agent-slack: a Slack CLI built to be read by language models
Slack automation CLI for AI agents
At a glance
- What is it?
- agent-slack wraps Slack's client APIs in a TypeScript and Bun command line tool whose JSON output is pruned for token cost. It is aimed at agents that need to read, search and post in Slack without a bot token or a Python stack.
- Who is it for?
- Adopt agent-slack if you run a coding agent on macOS or Windows that needs to read threads, search messages and post replies without registering a Slack app, and if you can accept a browser-token or desktop-token authentication path. Do not adopt it for a headless Linux CI runner or for a multi-tenant service that needs per-user OAuth scopes, because the documented import paths are macOS and Windows only and the fallback browser imports require AppleScript.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 9 days ago.
- What is it written in?
- Mainly TypeScript, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
The gap agent-slack fills between Slack's API and an agent loop
Slack's public Web API expects a bot or user token issued through an app registration, and its responses carry a lot of envelope that a language model does not need. agent-slack takes a different route. The README states the guiding principle as token efficiency: compact JSON, minimal duplication, and empty or null fields pruned so LLMs can consume results cheaply. The command map covers reads (message get, message list), search across messages and files, writes (send, edit, delete, react), Slack-native drafts, channel creation and invites, and canvases as Markdown. The intended user is not a platform engineer building a Slack app. It is an agent, or the person configuring one, that needs to act inside an existing workspace with as little setup as possible. The README also ships an agent skill under skills/agent-slack/ and tells readers to treat the installed CLI's --help output as authoritative over the README itself, which is a candid admission that the command surface moves faster than the prose.
Authentication without an app registration, and what that costs
The zero-config claim rests on local credential extraction. On macOS and Windows, the README says authentication happens automatically by reading Slack Desktop local data, and that you do not need to quit Slack. If that fails, the tool tries Chrome, Brave and Firefox extraction on macOS. Manual equivalents exist as subcommands: auth import-desktop, import-brave, import-chrome, import-firefox, plus auth whoami and auth test. The browser imports read tokens from a logged-in Slack tab via AppleScript, and the README warns that both browsers ship with Allow JavaScript from Apple Events disabled by default, so you must enable it under View, Developer first, and macOS will prompt for your password the first time. There is also an environment variable path: SLACK_TOKEN set to a browser token beginning xoxc- together with SLACK_COOKIE_D set to the xoxd- cookie, or a standard xoxb or xoxp token. This design trades setup convenience for credential lifetime. A browser or desktop session token is not the same artifact as an app token, and the README does not describe a rotation or refresh procedure. If Slack invalidates the session, the tool has no documented re-auth loop beyond running the import commands again.
Targets, workspace selection and the multi-workspace trap
Reads accept either a Slack message URL of the form https://workspace.slack.com/archives/<channel>/p<digits> with an optional thread_ts query parameter, or a channel reference written as #general, bare general, or a channel ID like C0123. The README gives two concrete examples: agent-slack message get "#general" --ts "1770165109.628379" and agent-slack message list "#general" --thread-ts "1770165109.000001". The trap is multi-workspace use. If more than one workspace is configured and you address a channel by name rather than by ID or full URL, the README states you must pass --workspace or set SLACK_WORKSPACE_URL. The flag accepts a full URL or a unique substring selector, so both --workspace "https://stablygroup.slack.com" and --workspace "stablygroup" are documented as valid. A unique substring is convenient and also fragile: it depends on no other configured workspace sharing that fragment. For an agent that constructs commands programmatically, passing the full URL or the channel ID removes an entire class of ambiguous-target failure.
