slack-mcp-server

Least-privilege permissions

• Create a dedicated Slack bot with minimal channel/workspace scope; restrict to specific channels only rather than org-wide access.
• Use Slack's granular permission scopes (e.g., chat:write, channels:read only) instead of accepting default "no permission requirements" settings.
• Rotate bot tokens regularly (30–90 days) and revoke immediately if agent credentials are suspected compromised.
• Disable DM access if not required; if needed, explicitly allowlist only approved user IDs rather than granting blanket private message access.

Network isolation

• Run the MCP connector on an isolated network segment or container with egress controls; restrict outbound access to Slack API endpoints only.
• Use a proxy or firewall to intercept and log all Slack API calls; block unexpected endpoints (e.g., external file uploads or unusual message patterns).
• Store bot token in a secrets manager (HashiCorp Vault, AWS Secrets Manager) rather than plaintext config files; never commit credentials to version control.

Monitoring

• Log all agent actions (message reads, posts, file access) with timestamps and user attribution; alert on bulk message retrieval or unusual channel access patterns.
• Monitor Slack audit logs for bot token usage anomalies (off-hours activity, mass channel joins, high API call rates).
• Set alerts for failed authentication attempts and token refresh events; correlate with agent error logs for injection attacks.

Red flags to watch for

• Messages containing LLM prompt keywords (ignore instructions, act as, bypass rules) or shell metacharacters—sanitize all Slack message input before LLM processing.
• Unexpected agent actions (posting messages to channels it shouldn't access, reading sensitive DMs) or rapid successive API calls suggesting token abuse.
• Agent behavior changes following third-party updates; pin MCP connector version and test updates in staging before production deployment.