diff --git a/content/docs/operate/governance/remote-mcp-servers/index.mdx b/content/docs/operate/governance/remote-mcp-servers/index.mdx index bf232d63c..94804e64b 100644 --- a/content/docs/operate/governance/remote-mcp-servers/index.mdx +++ b/content/docs/operate/governance/remote-mcp-servers/index.mdx @@ -173,7 +173,7 @@ Common settings include: height={ADVANCED_SETTINGS_HEIGHT} /> -Some remote servers need provider-specific setup beyond these generic settings. See [Connect a Salesforce Hosted MCP Server](/en/operate/governance/remote-mcp-servers/salesforce), [Connect a ServiceNow Hosted MCP Server](/en/operate/governance/remote-mcp-servers/servicenow), [Connect a Dynamics 365 Customer Service MCP Server](/en/operate/governance/remote-mcp-servers/dynamics-365-customer-service), [Connect a HubSpot Remote MCP Server](/en/operate/governance/remote-mcp-servers/hubspot), [Connect a Snowflake-Managed MCP Server](/en/operate/governance/remote-mcp-servers/snowflake), [Connect an Atlassian Remote MCP Server](/en/operate/governance/remote-mcp-servers/atlassian), [Connect a GitHub Remote MCP Server](/en/operate/governance/remote-mcp-servers/github), [Connect a Splunk MCP Server](/en/operate/governance/remote-mcp-servers/splunk), or [Connect the AWS MCP Server](/en/operate/governance/remote-mcp-servers/aws) for fully worked examples. +Some remote servers need provider-specific setup beyond these generic settings. See [Connect a Salesforce Hosted MCP Server](/en/operate/governance/remote-mcp-servers/salesforce), [Connect a ServiceNow Hosted MCP Server](/en/operate/governance/remote-mcp-servers/servicenow), [Connect a Dynamics 365 Customer Service MCP Server](/en/operate/governance/remote-mcp-servers/dynamics-365-customer-service), [Connect a HubSpot Remote MCP Server](/en/operate/governance/remote-mcp-servers/hubspot), [Connect a Snowflake-Managed MCP Server](/en/operate/governance/remote-mcp-servers/snowflake), [Connect an Atlassian Remote MCP Server](/en/operate/governance/remote-mcp-servers/atlassian), [Connect a GitHub Remote MCP Server](/en/operate/governance/remote-mcp-servers/github), [Connect a Splunk MCP Server](/en/operate/governance/remote-mcp-servers/splunk), [Connect the AWS MCP Server](/en/operate/governance/remote-mcp-servers/aws), or [Connect the Slack MCP Server](/en/operate/governance/remote-mcp-servers/slack) for fully worked examples. ## Where the server's tools become available diff --git a/content/docs/operate/governance/remote-mcp-servers/meta.json b/content/docs/operate/governance/remote-mcp-servers/meta.json index 5490c72f6..bf2a99c6c 100644 --- a/content/docs/operate/governance/remote-mcp-servers/meta.json +++ b/content/docs/operate/governance/remote-mcp-servers/meta.json @@ -10,6 +10,7 @@ "atlassian", "github", "splunk", - "aws" + "aws", + "slack" ] } diff --git a/content/docs/operate/governance/remote-mcp-servers/slack.mdx b/content/docs/operate/governance/remote-mcp-servers/slack.mdx new file mode 100644 index 000000000..79c8e5e07 --- /dev/null +++ b/content/docs/operate/governance/remote-mcp-servers/slack.mdx @@ -0,0 +1,121 @@ +--- +title: Connect the Slack MCP Server +sidebarTitle: Slack +description: Configure a Slack app and Arcade's OAuth 2.0 settings to connect Slack's hosted MCP server +--- + +import { SignupLink } from "@/components/analytics"; + +Slack hosts an [MCP server](https://docs.slack.dev/ai/slack-mcp-server/) at `mcp.slack.com/mcp`, exposing tools for searching, reading, and sending messages, working with canvases, and looking up users. This guide covers the Arcade-side setup for connecting it as a [remote MCP server](/en/operate/governance/remote-mcp-servers), plus the Slack settings that most commonly trip people up. + + + This guide is about connecting to Slack's own MCP server, not the Arcade + Slack toolkits. Arcade's [Slack toolkit](/en/resources/integrations/social/slack) + and [Slack API toolkit](/en/resources/integrations/social/slack-api) cover + Slack with none of the setup below. + + Reach for Slack's server instead when you want the tools Slack itself + builds and maintains, with access governed by your own Slack app and the + user scopes you grant it. + + + + This guide is sourced from Slack's [MCP server + overview](https://docs.slack.dev/ai/slack-mcp-server/) and [sample app + guide](https://docs.slack.dev/ai/slack-mcp-server/developing/). + + + + + +Connect Slack's MCP server to Arcade and use its tools in gateways and SDKs. + + + + + +- An Arcade account +- A Slack workspace where you can create and install a Slack app +- The ability to contact Slack support for your workspace, to turn off [per-user tool descriptions](#per-user-tool-descriptions) + + + + + +- Which Slack app settings matter for Arcade specifically, and why +- Configure the remote server's OAuth 2.0 settings in Arcade +- Why Slack's per-user tool descriptions matter in a shared gateway, and how to turn them off + + + + +## Set up Slack + +Slack's MCP server only accepts clients backed by a registered Slack app. Follow Slack's [sample app guide](https://docs.slack.dev/ai/slack-mcp-server/developing/) to create one. A few settings on that app matter specifically for connecting to Arcade: + +- **App type**: only internal apps and apps published in the Slack Marketplace can use the MCP server. An internal app installed to your own workspace is the usual choice for Arcade. + +- **Model Context Protocol**: turn on the MCP server feature under **Agents** in the app's settings (or set `settings.is_mcp_enabled` in the app manifest). Without it, the app can't connect to the MCP server. + +- **User token scopes**: the MCP server's tools act on behalf of each user, so they need user token scopes, added under **OAuth & Permissions**. Each tool needs its own scopes. For example, searching messages needs `search:read.public` (plus `search:read.private`, `search:read.mpim`, and `search:read.im` for private conversations), and sending messages needs `chat:write`. Check the scope table in Slack's [MCP server overview](https://docs.slack.dev/ai/slack-mcp-server/) and add a scope for every tool you plan to expose. + +- **Redirect URLs**: set this once you have the redirect URI Arcade generates (see [Add the redirect URI to your Slack app](#add-the-redirect-uri-to-your-slack-app) below). + +## Configure the remote server in Arcade + + + +### Register the server + +Go to the [MCP servers dashboard](https://app.arcade.dev/servers), click **Add Server**, choose **Remote MCP**, and enter a server ID and the server URL: + +``` +https://mcp.slack.com/mcp +``` + +### Configure OAuth2 authorization + +Open **Advanced settings → OAuth2 authorization** and enter your Slack app's **Client ID** and **Client Secret**. + + + Slack's MCP server doesn't support Dynamic Client Registration, so you must + supply the Client ID and Secret manually. If you leave these blank, Arcade + attempts Dynamic Client Registration and the connection fails. + + +### Add the redirect URI to your Slack app + +Copy the redirect URI Arcade generated and add it under **Redirect URLs** in your Slack app's **OAuth & Permissions** settings. + +### Authorize and confirm + +Save the server to open the authorization prompt. Sign in with a Slack account in the workspace where you installed the app, and approve the requested scopes. + + + +## Per-user tool descriptions + + + Slack's MCP server writes the authorizing user's Slack user ID into some + tool descriptions, such as `slack_search_public_and_private` and + `slack_send_message`. An agent reads that ID as "me", so a description + listed with one person's credentials can point another user's agent at the + wrong person: searching for someone else's mentions, or sending a message + to someone else. + + +Arcade fetches a remote server's tool list with the credentials of the admin who authorized it (see [Who authenticates, and when](/en/operate/governance/remote-mcp-servers#who-authenticates-and-when)). With Slack's server, that list can carry the admin's user ID to every user of a gateway, even though each tool call still runs with the calling user's own token. + +Slack can switch these per-user descriptions off for your workspace, but only on request. Contact Slack support and ask them to turn off per-user tool descriptions on the Slack MCP server. Do this before you roll the server out beyond a single user. + +## Troubleshooting + +- **A Dynamic Client Registration error when you save the server**: the Client ID and Client Secret are empty. See [Configure OAuth2 authorization](#configure-oauth2-authorization). +- **Authorization doesn't complete, or the server never lists tools**: confirm the Model Context Protocol