: two steps

Slack uses the same two-step gate as Microsoft 365: an org admin connects first to bind the workspace, then each member connects individually.

Step 1 — Admin connects (one time, per organization)

A Cosmo org OWNER or ADMIN must connect Slack first. This binds your organization to a specific Slack workspace (team_id). After this, no one — inside or outside your org — can attach a different Slack workspace to your Cosmo org.

Open Cosmo Desktop → Integrations.
Find Slack and click Connect.
Enter a label (e.g., Company HQ).
A browser window opens to Slack's OAuth screen. Sign in with your Slack account and click Allow.
Cosmo records the workspace binding. Other members can now connect.

If you are not an org OWNER or ADMIN, you will see an error asking you to ask an admin to connect first.

Step 2 — Each member connects (once per member)

Once the admin binding is in place, every member connects individually:

Open Cosmo Desktop → Integrations.
Find Slack and click Connect.
Enter a label (e.g., Work).
Sign in with your own Slack account. Cosmo verifies your account belongs to the bound workspace.
Your personal tokens are stored locally — no teammate can read your messages.

CLI

cosmo mcp connect slack --label "Work"

Or inside an active cosmo session:

/mcp connect slack "Work"

Managing connections

cosmo mcp list
cosmo mcp remove <instance-id>

Credential storage

OAuth tokens are stored locally on the user's device:

~/.cosmo/mcp-tokens/<instanceId>.json

Each user's tokens are isolated to their own Slack account. One user's session cannot read another's messages.

Revoking access

From Cosmo: click Disconnect next to Slack in the Integrations screen, or run cosmo mcp remove <instance-id>. The local token file is deleted immediately.
From Slack: go to Settings & administration → Manage apps, find Cosmo, and click Remove. Existing tokens will fail on next use.

Troubleshooting

"not_allowed_token_type" from Slack. You added scopes under Bot Token Scopes instead of User Token Scopes. Slack's MCP server requires user tokens. Move all scopes to User Token Scopes, reinstall the app, then reconnect.

"invalid_client_id" or OAuth fails to start. Verify COSMO_SLACK_CLIENT_ID matches the Client ID in Basic Information → App Credentials and that pnpm seed:providers was re-run after setting the env var.

"redirect_uri_mismatch" from Slack. The redirect URL used during the flow is not registered in your Slack App. Add it under OAuth & Permissions → Redirect URLs.

"missing_scope" when using a tool. Add the missing scope under User Token Scopes, reinstall the Slack App to your workspace, then disconnect and reconnect in Cosmo to get a new token with the updated scopes.

Private channels are missing. Slack's MCP server only surfaces data the authorizing user can access. The user must be a member of the private channel.

OAuth flow times out. The flow must complete within 2 minutes. If the browser window doesn't open, check that Cosmo is allowed to open external URLs in your OS settings.

On this page