Slack

Diskret connects to Slack’s official MCP server (https://mcp.slack.com/mcp). Slack only lets internal apps (created inside your workspace) and apps published in the Slack Marketplace use its MCP server, and it does not support dynamic client registration. So your Slack admin creates one internal Slack app, once, and pastes its client ID and secret into Diskret. You can see, limit and remove the app at any time.

Time: about 10 minutes. Who: a Slack workspace admin (or someone allowed to create and install apps in the workspace).

What Diskret can access

Each user connects their own Slack account, so Diskret can only read what that user can read in Slack. Slack calls these user token scopes.

Scopes	Why	Required
search:read.public search:read.private	Search messages in public and private channels	Yes
channels:history groups:history	Read a channel or thread	Yes
channels:read groups:read users:read	Know which channels and people a result is about	Yes
search:read.files files:read	Search and read shared files	Optional
search:read.users	Find people by name	Optional
search:read.im search:read.mpim im:history mpim:history im:read mpim:read	Search and read direct messages and group DMs	Optional, see below
chat:write	Send messages	Only if users should post from the AI client

Start with the required scopes only. Direct messages are where people write most freely about customers, tenants and colleagues, so add the DM scopes only once you have decided that the AI client should see them. Leave out users:read.email unless you need email addresses: Diskret pseudonymises them, but data that never leaves Slack is better still.

Every response passes through Diskret’s field rules and pseudonymisation before it reaches the AI client. Send tools stay closed until an admin opens them, and you can require an approval for each message.

1. Create the Slack app

1. Go to api.slack.com/apps and click Create New App → From scratch.
2. Name it (e.g. Diskret) and pick your workspace. Do not distribute the app publicly: it must stay internal to your workspace.
3. In the sidebar, open Agents & AI Apps and turn Model Context Protocol on.

2. Add the redirect URL and scopes

1. In the sidebar, open OAuth & Permissions.
2. Under Redirect URLs, add the Redirect URI shown on the connector form in Diskret (on Diskret Cloud: https://app.diskret.ai/oauth/upstream/callback) and click Save URLs.
3. Under Scopes → User Token Scopes, add the scopes from the table above. Leave Bot Token Scopes alone: Diskret does not use a bot token.
4. Click Install to Workspace and approve. If your workspace requires app approval, a Slack admin approves it the usual way.
5. Open Basic Information and copy the Client ID and Client Secret.

Caution

If the app restricts API token usage to certain IP ranges (OAuth & Permissions → Restrict API Token Usage), Slack rejects every call from an address that is not on the list. Either leave the restriction off, or contact Diskret support for Diskret Cloud’s outbound IP addresses and add them.

3. Add the connector in Diskret

1. In Diskret, go to Connectors → New connector.
2. Name it (e.g. Slack) and set the URL to https://mcp.slack.com/mcp.
3. Under Authentication, choose Sign in with OAuth, and under Whose credential choose Personal (each user connects their own).
4. Paste the Client ID and Client secret.
5. Under Scope, enter the scopes you added to the Slack app, separated by spaces, e.g. search:read.public search:read.private channels:history groups:history channels:read groups:read users:read. Do not leave it empty: Slack advertises every scope its MCP server knows, including the ones that send messages, and Diskret would ask for all of them.
6. Save, then click Check sign-in. Diskret shows the authorization server it found (https://mcp.slack.com) and the scopes it will ask for.
7. Choose which units get access to which Slack tools. Keep send, create and upload tools closed, or set them to need an approval.

Each user then goes to My connections, clicks Connect and signs in to Slack. Calls run with that user’s own Slack permissions: they only see channels they are a member of, and Slack’s own access logs still apply. Users who have not connected do not see the Slack tools. If Slack stops accepting the sign-in, the user sees Sign in again under My connections.

Maintenance

• Client secret: rotate it under Basic Information → App Credentials if it may have leaked, then paste the new one into Diskret.
• More scopes later: add them to the Slack app under User Token Scopes, reinstall the app, add them to Scope on the connector, and ask users to connect again.
• Revoke access: remove the app from the workspace to cut off Diskret for everyone, or remove the connector in Diskret. Users can revoke their own access under My connections.

Troubleshooting

Error	Likely cause	Fix
bad_redirect_uri / redirect_uri_mismatch	The redirect URL in the Slack app differs from Diskret’s	Copy it again from the connector form, exactly, and click Save URLs
invalid_scope	A scope in Diskret is not a user token scope on the Slack app	Add it under User Token Scopes and reinstall, or remove it from Scope
Sign-in works but tools fail with an app error	Model Context Protocol is off, or the app is not internal	Turn it on under Agents & AI Apps; use an app created in your own workspace
Calls rejected after sign-in	The app restricts API tokens to IP ranges	See the caution in step 2
Check sign-in asks for a client ID	Client ID missing on the connector	Slack has no dynamic registration; paste the app’s client ID and secret