Skip to content
Get started
Back to writing
Guides9 min read

How to Add an AI Agent to Slack

Add a Slack AI agent that answers mentions and DMs, uses your tools, checks each person's access and stays quiet when people talk to each other.

Grainy film still of a classical marble bust in a dim room lit cobalt blue, an orange-red glow on its face from a screen just out of frame

Short answer: To add an AI agent to Slack, create the agent, create a Slack app from a manifest that grants the scopes and events it needs, then connect the app's bot token and signing secret and invite it to a channel. On Keiki the manifest is generated for you, every request from Slack is verified, and tools that change data can require a named person's approval before they run.

It's Monday morning and someone in #sales types "@agent any new leads from X since Friday?" Two minutes later a reply lands in the thread: two short lead summaries, where each one came from, and a draft response for each. A colleague replies to the first summary to tag the account owner. The agent says nothing, because nobody was talking to it.

That second moment matters as much as the first. Slack sends a bot every message in every channel it belongs to, and a bot that answers too much gets muted within a week. A good Slack AI agent answers when it's addressed, uses your real systems, knows who it's talking to, and stays out of everything else.

This guide shows you how to build that: what a Slack agent should answer, how to set one up step by step, and how to connect it securely so each person keeps their own level of access.

Why Slack is where agents live now

Slack has said plainly that it wants to be the home for agents. On October 20, 2025, Slack announced at Dreamforce that it is becoming an "agentic operating system" where an organization's agents live, with a new Real-Time Search API and Model Context Protocol (MCP) server so third-party agents can work with Slack data. Slack's developer docs now describe agents as "autonomous, goal-oriented AI apps that can reason, use tools, and maintain context across conversations," and the guide to developing an agent breaks the work into a response loop: receive input, reason, call tools, render output.

People are also using agents at work already. The Slack Workforce Index from June 2025, a survey of 5,156 desk workers in six countries, found that 40% of workers had worked with an AI agent and 23% had handed tasks to one to complete for them. It also found that daily agent users were more than twice as likely to report high trust in AI.

What a Slack agent should answer

Before the model sees anything, Keiki classifies each Slack event. Most of them never reach the model at all.

| Event | What the agent does | | --- | --- | | A direct message to the app | Always answers | | A message that mentions the app | Answers and joins that thread | | A reply in a thread the agent is already in | Decides whether it's being addressed | | An edit that adds a mention it hadn't seen | Treats it as a new mention | | A file shared right after the agent asked for one | Picks it up in that thread | | Channel chatter, joins, reactions | Ignores it |

Inside a thread, the agent is told on every message whether it was mentioned, whether someone else was, and whether it's a DM. Its instructions are simple: if it's addressed, answer. If two people are talking to each other, say nothing. If it's unsure, stay quiet. A missed message costs a re-ask. An interruption costs trust.

A quiet turn posts nothing, not even a "..." message, but it's still recorded in the trace and marked silent, so you can see what the agent chose not to say. The full behaviour contract is in the Slack agents docs.

How to set up an AI agent in Slack

You can do all of this from the Keiki dashboard. Only step 5 has optional code.

Step 1: Create the agent

Describe the job in plain language, for example: "Answer questions about our customers using our CRM and docs, and draft replies to new leads." Then connect the tools it needs: an MCP server, a webhook, or a capability from the marketplace. Test it in the dashboard before it goes anywhere near Slack.

Step 2: Create the Slack app from the generated manifest

On the agent's Channels page, add Slack and choose Create app in Slack. Keiki opens Slack with an app manifest that already fills in the scopes, the bot events (app_mention, message.channels, message.groups, message.im, message.mpim, assistant_thread_started and assistant_thread_context_changed), the events request URL and the Interactivity URL. Choose a workspace, create the app, then select Install to Workspace.

If you already have a Slack app, choose Use an existing app instead. Keiki shows the two request URLs to paste into the app's Event Subscriptions and Interactivity settings. Interactivity is what makes the Approve and Decline buttons work, so don't skip it.

Step 3: Connect the bot token and signing secret

Copy the xoxb- bot token and the signing secret from the Slack app back into Keiki. Keiki checks the token with Slack as you type, so you find out about a wrong token before you save.

The signing secret is what keeps strangers out. Slack signs every request it sends with it, and Slack's guide to verifying requests from Slack recommends rejecting any request whose timestamp is more than five minutes old to stop replay attacks. Keiki does that check for you on every event and every button press.

Step 4: Invite the bot to one channel

Invite the app to a single channel first. Channel membership is the read gate: the agent only sees channels it was invited to. Starting in one place gives your team somewhere to try it before it shows up everywhere.

Then test the basics:

  • Mention it with a question and check that it answers in a thread.
  • Have two people talk to each other in that thread and check that it stays quiet.
  • Send three messages in a row. Keiki's steering gathers messages that land close together into one turn, so you should get one answer, not three.
  • Type "stop" while it's working. The running turn ends and the agent reacts to your message to confirm. There is also a Stop button on its status message.

Step 5: Gate the tools that change things

An agent that only searches is a search box. The useful version files the ticket, updates the deal or sends the follow-up. Those are the tools that need a person's say-so.

