Slack

Read-only Slack through your own account. A pulse across your channels, the replies you owe, threads where someone outside the workspace is waiting, and channels you joined that the agent doesn't know about yet. It never posts and never reads DMs.

The Slack pack lets the agent read the Slack channels your own account is in. Ask in plain words: "slack pulse", "what's happening in ext-acme today", "pull this thread <link>", "search Slack for INV-1042". With the pack on, the attention queue and sync also show what Slack is waiting on.

It reads and never writes. The token has no scope to post, react or open a DM, and the agent refuses a token that has one.

Setting it up

Run configure-skills → Slack. The walk has three parts.

1. A Slack app for your workspace, once. Each workspace creates its own app, and anyone allowed to create apps there can do it. Teammates who join later skip this step: they reuse the app's Client ID. If your workspace has no app yet, the walk takes you through it:

At api.slack.com/apps, choose Create New App → From scratch, name it after your agent and pick your workspace.
Under OAuth & Permissions → User Token Scopes (not Bot Token Scopes), add channels:history, channels:read, groups:history, groups:read, users:read and search:read. Nothing else.
Add http://localhost under Redirect URLs.
Turn on Advanced token security via PKCE. Slack says this can't be undone. It's what lets the agent sign in without a client secret.
Copy the Client ID from Basic Information and paste it into the walk. It's a public identifier, not a secret, and it's saved as AGENT_SLACK_CLIENT_ID in <HOME>/.claude/settings.local.json.
If your workspace requires admin approval, install the app and have an admin approve it once.

2. Your own sign-in, once. The sign-in waits for Slack's answer on a local port, which the agent's sandbox doesn't allow, so you run it in your own terminal. The walk prints the exact command with your paths filled in:

cd <HOME> && <plugin>/bin/kevin slack auth

Your browser opens Slack's authorize page. Click Allow, and the terminal prints {"ok": true, …}. The tokens land in <HOME>/.state/secrets/slack/slack-tokens.json, readable only by you, under the secrets folder the agent's own shell can't read. The Slack tools run in the agent's MCP server, which can.

3. The channel map. The walk then writes knowledge/concepts/slack-channels.md from the channels you're in (below), unless you already have one.

A refresh token expires after 30 days without use. If that happens, run kevin slack auth again.

The channel map

The agent groups your channels in a markdown file you own, knowledge/concepts/slack-channels.md:

## Team
- team-eng
- team-ops — on-call and deploys

## External
- ext-acme — Acme Corp, shared channel
- ext-globex

## Reference (opt-in)
- general

## Uncategorized
- ext-initech — joined 2026-01-15

Each ## heading is a category and each bullet is a channel, with an optional note after —.
External holds the channels you share with other organizations or with guests. Those are the ones scanned for threads waiting on your team.
Reference is skipped by a pulse unless you ask for it. Uncategorized is the inbox for channels the agent couldn't place.
You can add categories of your own.
The agent only appends to the file. It files a new channel by its name, then by patterns in your own entries, then by its topic, and never moves a channel you placed.
With seven or more channels in Uncategorized, a pulse first asks whether to sort them.

What's waiting

The slack_waiting tool decides in code what's waiting, and returns who, where, how long and a link, never message text. That's what lets an unattended sync run it.

List	What's in it
Replies I owe	Messages anywhere in the workspace that mention you and that you haven't replied to in an hour. A bare tag counts: someone pulling you in is the ask.
External threads waiting	Threads in your External channels where the last word is from someone outside the workspace, an hour or more old, with no reply or reaction from your team. A bot's auto-acknowledgement doesn't count as a reply. A thread never shows in both lists.
New channels	Channels you're in that the map doesn't list. A channel the map leaves out is never scanned, so a new join gets flagged before it goes unchecked.

The attention queue shows the first two as groups, each item with how long it has waited. New channels show as a note under External threads waiting. Sync prints all three in a 🔔 Slack block, and its closing questions offer slack sort new channels, which files each new channel into the map without reading any messages.

A pulse

slack with no argument scans every categorised channel except Reference for the last 24 hours, in one batched read. It drops acknowledgements and routine bot posts, and keeps unanswered questions, errors, asks, decisions and blockers. The brief is grouped by category, most urgent first, and saved to reports/slack/. slack external scans one category. A single channel, a thread or a search is answered directly and isn't saved unless you ask.

The brief quotes at most one line of any message, and the agent never drafts a reply to send. Every read is logged under [💬 slack] in .state/logs/app.log.

Turning it off

configure-skills → deconfigure → Slack revokes the tools and offers the command that deletes your local token. To revoke the app's access on Slack's side, open your workspace's Authorized apps settings and revoke it there. Your teammates' tokens are their own and keep working.