What the agent gets
- List public channels and read their history and threads.
- No read access to private channels or DMs.
- Resolve users, turning the user IDs in message payloads into names, emails, and titles.
- Post messages as the Rippit Slack app, in public or private channels where the app is already a member, or as DMs to explicitly selected users.
With the Slack data integration
The Slack data integration and this connection do different jobs, and they work best together.- The data integration copies every message from the public channels you select into Rippit and keeps it current. That stored history is what lets the agent find themes across months of threads, enrich conversations, and run Agent Apps over them. It never posts to Slack.
- This connection gives the agent live reads during a chat, and posts results back to Slack as the Rippit Slack app.
Setup
Connect as a Slack admin. Click Connect on Slack and authorize; there is nothing to create in Slack first. Rippit reuses its existing Slack app, so authorizing covers both message delivery and read access in one approval. The install needs Slack admin rights, so a non-admin who starts the flow will not be able to finish it. After authorizing, invite Rippit to each channel it should post in by typing@Rippit there.
How the connection is built
One Slack authorization sets up two things. Reading goes through an MCP component that Rippit hosts and manages. It runs inside the Rippit MCP service, so there is nothing for you to install or run, and it is what the agent’sslack_* tools call. If your security review covers MCP servers, this component is in scope even though setup looks like an ordinary Slack app install.
Sending goes through the Rippit Slack app directly, not through MCP. The send_slack tool posts as that app.
OAuth scopes
The authorization requests two sets of scopes in one approval.
The read scopes cover public channels only. No private-channel, group DM, or DM read scope is requested, and the read tools reject a private conversation ID even if one is supplied.
groups:read on the bot token lets the agent list the private channels the app has been invited to, so it can offer them as delivery destinations. It does not let the agent read their messages.
Channel access
Reads are not limited to channels the Rippit app has been invited to. The read tools use the authorizing admin’s user token, so the agent can read any public channel that admin can see. There is no per-channel read allowlist. To limit what the agent can read, authorize with a Slack account whose public-channel visibility matches what you want to expose. Posting is limited to where the app is a member. A post to a channel where the app has not been invited fails. Invite the app with@Rippit to allow it. DMs go to explicitly selected users.
Who can use it
The connection is organization-wide. Anyone in your Rippit organization can use it to read public Slack channels and to post. It can also be configured for use in Agent Apps. Messages are sent by the Rippit Slack app, not by the person who authorized the connection or the person who asked for the post.Restricting what gets posted
You can instruct the agent or an Agent App to post only aggregate summaries and alerts, to leave out customer-identifying information, sensitive personal information, and payment or card data, and to skip the post when it cannot confidently exclude that content. Put those rules in the Agent App instructions so they apply on every run. These are instructions the agent follows, not a filter Rippit enforces on the message. There is no technical guarantee that a prohibited value cannot appear in a post, so treat the channels the app can post to as you would any channel where that data might be discussed.Data handling
What Rippit stores. The MCP component forwards each request to Slack and returns the result to the agent. Where Slack content can end up. The agent can bring details it reads from Slack into a Rippit chat, and Rippit chat transcripts are retained for 365 days. Content the agent writes into a worksheet, report, or Agent App output follows your workspace’s retention terms for that data. Training. Rippit does not train models on your data. Slack content is used for inference only. Credentials. Tokens are encrypted at rest and removed when you disconnect. Revoking the Rippit app in Slack has the same effect immediately. Agreements. This connection is covered by your existing Rippit Data Processing Addendum. Rippit does not maintain a separate security questionnaire; the AI Contract Addendum and current certifications are available from the Rippit Trust Center.Tools
send_slack is Rippit’s own tool, not part of the Slack connection, and it is available automatically; it shows in the tool picker marked automatic. If you have used Slack MCP servers elsewhere and expect a slack_send_message tool, this is what replaces it.
A Rippit admin can turn off any of the slack_* tools from the Slack server’s tool picker on the Connections page, for example to stop the agent from resolving user emails. send_slack is the exception: it is always available and cannot be turned off.
Because delivery goes through the Rippit Slack app, a post to a channel where the app has not been invited fails. Invite the Rippit app to the channel and try again. When the agent asks you to choose a channel destination, it lists the public and private channels the app is a member of, so it only offers channels the app can already post to. A DM destination uses the explicitly supplied Slack user email and still posts as the Rippit app.