@jtalk22/slack-mcp 4.2.2 → 4.4.0

package/README.md

@@ -20,7 +20,7 @@ npx -y @jtalk22/slack-mcp --setup
 
 ## Why This Exists
 
-Slack's official MCP server requires a registered app, admin approval, and [doesn't work with Claude Code or GitHub Copilot](https://github.com/anthropics/claude-code/issues/30564) due to OAuth/DCR incompatibility. Screenshotting messages is not a workflow.
+Slack's official MCP server is OAuth-first and can require a registered app, admin approval, or client compatibility workarounds. See the tracked [Claude Code/GitHub Copilot compatibility discussion](https://github.com/anthropics/claude-code/issues/30564). Screenshotting messages is not a workflow.
 
 This server uses your browser's session tokens instead. If you can see it in Slack, your AI agent can see it too. No app install, no scopes, no admin.
 
@@ -42,9 +42,9 @@ This server uses your browser's session tokens instead. If you can see it in Sla
 | Tools | Limited | **21** |
 | Visible to admins | Yes | **No — session-token transport** |
 
-## Workflow Primitives (new in 4.2)
+## Workflow Primitives
 
-Save a workflow profile that binds a `workflow_kind` to channels + priority people + retention + cadence. Stored locally at `~/.slack-mcp-workflows.json`. The hosted brain at [mcp.revasserlabs.com](https://mcp.revasserlabs.com) reads these profiles and returns **structured JSON per workflow_kind** — downstream automation (Linear, Notion, status dashboards) consumes the JSON directly.
+Introduced in 4.2. Save a workflow profile that binds a `workflow_kind` to channels + priority people + retention + cadence. Stored locally at `~/.slack-mcp-workflows.json`. The hosted brain at [mcp.revasserlabs.com](https://mcp.revasserlabs.com) reads these profiles and returns **structured JSON per workflow_kind** — downstream automation (Linear, Notion, status dashboards) consumes the JSON directly.
 
 | `workflow_kind` | Returns (structured JSON) |
 |---|---|
@@ -137,10 +137,10 @@ Or via CLI: `codex mcp add slack -- npx -y @jtalk22/slack-mcp`
 | `slack_token_status` | Token age, health, and cache stats | read-only |
 | `slack_refresh_tokens` | Auto-extract fresh tokens from Chrome | read-only* |
 | `slack_list_conversations` | List DMs and channels | read-only |
-| `slack_conversations_history` | Get messages from a channel or DM | read-only |
-| `slack_get_full_conversation` | Export full history with threads | read-only |
-| `slack_search_messages` | Search across workspace | read-only |
-| `slack_get_thread` | Get thread replies | read-only |
+| `slack_conversations_history` ‡ | Get messages from a channel or DM | read-only |
+| `slack_get_full_conversation` ‡ | Export full history with threads | read-only |
+| `slack_search_messages` ‡ | Search across workspace | read-only |
+| `slack_get_thread` ‡ | Get thread replies | read-only |
 | `slack_users_info` | Get user details | read-only |
 | `slack_list_users` | List workspace users (paginated, 500+) | read-only |
 | `slack_users_search` | Search users by name, display name, or email | read-only |
@@ -161,6 +161,8 @@ Or via CLI: `codex mcp add slack -- npx -y @jtalk22/slack-mcp`
 
 † Hosted stubs return a structured upgrade payload (`signup_url`, `free_tier_quota`, `pro_value_prop`) — no Slack write occurs from OSS. Activate the brain at [mcp.revasserlabs.com](https://mcp.revasserlabs.com) (free tier, no card).
 
+‡ Also accepts `include_rich_message_fields` to return attachments, blocks, files, reactions, and metadata — see [Rich Message Fields](#rich-message-fields).
+
 ## Install
 
 **Node.js 20+**
@@ -171,6 +173,8 @@ npx -y @jtalk22/slack-mcp --setup
 
 The setup wizard handles token extraction and validation.
 