Getting it running: three install paths and the first commands
The recommended install is a shell script: curl -fsSL https://raw.githubusercontent.com/stablyai/agent-slack/main/install.sh | sh. For npm users, npm i -g agent-slack requires Node 22.5 or newer. A Nix flake path exists as nix run github:stablyai/agent-slack. The agent skill installs with npx skills add stablyai/agent-slack, or manually with bash ./scripts/install-skill.sh. Once installed, the sequence the README implies is auth whoami to see which identity was picked up, then auth test to confirm it works. A first read is agent-slack message get on a URL, or agent-slack message list "#general" --limit 20 for recent channel history. The README shows one filter worth noting: agent-slack message list "#general" --with-reaction eyes returns recent messages carrying that reaction, which is a cheap way for an agent to find items a human has already flagged. There is also a self-update subcommand that the README says detects npm, bun or binary installs. Two behavioural details matter for callers: Slack data commands emit pruned JSON while help, update and some authentication setup commands emit text, and attached files are downloaded automatically and returned as absolute local paths rather than as remote URLs.
Where the design strains: platform coverage and side effects
The automatic authentication story is macOS and Windows only, and the fallback browser imports are macOS only and depend on AppleScript plus a browser setting most users have never touched. A headless Linux container, which is where a lot of agent infrastructure runs, has no documented automatic path; you would supply SLACK_TOKEN and SLACK_COOKIE_D yourself, and the README does not explain how to obtain those non-interactively. The human-in-the-loop principle is the second strain. The README says the tool loops humans in when appropriate and not in CI environments, and points at message compose, which opens a Slack-like editor in a browser. That is a deliberate interruption. An agent that calls compose inside an unattended loop gets a browser window, not a result. The same applies to the workflow run subcommand, which the command map describes as tripping a workflow trigger. The command map lists workflow preview as trigger metadata with no side effects, which implies run does have side effects, and there is no documented dry-run flag for it. Treat every write subcommand as a real write.
How it differs from Slack's own tooling and from a Slack app
The obvious comparison is a Slack app built on the official SDKs and installed with OAuth scopes. That approach gives you a stable bot identity, per-scope permissions, token rotation and an audit trail, and it works identically on Linux. agent-slack gives up all of that in exchange for not having to register anything: it reuses credentials that already exist on the machine. The second comparison is Slack's own CLI tooling and the community Slack CLIs, which generally assume an app token and are built for humans reading formatted output. agent-slack inverts that: the README says Slack data commands output aggressively pruned JSON, which is worse for a human at a terminal and better for a model paying per token. The third comparison is a general browser automation layer driving the Slack web client. That can do anything the UI can do, and it breaks whenever Slack changes its DOM. agent-slack sits between the two: it speaks to Slack's client endpoints rather than scraping the interface, but it authenticates with the same session material a scraper would use.
Maintenance, release cadence and the MIT licence
The repository is TypeScript on Bun, licensed MIT, and not archived. The release list shows v0.10.0, v0.10.1 and v0.10.2 all published within three days of each other in early September 2026, and the last push to main is dated 2026-09-07. A patch-per-day cadence at the 0.10 line tells you the surface is still moving and that pinning a version is the safer choice for anything an agent depends on. The self-update subcommand exists but the README does not describe how to pin or roll back, so version control on your side is the mechanism you actually have. MIT is permissive: it allows commercial use and modification and requires the licence and copyright notice be retained. It also means no warranty and no support obligation from the authors. That is a statement about the licence text, not legal advice about your situation; the interaction between how this tool obtains credentials and your organisation's acceptable-use policy for Slack is a question for your own review, not one the licence answers. Nothing in the supplied material describes a security review of the credential extraction paths.
Editorial conclusion
Adopt agent-slack if you run a coding agent on macOS or Windows that needs to read threads, search messages and post replies without registering a Slack app, and if you can accept a browser-token or desktop-token authentication path. Do not adopt it for a headless Linux CI runner or for a multi-tenant service that needs per-user OAuth scopes, because the documented import paths are macOS and Windows only and the fallback browser imports require AppleScript. Before wiring it into an agent loop, run agent-slack auth test and agent-slack auth whoami on the target machine, then confirm that agent-slack message list "#your-channel" --limit 5 returns the workspace you expect when more than one workspace is configured.
Community notes