Slack Plugin

Overview

The ManageLM Slack plugin connects your infrastructure to Slack through the same portal API used by the n8n and VS Code integrations, which covers the same features ManageLM gives Claude through MCP. It provides two-way communication:

• Inbound: ManageLM webhook events are posted to Slack as rich Block Kit messages
• Outbound: Slack slash commands call the ManageLM API to check status, run tasks and scans, and search your fleet

Features

Architecture

The plugin serves everything on a single HTTP port (PORT, default 3100):

Prerequisites

• Node.js 20.6+
• A ManageLM account with at least one agent (create account)
• A Slack workspace where you can install apps
• A server or container with a public URL (for HTTP mode) or use Socket Mode for local development

1. Create a Slack App

Quick method: use the manifest

1. Go to api.slack.com/apps and click Create New App > From an app manifest

2. Select your workspace

3. Paste the manifest below (YAML tab), replacing <YOUR_HOST> with your plugin's public URL

4. Click Create

display_information:
  name: ManageLM
  description: Manage your servers from Slack.

features:
  bot_user:
    display_name: ManageLM
    always_online: true
  slash_commands:
    - command: /managelm
      description: Manage your servers with ManageLM
      usage_hint: status | run <host> <skill> <task> | task <id> | answer <id> <text> | scan <host> <type> | search <kind> [text]

oauth_config:
  scopes:
    bot:
      - chat:write
      - commands
      - views:write

settings:
  interactivity:
    is_enabled: true
    request_url: https://<YOUR_HOST>/slack/events

Manual method

1. Go to api.slack.com/apps > Create New App > From scratch

2. Under OAuth & Permissions, add bot scopes: chat:write, commands, views:write

3. Under Slash Commands, create /managelm with Request URL https://<your-host>/slack/events

4. Under Interactivity, enable and set Request URL to https://<your-host>/slack/events

After creating the app

1. Install the app to your workspace

2. Copy the Bot User OAuth Token (xoxb-...) from OAuth & Permissions

3. Copy the Signing Secret from Basic Information

2. Create a ManageLM API Key

1. In the ManageLM portal, go to Settings > MCP & API > API Keys

2. Create a key and tick the authorizations the bot needs: Reports to start scans, Credentials to search credentials. Only permissions you hold yourself are offered.

3. Copy the key (mlm_ak_...)

3. Configure Environment

Copy the example file and fill in your credentials:

# Slack credentials
SLACK_BOT_TOKEN=xoxb-your-token
SLACK_SIGNING_SECRET=your-signing-secret
# Only for Socket Mode: leave it out for HTTP mode
# SLACK_APP_TOKEN=xapp-your-app-token

# ManageLM
MANAGELM_PORTAL_URL=https://app.managelm.com
MANAGELM_API_KEY=mlm_ak_your-key

# Webhook
# Same secret as on the portal webhook
MANAGELM_WEBHOOK_SECRET=your-webhook-secret
PORT=3100

# Who may use the bot (optional, comma-separated Slack IDs). Unset: anyone in the workspace
SLACK_ALLOWED_USERS=U0123456789,U9876543210
SLACK_ALLOWED_CHANNELS=C0123456789

# Channel routing (optional): warnings and critical events, then all other events
SLACK_CHANNEL_ALERTS=C0123456789
SLACK_CHANNEL_INFO=C9876543210

4. Register the Webhook

An admin, in the ManageLM portal, goes to Settings > MCP & API > Webhooks and creates a webhook:

The portal signs every delivery with HMAC-SHA256. The plugin verifies the X-Webhook-Signature header before processing any event.

