Slack MCP Server

Integration Overview

Slack is the communication platform where most security teams coordinate investigations, share findings, and notify stakeholders. With the Slack MCP server, Panther AI can send messages, search channels and files, manage canvases, and look up user profiles — all from within the Panther AI chat experience.

Admins configure which MCP servers are available to the organization. Each analyst then connects individually via OAuth and controls which tools Panther AI is allowed to use, with the option to require approval before any action is taken.

Use Cases for the Slack MCP Server

• Ask Panther AI to post an alert summary to a security channel as part of a triage workflow

• Search Slack for prior conversations about a specific indicator, host, or threat actor

• Have Panther AI notify the on-call analyst or incident commander when escalating an alert

• Send investigation updates to a shared incident channel without leaving the Panther console

Connecting the Slack MCP Server

Navigate to Settings > Panther AI > MCP Servers and select Slack from the catalog. Slack requires manual OAuth credentials — you'll create a Slack app, configure the required user token scopes, and enable MCP in the app settings before providing the client ID and secret in Panther.

For full setup instructions, view the Slack MCP server documentation here.