@modelcontextprotocol/server-slack

None of the releases we tried started without a real key or a running service, so there is nothing to compare.

npm package · npm page · recorded on 24 October 2026 on a clean machine with placeholder settings; only tools/list was sent. A changed description is not a vulnerability. Method and limits.

Release by release

Releases tried:

Lock these tools

Pin what @modelcontextprotocol/server-slack serves you today, commit the lock, and a pull request fails when a tool changes, with the text before and after. Pin the package version in your MCP config as well.

$ pip install verfy
$ verfy lock check --update   # shows each tool, then writes verfy.lock
$ git add verfy.lock

# .github/workflows/verfy.yml, after actions/checkout
- uses: anvarbekovjavohir277-dot/verfy-action@v1

Maintain this server? Run the same check on your releases and add the Locked by Verfy badge to your README.