Slack

Auth (tools): Static OAuth app (client id + secret) → each user Connect.

MCP: https://mcp.slack.com/mcp

Slack tools use each user's OAuth grant. Slack inbound (DMs, @mentions, HITL buttons) uses a separate bot token and signing secret. Brain does not use Vercel Connect.

Admin: Set up MCP app credentials

1. Create an OAuth / MCP app at the provider (see notes below)
2. In Brain open /tools → Slack → Set up / App settings
3. Enter client id and secret (scope: this workspace or entire instance, depending on your role)
4. Save

Deploy-time env fallback (optional):

Prefer UI Set up when possible; env remains a host-wide fallback.

Admin: Slack inbound (DMs and @mentions)

Instance admins configure the bot on /tools → Slack → Set up inbound (or Inbound settings if it is already on). Env is the deploy-time fallback:

In the Slack app (api.slack.com/apps → your Brain app):

1. Event Subscriptions → turn Enable Events on → Request URL: {BRAIN_PUBLIC_URL}/eve/v1/slack (wait for Verified)
2. Subscribe to bot events: app_mention, message.im, and message.channels (thread follow-ups; add message.groups for private channels)
3. Interactivity & Shortcuts → turn Interactivity on → Request URL: {BRAIN_PUBLIC_URL}/eve/v1/slack
4. Bot scopes as needed: chat:write, im:history, im:write, users:read, users:read.email, plus channel history (channels:history / groups:history)

The Event URL is also on Tools → Slack when inbound is on (copy it from there). Do not paste it as an OAuth redirect — that is {BRAIN_PUBLIC_URL}/api/connections/slack/callback in App settings.

Without a bot token and signing secret, inbound Slack is off. MCP Connect still works only after client id and secret are saved in Set up / App settings. Inbound on does not unlock Connect.

Optional: turn on Limit @mentions to selected channels in the same inbound dialog. Brain lists public and private channels the bot can see; tick those that may @mention Brain. Paste extra C… / G… ids for channels Slack did not list (invite the bot, or paste the id). Leave the switch off to allow every channel. DMs always work. @mentions and thread follow-ups outside the list are ignored (no reply), including leftover active threads. Saving with the switch off stores “unrestricted” and ignores env SLACK_INBOUND_CHANNEL_IDS.

Users: Connect

1. Open /tools → Slack → Connect
2. Approve access in the provider UI
3. Enable the app for Agent-mode chats

Inbound mapping uses the Slack user id stored at Connect. If you have not Connected yet, Brain may map a unique Slack profile email to your Brain account. Unmapped users get a private refusal with a Connect link — the bot never runs as anonymous.

How inbound chat works

• DMs to the bot and @mentions start Agent turns as your Brain user
• Replies in an active Brain thread continue without another mention
• Unmentioned channel noise is ignored
• Optional channel allowlist limits @mentions (Tools checklist or env); DMs are not filtered
• HITL approve/deny appears as Slack buttons and uses instance posture (not schedule unattended rules)
• /new starts a fresh Slack session and is not sent to the model
• Each Slack thread is stored as a personal Brain sidebar chat. Opening it in Brain continues that Slack thread: your prompt and Brain’s reply are posted there. HITL for turns you start in Brain is in the app; turns started in Slack still use Slack buttons. Allowlist still applies to Slack @mentions only (not to this Brain→Slack post).

Callback URL

{BRAIN_PUBLIC_URL}/api/connections/slack/callback

Slack app notes

Register redirect URIs for Menu Connect and any mid-turn URI printed in .eve/slack-authorize-url.txt.

Typical MCP capabilities include search, channel history, messaging, reactions, and canvases — write tools may require approval in chat.