feature is turned on for your Slack app. See [Set up Slack](#set-up-slack). +- **A tool call fails with `missing_scopes`**: your Slack app doesn't request a user token scope that tool needs. Add the scope under **OAuth & Permissions**, then have the affected user authorize again so their token picks it up. +- **An agent acts on the wrong person when asked about "me"**: the tool descriptions name a different user. See [Per-user tool descriptions](#per-user-tool-descriptions). + +## Next steps + +- [Create an MCP Gateway](/en/operate/governance/mcp-gateways/create-via-dashboard) to expose this server's tools. +- [Connect to MCP clients](/en/get-started/mcp-clients). diff --git a/public/llms.txt b/public/llms.txt index 066d98e16..dcf637ba7 100644 --- a/public/llms.txt +++ b/public/llms.txt @@ -1,4 +1,4 @@ - + # Arcade @@ -120,6 +120,7 @@ Arcade docs serve two audiences. Start with the path that matches your goal: - [Connect an Atlassian Remote MCP Server](https://docs.arcade.dev/en/operate/governance/remote-mcp-servers/atlassian): This guide explains how to connect Arcade to Atlassian's Rovo MCP server to access Jira, Confluence, Jira Service Management, Bitbucket, and Compass tools, using Atlassian's OAuth 2.1 with automatic client registration. It covers the Arcade-side setup and the key Atlassian administrator controls—specifically domain allowlisting, permission groups, and IP restrictions—that govern which users can access which tools. - [Connect Arcade to your LLM](https://docs.arcade.dev/en/get-started/agent-frameworks/setup-arcade-with-your-llm-python): This guide teaches you how to integrate Arcade's tool-calling capabilities into a Python application powered by an LLM by building a "harness" that orchestrates communication between the user, model, and tools. You'll learn to set up an agentic loop, add Arcade tools to it, and implement a multi-turn conversation system that handles tool authorization and execution. - [Connect the AWS MCP Server](https://docs.arcade.dev/en/operate/governance/remote-mcp-servers/aws): This guide explains how to connect Arcade to AWS's managed MCP Server using OAuth 2.1 authentication, where access is controlled entirely by the IAM permissions of the identity that authorizes the connection. It covers the setup steps on both the Arcade and AWS sides, including granting the necessary OAuth permissions to an IAM identity and understanding how the authorization model works. +- [Connect the Slack MCP Server](https://docs.arcade.dev/en/operate/governance/remote-mcp-servers/slack): This guide helps you connect Slack's hosted MCP server to Arcade so you can use Slack's tools for messaging, searching, and user management within Arcade gateways and SDKs. It covers the required Slack app configuration (including enabling MCP, setting user token scopes, and registering redirect URLs) and the Arcade-side setup for OAuth 2.0 authentication with your Slack app credentials. - [Connect to MCP Clients](https://docs.arcade.dev/en/get-started/mcp-clients): This page explains how to connect various development tools and AI clients (like Cursor, Claude Desktop, and VS Code) to Arcade MCP Gateways, which enable agents to access and call tools from integrated services like GitHub, Slack, Gmail, and custom servers. The gateway acts as a control layer that determines which tools each client can access, drawing from Arcade's hosted integrations, remote MCP servers, or your own custom servers. - [Contact Us](https://docs.arcade.dev/en/resources/contact-us): This page provides multiple contact channels and support options for users to reach the Arcade team for assistance with their agents and services. It serves as a central hub for getting help and connecting with the support team through various communication methods. - [Contextual Access](https://docs.arcade.dev/en/operate/governance/contextual-access): Contextual Access enables enterprises to control which tools users can access, validate tool requests before execution, and filter or transform tool outputs using custom logic hooks that integrate with Arcade's execution flow. The feature works through three hook points—Access, Pre-Execution, and Post-Execution—that let you enforce policies like role-based tool visibility, input validation, and output redaction without modifying your tools or agents.