+After setup, have your client run `slack_health_check` — a workspace name in the response confirms you are connected.
+
 <details>
 <summary><strong>Claude Desktop (macOS)</strong></summary>
 
@@ -230,6 +234,8 @@ Add to `~/.claude.json`:
 }
 ```
 
+Or via CLI: `claude mcp add slack -- npx -y @jtalk22/slack-mcp`
+
 </details>
 
 <details>
@@ -305,7 +311,8 @@ Session tokens (`xoxc-` + `xoxd-`) from your browser. If you can see it in Slack
 
 Tokens expire. The server notices before you do — proactive health monitoring, automatic refresh on macOS, warnings when tokens age out. File writes are atomic (temp file → chmod → rename) to prevent corruption. Concurrent refresh attempts are mutex-locked.
 
-## What's New in 4.2.0
+<details>
+<summary><strong>What's New in 4.2.0</strong></summary>
 
 - **Workflow primitives** — `slack_workflow_save` + `slack_workflows` bind a `workflow_kind` (`incident_room`, `exec_brief`, `support_inbox`, `product_launch_watch`, `custom`) to channels, priority people, retention, and cadence. The hosted brain returns structured JSON per kind — `incident_room` returns `{incident_summary, timeline, open_risks, owner_gaps, next_actions}`, `exec_brief` returns `{summary, decisions, risks, asks, action_items}`. Downstream automation (Linear, Notion, dashboards) consumes the JSON directly.
 - **Discoverable upgrade stubs** — `slack_smart_search`, `slack_catch_me_up`, `slack_triage` appear in OSS as upgrade payloads pointing at the hosted brain. Response shape is `{signup_url, free_tier_quota, pro_value_prop}` — no interruptions, the AI routes the user cleanly.
@@ -315,6 +322,37 @@ Tokens expire. The server notices before you do — proactive health monitoring,
 
 Full release notes on [GitHub releases/latest](https://github.com/jtalk22/slack-mcp-server/releases/latest).
 
+</details>
+
+## Rich Message Fields
+
+Added in 4.4.0. The four read tools marked ‡ above accept `include_rich_message_fields: true`, which surfaces the parts of a message that live outside `text` — `attachments`, `blocks`, `files`, `reactions`, `metadata`, plus `subtype`/`bot_id`/`app_id` (automated/bot/app markers) and `team` (workspace id).
+
+An attachment-only alert reads as empty without the flag:
+
+```json
+{ "ts": "1767368030.607599", "user": "incident-bot", "text": "" }
+```
+
+With `include_rich_message_fields: true`, the content is surfaced:
+
+```json
+{
+  "ts": "1767368030.607599",
+  "user": "incident-bot",
+  "text": "",
+  "subtype": "bot_message",
+  "bot_id": "B012345",
+  "attachments": [{ "title": "PagerDuty", "text": "P1 — API latency > 2s" }]
+}
+```
+
+Output shape only — no extra permissions. `blocks` can be large, so it is opt-in per call to keep client context lean. For the full developer payload inside `metadata`, also set `include_all_metadata: true` (an independent Slack flag).
+
+`slack_search_messages` accepts the flag, but Slack's search API does not return rich fields on matches — read full content with `slack_conversations_history` or `slack_get_thread` on the match's channel and timestamp.
+
+Patch by [@rvandam](https://github.com/rvandam) (#143).
+
 ## Hosted HTTP Mode
 
 For remote MCP endpoints (Cloudflare Worker, VPS, etc.):
@@ -331,7 +369,7 @@ Details: [docs/DEPLOYMENT-MODES.md](docs/DEPLOYMENT-MODES.md)
 
 ## Troubleshooting
 
-**Tokens expired:** Run `npx -y @jtalk22/slack-mcp --setup` or use `slack_refresh_tokens` (macOS).
+**Tokens expired:** Run `npx -y @jtalk22/slack-mcp --setup` or use `slack_refresh_tokens` (macOS). To prevent silent expiration during long Claude-idle windows, set up the optional [token-refresh LaunchAgent](docs/SETUP.md#keep-tokens-fresh-while-claude-is-closed-macos-optional).
 
 **DMs not showing:** Use `slack_list_conversations` with `discover_dms=true`.
 
@@ -343,6 +381,7 @@ More: [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md)
 
 - [Setup Guide](docs/SETUP.md)
 - [API Reference](docs/API.md)
+- [Roadmap](docs/ROADMAP.md)
 - [Architecture](docs/ARCHITECTURE.md)
 - [Deployment Modes](docs/DEPLOYMENT-MODES.md)
 - [Use Case Recipes](docs/USE_CASE_RECIPES.md)
@@ -371,4 +410,4 @@ Not affiliated with Slack Technologies, Inc. Uses browser session credentials
 
 ---
 
-Hosted version live at [mcp.revasserlabs.com](https://mcp.revasserlabs.com): Free tier (no card), $9/mo Pro, $49/mo Team flat, Ops from $199/mo. Hosted owns the AI brain (smart_search, catch_me_up, triage), the scheduled morning catch-up DM at 8am workspace time *(rolling out Q2 2026)*, permanent OAuth (no 2-week token rotation), 90-day Vectorize retention, and shared workflow profiles. The OSS package owns local stdio + all 16 read/write Slack tools + workflow profile primitives (slack_workflow_save, slack_workflows). The 3 paid stubs (slack_smart_search, slack_catch_me_up, slack_triage) appear in OSS as discoverable upgrade prompts.
