slack-mcp-server

The server relies on highly sensitive Slack authentication tokens (xoxc/xoxd, xoxp, xoxb), which grant extensive access to Slack workspace data. Their security is paramount and depends on strict environment variable management. The 'stealth mode' using browser tokens (xoxc/xoxd) and custom TLS fingerprinting (utls) is an advanced technique that might bypass Slack's official API app controls, but is inherently fragile and could be against Slack's terms of service, leading to potential blocking or detection. The custom TLS implementation also introduces complexity, and while intended for enterprise compatibility, could pose risks if not perfectly secure. The 'conversations_add_message' tool, which allows posting messages, is disabled by default, which is a good security practice; if enabled, it offers channel-specific restrictions. Sensitive cached data (users, channels) is stored in local files, requiring secure file system permissions. No 'eval' or obfuscation was found in the provided code.