slack-mcp-server

The server's core functionality relies on extracting highly privileged 'xoxc-' (token) and 'xoxd-' (cookie) browser session tokens from Chrome (macOS only) via AppleScript executing JavaScript within the browser. This grants the server the same access you have in your web browser. While powerful, this is a high-privilege operation and requires significant trust in the application. The project implements several good security practices: - Tokens are stored locally (file, macOS Keychain) with strict 'chmod 600' permissions. - Atomic writes prevent file corruption during token/cache updates. - The REST API server (`slack-mcp-web`) generates a secure, random API key and binds exclusively to localhost (`127.0.0.1`), preventing external network access by default. CORS is also restricted to localhost origins. - Filename sanitization is implemented for exports to prevent path traversal vulnerabilities. - No obvious hardcoded secrets or malicious 'eval' patterns (the JavaScript execution is explicit and part of the core design).