Slack

Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment.

Reads the public Slack channels that the LightHouse app has been added to, a thread at a time, so agents can answer from what the team has already said. A person adding the app to a channel is the decision to let the agents read it.

At a glance

Collector	Slack, version 1.0.0
Reads	Slack: Slack Web API (the vendor's documentation)
Family	Communication
Kind	Chat
Ways to connect	Access token, OAuth approval
Scopes	Read: channels:read, channels:history, users:read, team:read
Read only	Yes
Vendor's API can move money	No
Personal data	Content, Identity
Hosts it may contact	slack.com
Vendor API versions	Slack Web API (auth.test, conversations.list, conversations.history, conversations.replies)
Lowest engine version	0.45.0

What it reads

• Public channels the app is a member of (by name with channels, or every such channel). Private channels, direct messages and group messages are never read; the scopes asked for cannot reach them.
• A thread is one record: the first message and its replies, in order, with the channel and who wrote it. Slack’s mentions and links are turned into readable text.
• Each pull reads the last recent_days (seven by default) of every channel, which catches new messages and replies to recent threads. Every reconcile_hours (six by default) the whole history_days window (365 by default) is listed and held to what the cursor knows: a thread that has gone is withdrawn, one whose replies changed is read again, and one older than the window leaves the corpus.
• A channel the app has left, that was archived, or that you take out of channels has its threads withdrawn.
• Never read: files, joins and other channel events.

How to connect

1. A workspace administrator installs the LightHouse Slack app (or your own app, which can be the one Octy answers in) with the bot scopes below. The bot token begins xoxb-.
2. A person adds the app to each public channel to be read.
3. In LightHouse, open Connectors, choose Slack, name the channels (optional), the label and how often to read, and approve the install or paste the bot token.
4. In code, give the deployment the bot token as SLACK_TOKEN from your secret store and add a kind: slack source card with label, optional channels, history_days and requires.

Permissions

Bot scopes channels:read (which public channels the app is in), channels:history (their messages and threads), users:read and team:read. The collector sends only GET requests to slack.com: auth.test, conversations.list (public channels only), conversations.history and conversations.replies. It never posts. Its read-only test proves it on every change.

Limits

• history_days is 1 to 3650 and recent_days 1 to history_days; channel names are lower-case letters, digits, _ and -.
• A channel the app is not a member of is not read.
• A thread older than the window leaves the corpus.
• Slack’s ok: false answers are reported by code only (for example not_in_channel, missing_scope).
• Requests are paced and back off when Slack asks (Retry-After).

Data handling

• Message text is copied into the deployment’s corpus under the source’s label, with the sender’s display name. Chat names people and holds personal data of any kind.
• The bot token stays in your secret store and is never written to logs or run notes; the error reports Slack’s error code, never a body.
• Nothing leaves the deployment: only counts reach LightHouse.

Troubleshooting

What you see	What it means	What to do
not Slack channel names	A channel is not written as a lower-case Slack name	Use the channel’s name without #
history_days is 1 to 3650, and recent_days 1 to history_days	A window is out of range	Correct the numbers
credential variable 'SLACK_TOKEN' is not set	The bot token variable is empty	Set it to the bot token
Slack refused: invalid_auth	The token is wrong or revoked	Reinstall the app and use its new bot token
Slack refused: missing_scope	The app lacks channels:read or channels:history	Add the scope and reinstall
Slack refused: not_in_channel	The app is not in the channel	Add the app to the channel
Read succeeded, 0 written	Nothing new in the recent window	Nothing to do

Certification

Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See How collectors are certified.

Date	Collector	Engine	Vendor API	Method	Expires
10 November 2026	1.0.0	0.45.0	Slack Web API	Fixtures only: built, not certified	Not applicable

Security posture

From the collector’s last scan on the default branch. What each line means, and what blocks a release: Security posture.

Last scanned	10 November 2026
Critical findings	0
High findings	0
Medium findings	0
Low findings	0
Info findings	0
Release blocked	No
Network allow-list check	Pass
Read-only behavioural test	Pass
SBOM (CycloneDX)	Produced
Dependency licences	Pass
Scanners	bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only