5. Run the Plugin

Node.js

npm install
npm run build
node --env-file=.env dist/app.js

Docker

docker build -t managelm-slack .
docker run --env-file .env -p 3100:3100 managelm-slack

Docker Compose

services:
  managelm-slack:
    build: .
    env_file: .env
    ports:
      - "3100:3100"
    restart: unless-stopped

Slash Commands

Examples

/managelm status
/managelm run web-prod-01 packages List outdated packages
/managelm run lb-01 auto Restart nginx
/managelm scan db-master security
/managelm search security ssh
/managelm search monitors

The run command works like submitting a task from Claude or the portal UI. It sends the instruction to the agent, waits up to 100 seconds for the result, and posts it back to the channel. A longer task is reported as still running, with the command to check it later.

Event Notifications

When a ManageLM webhook event fires, the plugin posts a Block Kit message with the event details and a View in Portal link:

Interactive Buttons

• View Details: fetch the task status and result and display it as an ephemeral message
• View in Portal: open the matching ManageLM portal page in your browser

Channel Routing

Route warnings and critical events to a dedicated alerts channel and informational events elsewhere. Alerts are the events the portal itself flags: agent offline, task failed, monitor down or stalled, backup or credential rotation failed, certificate renewal failed or revoked, keystore refusals and deleted keys, failed or stalled reports and pentests, and admin sessions opened.

# Warnings and critical events
SLACK_CHANNEL_ALERTS=C0123456789
# All other events
SLACK_CHANNEL_INFO=C9876543210

If only one variable is set, every event goes to that channel. Make sure to invite the bot to the target channels. With neither set, the result of a task started from the run form comes to you as a direct message.

Environment Reference

Security

• Webhook HMAC: the portal signs every webhook payload with HMAC-SHA256. The plugin uses crypto.timingSafeEqual to verify signatures, preventing timing attacks, refuses a delivery sent more than 5 minutes ago and ignores a repeat of one already received, so a captured one cannot be replayed.
• Access control: SLACK_ALLOWED_USERS and SLACK_ALLOWED_CHANNELS limit who can run commands, submit the run form and use message buttons. Without them, anyone in the workspace can.
• Slack request verification: all incoming Slack requests are verified using the Signing Secret via the Bolt framework.
• API key scope: the key acts as its creator, limited to the authorizations ticked, and cannot reach portal settings, users, keys or webhooks. Use the narrowest scope that fits your needs.
• Private answers: replies to /managelm answer are ephemeral, so an answer such as a password is never shown to the channel.
• No secrets in messages: the plugin never posts API keys, tokens, or raw server credentials to Slack channels.
• Body size limit: the webhook receiver rejects payloads over 512 KB to prevent memory exhaustion.

Troubleshooting

Slash command returns "dispatch_failed"

Slack cannot reach your plugin. Verify your Request URL in the Slack app settings points to https://<your-host>/slack/events and the plugin is running. For local development, use Socket Mode instead.

No notifications appear in Slack

• Check the webhook is registered and enabled in Settings > MCP & API > Webhooks in the ManageLM portal, with the event categories you expect
• Verify SLACK_CHANNEL_ALERTS or SLACK_CHANNEL_INFO is set and the bot is invited to those channels
• Check the plugin logs for [webhook] Received event: messages
• Verify the webhook secret matches between portal and MANAGELM_WEBHOOK_SECRET

401 Invalid signature on webhooks

The MANAGELM_WEBHOOK_SECRET in your .env does not match the secret configured on the webhook in the portal. Update one to match the other. A delivery is also refused when the plugin host's clock is more than 5 minutes off: keep it synchronized (NTP).

Agent not found when using /managelm run

The name you typed doesn't exactly match an agent the key can see. The plugin matches the full hostname or display_name (case does not matter) and never guesses from a partial name: it suggests close matches instead. Use /managelm status to see exact names.

Permission denied

The key lacks an authorization the command needs (for example Reports for scan, Credentials for search credentials), or the key's creator cannot access that server. Create a key with the right authorizations.

Task still running

The task took longer than 100 seconds. It keeps running on the agent: check it with /managelm task <task_id>, or subscribe the webhook to task events to be notified when it finishes.