+Hosted version live at [mcp.revasserlabs.com](https://mcp.revasserlabs.com): Free tier (no card), $9/mo Pro, $49/mo Team flat, Ops from $199/mo. Hosted owns the AI brain (smart_search, catch_me_up, triage), the scheduled morning catch-up DM at 8am workspace time *(rolling out Q2 2026)*, permanent OAuth (no 2-week token rotation), 90-day Vectorize retention, and shared workflow profiles. The OSS package owns local stdio + the 16 Slack tools (12 read, 4 write) + workflow profile primitives (slack_workflow_save, slack_workflows). The 3 paid stubs (slack_smart_search, slack_catch_me_up, slack_triage) appear in OSS as discoverable upgrade prompts.

package/docs/API.md

@@ -119,9 +119,11 @@ Get messages from a channel or DM.
 |------|------|---------|-------------|
 | channel_id | string | *required* | Channel or DM ID |
 | limit | number | 50 | Messages to fetch (max 100) |
-| oldest | string | - | Unix timestamp, get messages after |
-| latest | string | - | Unix timestamp, get messages before |
+| oldest | string | - | Unix timestamp, get messages after; matching boundary timestamp is included |
+| latest | string | - | Unix timestamp, get messages before; matching boundary timestamp is included |
 | resolve_users | boolean | true | Convert user IDs to names |
+| include_rich_message_fields | boolean | false | Include Slack attachments, blocks, metadata, files, and reactions when present |
+| include_all_metadata | boolean | false | Pass Slack's `include_all_metadata` option to `conversations.history` |
 
 **Returns:**
 ```json
@@ -136,12 +138,32 @@ Get messages from a channel or DM.
       "user_id": "U05GPEVH7J9",
       "text": "Hello!",
       "datetime": "2026-01-02T15:33:50.000Z",
-      "has_thread": false
+      "has_thread": false,
+      "attachments": [
+        {
+          "text": "Additional message context"
+        }
+      ]
     }
   ]
 }
 ```
 
+`include_rich_message_fields` changes this tool's **output shape only** — it surfaces fields Slack
+already returns on the message object: `attachments`, `blocks`, `files`, `reactions`, `metadata`,
+plus `subtype`, `bot_id`, `app_id` (markers that flag automated / bot / app messages) and `team`
+(the workspace id, present on all messages). Especially `blocks` can be large, so it's opt-in per
+call to keep MCP client context lean.
+
+`include_all_metadata` is a **separate, independent** Slack request flag: its only effect is to add
+the full `event_payload` inside a message's developer `metadata` (without it you still get
+`metadata.event_type`). The two are orthogonal — set `include_rich_message_fields` to see `metadata`
+in the output at all; additionally set `include_all_metadata` for the full payload.
+
+Note: `slack_search_messages` matches are thin — Slack's search API does not return these rich
+fields on matches (only `team`). To read rich content for a search hit, call
+`slack_conversations_history` or `slack_get_thread` on the match's channel/ts.
+
 ---
 
 ### slack_get_full_conversation
@@ -152,10 +174,12 @@ Export full conversation with threads.
 | Name | Type | Default | Description |
 |------|------|---------|-------------|
 | channel_id | string | *required* | Channel or DM ID |
-| oldest | string | - | Unix timestamp start |
-| latest | string | - | Unix timestamp end |
+| oldest | string | - | Unix timestamp start; matching boundary timestamp is included |
+| latest | string | - | Unix timestamp end; matching boundary timestamp is included |
 | max_messages | number | 2000 | Max messages (up to 10000) |
 | include_threads | boolean | true | Fetch thread replies |
+| include_rich_message_fields | boolean | false | Include Slack attachments, blocks, metadata, files, and reactions when present |
+| include_all_metadata | boolean | false | Pass Slack's `include_all_metadata` option to `conversations.history` and `conversations.replies` |
 | output_file | string | - | Filename (saved to ~/.slack-mcp-exports/) |
 
 **Timestamps:**
@@ -188,6 +212,7 @@ Search messages across the workspace.
 |------|------|---------|-------------|
 | query | string | *required* | Search query |
 | count | number | 20 | Number of results (max 100) |
+| include_rich_message_fields | boolean | false | Include Slack attachments, blocks, metadata, files, and reactions when present |
 
 **Query Syntax:**
 - `from:@username` - From specific user
@@ -249,6 +274,8 @@ Get all replies in a thread.
 |------|------|---------|-------------|
 | channel_id | string | *required* | Channel or DM ID |
 | thread_ts | string | *required* | Thread parent timestamp |
+| include_rich_message_fields | boolean | false | Include Slack attachments, blocks, metadata, files, and reactions when present |
+| include_all_metadata | boolean | false | Pass Slack's `include_all_metadata` option to `conversations.replies` |
 
 **Returns:**
 ```json

