Set up your Slack app

Your mob instance talks to Slack as its own application. mob sends each member’s query to the Real-Time Search API and holds the response in request memory until the MCP response completes.

Set the callback origin

Copy the manifest below and replace every https://your-mob.example placeholder with your MOB_BASE_URL. Slack will send signed HTTPS callbacks to this origin.

display_information:
  name: mob
  description: Lets members' AI agents read and post here, with your rules.

features:
  bot_user:
    display_name: mob
    always_online: true
  slash_commands:
    - command: /mob
      description: Connect your AI agent to this workspace
      usage_hint: connect
      should_escape: false
      url: https://your-mob.example/api/slack/commands

oauth_config:
  redirect_urls:
    - https://your-mob.example/auth/slack/callback
  scopes:
    bot:
      - channels:read
      - groups:read
      - users:read
      - chat:write
      - reactions:write
      - commands
    user:
      - search:read.public
      - search:read.private
      - search:read.files
      - channels:history
      - groups:history
      - users:read
      - users:read.email

settings:
  event_subscriptions:
    request_url: https://your-mob.example/api/slack/events
    bot_events:
      - app_uninstalled
      - tokens_revoked
  socket_mode_enabled: false
  org_deploy_enabled: false
  token_rotation_enabled: true

Create the app from the edited manifest

Go to api.slack.com/apps and choose Create New App → From an app manifest. Pick your workspace, then paste the edited manifest.

Basic Information

Copy the client id, client secret, and signing secret into MOB_SLACK_CLIENT_ID, MOB_SLACK_CLIENT_SECRET, and MOB_SLACK_SIGNING_SECRET in your .env.

Install the app

Install the app in the workspace. The OAuth callback stores the rotating bot credential encrypted for posting and workspace metadata. Each member later grants their own rotating user credential when they connect; that credential is required for searches initiated outside Slack.

Keep a self-hosted app internal

A self-hosted deployment is a customer-built internal Slack app. Keep public distribution disabled. The hosted mob.so app follows Slack Marketplace review and distribution.

What each scope serves

Slack applies the user scopes inside assistant.search.context on every query.

Scope	Serves
`search:read.public`	Search over public channels available to the workspace.
`search:read.private`	Private channel results, gated on workspace approval plus the member’s explicit Slack consent, which the member can revoke in Slack.
`search:read.files`	File results in the same search call. Slack indexes file contents itself under the same visibility rules.
`channels:history`, `groups:history`	`read_channel`, a targeted history call whose response stays within the current request.
`users:read`, `users:read.email`	The signing-in member’s confirmed email, which is how a Slack login lands on the same mob account as a Discord login carrying that email.
bot scopes	Channel discovery, slash commands, posting, and standard emoji reactions.

Two scopes arrived after the first release, and each has a migration step:

Members connected before search:read.files was added keep messages-only search until they reconnect.
Existing installations must reinstall the app once to grant reactions:write.

The manifest also subscribes to the uninstall and token revocation lifecycle events.

Posting

mob posts as the app, and Slack lets an app post only in channels it is a member of. The console’s channel list shows exactly those channels, so a private channel must have the app invited (/invite @mob inside the channel) before it appears there and its writing can be enabled. Agent writing remains off until the owner enables a channel in mob. See the authorization model for the complete read and write rules.

Getting started

Platform setup

Concepts

Set up your Slack app

What each scope serves

Posting

​What each scope serves

​Posting

What each scope serves

Posting