Our security team uses the Slack integration permissions docs when approving the Cursor Slack app. That page only lists 18 bot scopes. On the Slack Marketplace → Security & Compliance tab, I also see 30 User Token Scopes and 22 Bot Token Scopes (including scopes not on the docs, e.g. links:read / links:write on the bot side).
Documentation: Could you update the Slack integration permissions section to include both User and Bot token scopes, with short descriptions (like the current bot table), so it matches what admins see on Marketplace?
Sensitive scopes: For scopes such as search:read.private, app_configurations:read / write, and managed_apps:install — what product features require them, and can any of them be disabled or limited per workspace?
Hey @T.H, the standard workspace install is bot-token only, and the user token scopes are only ever issued if an individual opts in (connecting the Slack MCP or setting up a custom bot). For the full per-scope purposes and exactly what can be limited for your workspace, since this is feeding a formal security review, the best path is to email [email protected]. We’ll walk it through with you and point you to the right artifacts (SOC 2 and more) via the Trust Center.
I’d mixed this up with my own setup: I’m using Slack’s slack-skills-plugin (Slack MCP) on my machine. The scope list I was worried about was from that personal plugin/MCP connection, not from our workspace’s standard Cursor Slack integration. Sorry for the noise.