package/docs/SETUP.md

@@ -138,6 +138,54 @@ slack_health_check
 
 You should see your username and team name.
 
+## Keep Tokens Fresh While Claude Is Closed (macOS, Optional)
+
+The MCP server auto-refreshes tokens every 4 hours while Claude is running. But if you keep Claude closed for a couple weeks, tokens expire silently — your next session opens with `invalid_auth`.
+
+A LaunchAgent fixes this. It runs token refresh twice a day regardless of whether Claude is open, as long as Chrome is running with a Slack tab somewhere.
+
+Create `~/Library/LaunchAgents/com.yourname.slack-token-refresh.plist`:
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>com.yourname.slack-token-refresh</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>-c</string>
+        <string>export NVM_DIR="$HOME/.nvm" &amp;&amp; [ -s "$NVM_DIR/nvm.sh" ] &amp;&amp; \. "$NVM_DIR/nvm.sh" &amp;&amp; exec npx -y @jtalk22/slack-mcp --refresh-tokens</string>
+    </array>
+    <key>StartCalendarInterval</key>
+    <array>
+        <dict><key>Hour</key><integer>6</integer><key>Minute</key><integer>17</integer></dict>
+        <dict><key>Hour</key><integer>18</integer><key>Minute</key><integer>17</integer></dict>
+    </array>
+    <key>RunAtLoad</key><true/>
+    <key>StandardErrorPath</key><string>/tmp/slack-token-refresh.log</string>
+</dict>
+</plist>
+```
+
+Load it:
+
+```bash
+launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.yourname.slack-token-refresh.plist
+```
+
+Check it ran:
+
+```bash
+tail /tmp/slack-token-refresh.log
+```
+
+**Why the `bash -c` wrapper:** LaunchAgents start without a TTY, so a bare `node` won't be on PATH if you use nvm. The wrapper sources `nvm.sh` first, then runs the refresher. (If you installed node via Homebrew, replace the whole inner command with `/opt/homebrew/bin/node /opt/homebrew/bin/npx -y @jtalk22/slack-mcp --refresh-tokens`.)
+
+**Trade-off:** Chrome must be running for extraction to succeed. If it's not, the LaunchAgent logs "Failed to extract" and tokens stay where they are — which is fine for another 12 hours.
+
 ## Troubleshooting
 
 ### "No credentials found"
@@ -151,7 +199,7 @@ Tokens have expired. Run `npx -y @jtalk22/slack-mcp --doctor` and follow the sug
 ### MCP Server Not Loading
 
 1. Check `~/.claude.json` syntax
-2. Verify the path to server.js is correct
+2. Verify JSON syntax in your client's MCP config
 3. Restart Claude Code
 
 ### Chrome Extraction Fails

package/lib/handlers.js

@@ -20,6 +20,7 @@ import {
   listProfiles as workflowListProfiles,
   ALLOWED_WORKFLOW_KINDS_LIST,
 } from "./workflow-store.js";
+import { withRichMessageFields } from "./rich-message-fields.js";
 
 // ============ Utilities ============
 
@@ -334,17 +335,19 @@ export async function handleListConversations(args) {
  */
 export async function handleConversationsHistory(args) {
   const resolveUsers = args.resolve_users !== false;
+  const includeRichMessageFields = parseBool(args.include_rich_message_fields);
   const result = await slackAPI("conversations.history", {
     channel: args.channel_id,
     limit: args.limit || 50,
     oldest: args.oldest,
     latest: args.latest,
-    inclusive: true
+    inclusive: true,
+    include_all_metadata: parseBool(args.include_all_metadata)
   });
 