If you define tools with the Keiki SDK, add a policy beside execute:

import { AgentKit, defineTool } from '@onkeiki/agents'
import { Effect, Schema } from 'effect'

const updateDealStage = defineTool({
  name: 'update_deal_stage',
  description: 'Move a deal to a new pipeline stage.',
  input: Schema.Struct({ dealId: Schema.String, stage: Schema.String }),
  policy: { approval: 'ask', requiredScopes: ['deals:write'] },
  execute: (input) =>
    Effect.promise(async () => {
      const res = await fetch(`https://crm.example.com/deals/${input.dealId}`, {
        method: 'PATCH',
        headers: { 'content-type': 'application/json' },
        body: JSON.stringify({ stage: input.stage }),
      })
      return { ok: res.ok }
    }),
})

const kit = AgentKit.create({
  apiKey: process.env.KEIKI_API_KEY!,
  name: 'Sales agent',
  agent: {
    model: '<model-id>',
    maxSteps: 10,
    historyLimit: 40,
    systemPrompt: () => 'You help the sales team with leads and deals.',
    tools: [updateDealStage],
  },
})

await kit.sync()

With approval: 'ask', the agent posts a card in the thread with what it's about to do and Approve and Decline buttons. Nothing runs until someone decides. You can also pair a write with a preview tool, so the card shows the exact change and Keiki checks the facts haven't moved before it runs. Read governed actions for previews, groups of writes and the action history. The same idea on iMessage is covered in How to Add Human-in-the-Loop to an iMessage Agent.

How to securely connect Slack to your AI agent

A Slack agent in a shared channel talks to many people, and they shouldn't all have the same power. The OWASP Top 10 for LLM applications calls this risk excessive agency, and names three root causes: excessive functionality, excessive permissions and excessive autonomy. A secure Slack agent addresses all three:

  • Functionality. Give the agent only the tools its job needs. If an MCP server also serves writes you don't want the agent to use, set those tools to deny in the connection's tool permissions.
  • Permissions. Check each tool call against what the person asking is allowed to do in your system.
  • Autonomy. Require approval for anything that changes data or money, and check the approver's permissions too.

Keiki handles permissions with identity. You run one HTTPS endpoint. For each new person in a conversation, Keiki sends it the Slack team and user (and email, if the app has the users:read.email scope) in a signed request. You answer with your user id, a role and a list of scopes, like billing:read or deals:write. Keiki then checks every tool call against those scopes before the tool runs. A call the person isn't allowed to make never reaches your API, and the agent tells them which permission they're missing.

Approvals follow the same rule. When someone presses Approve, Keiki checks the approver's scopes, not the requester's. A person without the scope gets a private refusal and the card stays pending. The action record keeps both names.

A few details worth knowing:

  • Without an identity endpoint, the agent knows each speaker's Slack name and id and nothing more, and every tool with requiredScopes is refused. Declaring scopes is safe before the endpoint exists.
  • If your endpoint fails or times out, the agent still answers, but gated tools are refused and the agent says it couldn't verify who is speaking. It never falls back to "allow".
  • In a Slack Connect channel, people from other workspaces can talk to the agent, and your endpoint decides what they can do. Return no scopes for a team that isn't yours to keep outsiders read-only.
  • Today you set identity through the partner deployments API, not the Slack setup screen.

What teams use Slack agents for

Two Keiki customers run their agents in Slack:

  • Arc built an agent that searches X, checks requests against the studio's ideal customer profile and brings qualified opportunities into Slack with the source and company context. The founder reports booking a call with a qualified prospect about 30 minutes after onboarding. Read the Arc customer story.
  • Panda Agency uses agents inside its Slack workspace to find video production leads, prepare client files and pull assets from Google Drive. The founder reports client setup going from 30 to 60 minutes to about one minute. Read the Panda Agency customer story.

Already built your own Slack bot?

If your home-grown Slack bot has slowly grown a runtime (permission checks, approval cards, a mid-turn message queue, a stop command), you can move that runtime to Keiki and keep what's yours: your tools, your identity endpoint, your rules and your skills. See Migrate a bespoke Slack agent for running one Keiki agent per customer organization, provisioned from your backend.

The same agent isn't limited to Slack, either. You define it once, and iMessage, SMS, WhatsApp, Telegram and email are channels you add to it. Introducing Keiki explains the idea.

FAQ

What is a Slack AI agent? A Slack AI agent is an app that reads messages addressed to it, calls tools like your CRM or ticketing system, and replies in the thread. Unlike a slash-command bot, it keeps context across a conversation and can take actions, with a person's approval for anything that changes data.

How do I build an AI agent for Slack? Create the agent, create a Slack app from a manifest with the right scopes and events, and connect the app's bot token and signing secret to the agent's runtime. On Keiki, the manifest is generated for you and the setup takes a few minutes in the dashboard.

How can I securely connect Slack to my AI agent? Verify every request with Slack's signing secret, give the agent only the tools its job needs, check each tool call against the asking person's permissions in your own system, and require approval for writes. Keiki does the request verification, and its identity endpoint and tool policies cover the rest.

Will a Slack AI agent read every message in my workspace? On Keiki, no. It only sees channels the app was invited to, and channel chatter that isn't addressed to it is ignored before it reaches the model.

Can the same agent answer on other channels too? Yes. A Keiki agent is defined once, and Slack, iMessage, SMS, WhatsApp, Telegram and email are channels you connect to it.

Sources