   const messages = await Promise.all((result.messages || []).map(async (msg) => {
     const userName = resolveUsers ? await resolveUser(msg.user) : msg.user;
-    return {
+    return withRichMessageFields({
       ts: msg.ts,
       user: userName,
       user_id: msg.user,
@@ -352,7 +355,7 @@ export async function handleConversationsHistory(args) {
       datetime: formatTimestamp(msg.ts),
       has_thread: !!msg.thread_ts && msg.reply_count > 0,
       reply_count: msg.reply_count
-    };
+    }, msg, includeRichMessageFields);
   }));
 
   return {
@@ -374,6 +377,7 @@ export async function handleConversationsHistory(args) {
 export async function handleGetFullConversation(args) {
   const maxMessages = Math.min(args.max_messages || 2000, 10000);
   const includeThreads = args.include_threads !== false;
+  const includeRichMessageFields = parseBool(args.include_rich_message_fields);
   const allMessages = [];
   let cursor;
   let hasMore = true;
@@ -386,36 +390,38 @@ export async function handleGetFullConversation(args) {
       oldest: args.oldest,
       latest: args.latest,
       cursor,
-      inclusive: true
+      inclusive: true,
+      include_all_metadata: parseBool(args.include_all_metadata)
     });
 
     for (const msg of result.messages || []) {
       const userName = await resolveUser(msg.user);
-      const message = {
+      const message = withRichMessageFields({
         ts: msg.ts,
         user: userName,
         user_id: msg.user,
         text: msg.text || "",
         datetime: formatTimestamp(msg.ts),
         replies: []
-      };
+      }, msg, includeRichMessageFields);
 
       // Fetch thread replies if present
       if (includeThreads && msg.reply_count > 0) {
         try {
           const threadResult = await slackAPI("conversations.replies", {
             channel: args.channel_id,
-            ts: msg.ts
+            ts: msg.ts,
+            include_all_metadata: parseBool(args.include_all_metadata)
           });
           // Skip first message (parent)
           for (const reply of (threadResult.messages || []).slice(1)) {
             const replyUserName = await resolveUser(reply.user);
-            message.replies.push({
+            message.replies.push(withRichMessageFields({
               ts: reply.ts,
               user: replyUserName,
               text: reply.text || "",
               datetime: formatTimestamp(reply.ts)
-            });
+            }, reply, includeRichMessageFields));
           }
           await sleep(50); // Rate limit
         } catch (e) {
@@ -470,6 +476,7 @@ export async function handleGetFullConversation(args) {
  * Search messages handler
  */
 export async function handleSearchMessages(args) {
+  const includeRichMessageFields = parseBool(args.include_rich_message_fields);
   const result = await slackAPI("search.messages", {
     query: args.query,
     count: args.count || 20,
@@ -477,7 +484,7 @@ export async function handleSearchMessages(args) {
     sort_dir: "desc"
   });
 
-  const matches = await Promise.all((result.messages?.matches || []).map(async (m) => ({
+  const matches = await Promise.all((result.messages?.matches || []).map(async (m) => withRichMessageFields({
     ts: m.ts,
     channel: m.channel?.name || m.channel?.id,
     channel_id: m.channel?.id,
@@ -485,7 +492,7 @@ export async function handleSearchMessages(args) {
     text: m.text,
     datetime: formatTimestamp(m.ts),
     permalink: m.permalink
-  })));
+  }, m, includeRichMessageFields)));
 
   return {
     content: [{
@@ -553,19 +560,21 @@ export async function handleSendMessage(args) {
  * Get thread handler
  */
 export async function handleGetThread(args) {
+  const includeRichMessageFields = parseBool(args.include_rich_message_fields);
   const result = await slackAPI("conversations.replies", {
     channel: args.channel_id,
-    ts: args.thread_ts
+    ts: args.thread_ts,
+    include_all_metadata: parseBool(args.include_all_metadata)
   });
 
-  const messages = await Promise.all((result.messages || []).map(async (msg) => ({
+  const messages = await Promise.all((result.messages || []).map(async (msg) => withRichMessageFields({
     ts: msg.ts,
     user: await resolveUser(msg.user),
     user_id: msg.user,
     text: msg.text || "",
     datetime: formatTimestamp(msg.ts),
     is_parent: msg.ts === args.thread_ts
-  })));
+  }, msg, includeRichMessageFields)));
 
   return {
     content: [{

package/lib/rich-message-fields.js

@@ -0,0 +1,38 @@
+/**
+ * Rich Slack message fields (opt-in).
+ *
+ * Slack stores a lot of message content outside the plain `text` field:
+ * attachments, Block Kit `blocks`, `metadata`, `files`, and `reactions` — plus
+ * `subtype`/`bot_id`/`app_id` (which flag bot / app messages) and `team` (the
+ * workspace id, present on every message). An attachment-only or block-only alert
+ * looks empty when you read `text` alone; surfacing these fields closes that blind spot.
+ *
+ * These are fields Slack already returns on the message object, so this is an
+ * output-shape opt-in only — independent of Slack's `include_all_metadata` request
+ * flag (which separately adds the `event_payload` inside `metadata`). They can be
+ * large (especially `blocks`), so callers opt in per request.
+ */
+
+export const RICH_MESSAGE_KEYS = [
+  "attachments", "blocks", "metadata", "files", "reactions",
+  "subtype", "bot_id", "app_id", "team"
+];
+
+/**
+ * Merge present rich fields from a raw Slack message onto a formatted output.
+ *
+ * Mutates and returns `output`. No-op when disabled or `msg` is falsy. Only keys
+ * actually present on `msg` are copied; `undefined` keys are skipped (a present
+ * falsy value such as `[]` is still copied).
+ */
+export function withRichMessageFields(output, msg, includeRichMessageFields) {
+  if (!includeRichMessageFields || !msg) return output;
+
+  for (const key of RICH_MESSAGE_KEYS) {
+    if (msg[key] !== undefined) {
+      output[key] = msg[key];
+    }
+  }
+
+  return output;
+}

package/lib/tools.js

@@ -93,15 +93,23 @@ export const TOOLS = [
         },
         oldest: {
           type: "string",
-          description: "Unix timestamp - get messages after this time"
+          description: "Unix timestamp - get messages after this time (boundary timestamp included)"
         },
         latest: {
           type: "string",
-          description: "Unix timestamp - get messages before this time"
+          description: "Unix timestamp - get messages before this time (boundary timestamp included)"
         },
         resolve_users: {
           type: "boolean",
           description: "Convert user IDs to names (default true)"
+        },
+        include_rich_message_fields: {
+          type: "boolean",
+          description: "Include Slack message attachments, blocks, metadata, files, and reactions when present"
+        },
+        include_all_metadata: {
+          type: "boolean",
+          description: "Pass Slack's include_all_metadata option to conversations.history"
         }
       },
       required: ["channel_id"]
@@ -125,11 +133,11 @@ export const TOOLS = [
         },
         oldest: {
           type: "string",
-          description: "Unix timestamp start (e.g., 1733011200 = Dec 1, 2025)"
+          description: "Unix timestamp start (e.g., 1733011200 = Dec 1, 2025; boundary timestamp included)"
         },
         latest: {
           type: "string",
-          description: "Unix timestamp end"
+          description: "Unix timestamp end (boundary timestamp included)"
         },
         max_messages: {
           type: "number",
@@ -139,6 +147,14 @@ export const TOOLS = [
           type: "boolean",
           description: "Fetch thread replies (default true)"
         },
+        include_rich_message_fields: {
+          type: "boolean",
+          description: "Include Slack message attachments, blocks, metadata, files, and reactions when present"
+        },
+        include_all_metadata: {
+          type: "boolean",
+          description: "Pass Slack's include_all_metadata option to conversations.history and conversations.replies"
+        },
         output_file: {
           type: "string",
           description: "Filename to save export (saved to ~/.slack-mcp-exports/)"
@@ -166,6 +182,10 @@ export const TOOLS = [
         count: {
           type: "number",
           description: "Number of results (max 100, default 20)"
+        },
+        include_rich_message_fields: {
+          type: "boolean",
+          description: "Include Slack message attachments, blocks, metadata, files, and reactions when present"
         }
       },
       required: ["query"]
@@ -239,6 +259,14 @@ export const TOOLS = [
         thread_ts: {
           type: "string",
           description: "Thread parent message timestamp"
+        },
+        include_rich_message_fields: {
+          type: "boolean",
+          description: "Include Slack message attachments, blocks, metadata, files, and reactions when present"
+        },
+        include_all_metadata: {
+          type: "boolean",
+          description: "Pass Slack's include_all_metadata option to conversations.replies"
         }
       },
       required: ["channel_id", "thread_ts"]

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jtalk22/slack-mcp",
   "mcpName": "io.github.jtalk22/slack-mcp-server",
-  "version": "4.2.2",
+  "version": "4.4.0",
   "description": "Slack MCP without OAuth. 21 tools (16 read/write Slack + 2 workflow profile primitives + 3 hosted-brain upgrade stubs). Free OSS or hosted (free tier no card; $9/mo Pro = unlimited; morning DM rolling out Q2 2026).",
   "type": "module",
   "main": "src/server.js",
@@ -13,6 +13,7 @@
     "slack-mcp-setup": "scripts/setup-wizard.js"
   },
   "scripts": {
+    "test": "node --test",
     "start": "node src/server.js",
     "http": "node src/server-http.js",
     "web": "node src/web-server.js",

package/public/index.html

@@ -190,6 +190,36 @@
       margin-bottom: 15px;
     }
     .modal input:focus { border-color: var(--teal); outline: none; }
+    .auth-options {
+      display: flex;
+      align-items: center;
+      gap: 8px;
+      margin: -4px 0 16px;
+      color: var(--muted);
+      font-size: 13px;
+      text-align: left;
+    }
+    .auth-options input { width: auto; margin: 0; }
+    .header-row {
+      display: flex;
+      justify-content: space-between;
+      align-items: flex-start;
+      gap: 12px;
+      margin-bottom: 20px;
+    }
+    .header-row h1 { margin-bottom: 0; }
+    .disconnect-btn {
+      display: none;
+      padding: 8px 12px;
+      background: transparent;
+      color: var(--muted);
+      border: 1px solid rgba(255, 255, 255, 0.18);
+      border-radius: 999px;
+      cursor: pointer;
+      white-space: nowrap;
+    }
+    .disconnect-btn.visible { display: inline-block; }
+    .disconnect-btn:hover { color: var(--text); border-color: rgba(255, 255, 255, 0.32); }
     .modal button {
       width: 100%;
       padding: 14px;
@@ -213,6 +243,10 @@
 
     @media (max-width: 640px) {
       body { padding: 12px; }
+      .header-row {
+        flex-direction: column;
+        align-items: stretch;
+      }
       h1 {
         display: flex;
         flex-direction: column;
@@ -247,14 +281,18 @@
     <div class="modal">
       <h2>Enter API Key</h2>
       <p>Copy the API key from the console where you ran<br><code>npm run web</code></p>
-      <input type="text" id="modalApiKey" placeholder="smcp_xxxxxxxxxxxx" autofocus>
+      <input type="text" id="modalApiKey" placeholder="smcp_xxxxxxxxxxxx" autocomplete="off" autofocus>
+      <label class="auth-options"><input type="checkbox" id="rememberApiKey"> Remember this key on this device</label>
       <button onclick="submitApiKey()">Connect</button>
       <div id="modalError" class="error"></div>
     </div>
   </div>
 
   <div class="container">
-    <h1>Slack Web API <span id="status" class="status"></span></h1>
+    <div class="header-row">
+      <h1>Slack Web API <span id="status" class="status"></span></h1>
+      <button type="button" id="disconnectButton" class="disconnect-btn" onclick="disconnect()">Disconnect</button>
+    </div>
     <div style="background:rgba(240,194,70,0.08);border:1px solid rgba(240,194,70,0.2);border-radius:8px;padding:8px 14px;margin-bottom:16px;display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:8px;font-size:13px;color:#d4c48a">
       <span>Hosted tiers live — <strong style="color:#f0c246">managed MCP endpoint, OAuth bridge for Claude.ai, encrypted storage</strong></span>
       <a href="https://mcp.revasserlabs.com" style="color:#f0c246;font-weight:600;text-decoration:none;white-space:nowrap" target="_blank">See tiers &rarr;</a>
@@ -290,18 +328,33 @@
     let apiKey = null;
     let currentChannel = null;
 
-    // Initialize: check URL param, then localStorage
+    function clearStoredApiKey() {
+      sessionStorage.removeItem('slackApiKey');
+      localStorage.removeItem('slackApiKey');
+    }
+
+    function rememberStoredApiKey(key) {
+      sessionStorage.removeItem('slackApiKey');
+      localStorage.setItem('slackApiKey', key);
+    }
+
+    function storeSessionApiKey(key) {
+      localStorage.removeItem('slackApiKey');
+      sessionStorage.setItem('slackApiKey', key);
+    }
+
+    // Initialize: check URL param, session storage, then remembered local storage
     (function init() {
       const params = new URLSearchParams(window.location.search);
       const keyFromUrl = params.get('key');
 
       if (keyFromUrl) {
-        // Save key from magic link and strip from URL
+        // Save magic-link keys for this tab only and strip them from the URL.
         apiKey = keyFromUrl;
-        localStorage.setItem('slackApiKey', apiKey);
+        storeSessionApiKey(apiKey);
         history.replaceState({}, '', window.location.pathname);
       } else {
-        apiKey = localStorage.getItem('slackApiKey');
+        apiKey = sessionStorage.getItem('slackApiKey') || localStorage.getItem('slackApiKey');
       }
 
       if (apiKey) {
@@ -329,7 +382,11 @@
         return;
       }
       apiKey = input;
-      localStorage.setItem('slackApiKey', apiKey);
+      if (document.getElementById('rememberApiKey').checked) {
+        rememberStoredApiKey(apiKey);
+      } else {
+        storeSessionApiKey(apiKey);
+      }
       hideModal();
       connect();
     }
@@ -346,8 +403,9 @@
       });
       if (res.status === 401 || res.status === 403) {
         // Auth failed - clear stored key and show modal
-        localStorage.removeItem('slackApiKey');
+        clearStoredApiKey();
         apiKey = null;
+        document.getElementById('disconnectButton').classList.remove('visible');
         showModal('Invalid or expired API key. Check console for current key.');
         throw new Error('Authentication failed');
       }
@@ -363,6 +421,7 @@
         const health = await api('/health');
         status.textContent = '● ' + health.user + ' @ ' + health.team;
         status.className = 'status ok';
+        document.getElementById('disconnectButton').classList.add('visible');
         loadConversations('im,mpim');
       } catch (e) {
         if (e.message !== 'Authentication failed') {
@@ -371,6 +430,18 @@
         }
       }
     }
+    function disconnect() {
+      clearStoredApiKey();
+      apiKey = null;
+      currentChannel = null;
+      document.getElementById('disconnectButton').classList.remove('visible');
+      document.getElementById('status').textContent = '';
+      document.getElementById('conversationList').innerHTML = '<li class="loading">Enter API key to connect</li>';
+      document.getElementById('channelName').textContent = 'Select a conversation';
+      document.getElementById('messages').innerHTML = '<div class="loading">Messages will appear here</div>';
+      showModal('Disconnected. Enter an API key to reconnect.');
+    }
+
     async function loadConversations(types, sourceButton = null) {
       const list = document.getElementById('conversationList');
       list.innerHTML = '<li class="loading">Loading...</li>';

package/public/share.html

@@ -5,9 +5,10 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Slack MCP Server</title>
   <meta name="description" content="No OAuth. No admin. 21 Slack tools for Claude, Cursor, Copilot, Gemini, and any MCP client. One command: npx -y @jtalk22/slack-mcp --setup">
+  <link rel="canonical" href="https://jtalk22.github.io/slack-mcp-server/public/share.html">
   <meta property="og:type" content="website">
   <meta property="og:title" content="Slack MCP Server — No OAuth, no admin, just your browser session">
-  <meta property="og:description" content="Slack's official MCP needs OAuth + admin. This one uses your browser session. 21 tools, works with Claude, Cursor, Copilot, Gemini.">
+  <meta property="og:description" content="OAuth-free Slack MCP using your browser session. 21 tools, works with Claude, Cursor, Copilot, Gemini.">
   <meta property="og:url" content="https://jtalk22.github.io/slack-mcp-server/public/share.html">
   <meta property="og:image" content="https://jtalk22.github.io/slack-mcp-server/docs/images/social-preview-v3.png">
   <meta property="og:image:width" content="1280">

package/server.json

@@ -17,7 +17,7 @@
     "url": "https://github.com/jtalk22/slack-mcp-server",
     "source": "github"
   },
-  "version": "4.2.2",
+  "version": "4.4.0",
   "remotes": [
     {
       "type": "streamable-http",
@@ -28,7 +28,7 @@
     {
       "registryType": "npm",
       "identifier": "@jtalk22/slack-mcp",
-      "version": "4.2.2",
+      "version": "4.4.0",
       "transport": {
         "type": "stdio"
       },

package/src/cli.js

@@ -37,6 +37,9 @@ if (firstArg === "web") {
 } else if (firstArg === "--apply-template" || firstArg === "apply-template") {
   scriptPath = join(__dirname, "../scripts/apply-template.js");
   scriptArgs = args.slice(1);
+} else if (firstArg === "--refresh-tokens" || firstArg === "refresh-tokens") {
+  scriptPath = join(__dirname, "../scripts/token-cli.js");
+  scriptArgs = ["auto"];
 } else if (WIZARD_ARGS.has(firstArg)) {
   scriptPath = join(__dirname, "../scripts/setup-wizard.js");
   scriptArgs = args;