For Slack admins
Reviewing a Roster request
Someone in your workspace asked to install Roster. It lets them ask their AI assistant (such as Claude) about Slack conversations they can already see. Here is what it does, so you can decide.
Permissions it asks for
Only user scopes, no bot. Every permission is read-only and limited to what the requesting person can already see.
search:read | search messages |
channels:history | read messages in public channels |
channels:read | list public channels |
groups:history | read messages in private channels you're in |
groups:read | list private channels you're in |
users:read | show people's names instead of IDs |
What it can't do
- Post, edit, react to or delete messages.
- Read direct messages or group DMs. They are filtered out even from search.
- Read channels the requester isn't a member of, or private channels they can't see.
- Change any workspace, channel or user setting.
The requester can also limit it to specific channels in Roster. Anything outside that list is refused.
How data is handled
- Messages are fetched only when the AI assistant asks, passed straight back, and not stored or logged.
- The Slack token is encrypted with AES-256-GCM and never sent to the browser or the AI assistant.
- We keep metadata only: workspace name and ID, the requester's Slack user ID, granted scopes, and a log of which tool ran and whether it worked.
Full details are on the privacy page.
Approving and removing it
Approve the request from Slack's app management page or the request DM. After approval, the requester clicks Add to Slack again to finish connecting.
To remove access later, remove Roster from your workspace's installed apps. Its tokens stop working right away.
Questions
Email prathamshirbhate1909@gmail.com. Roster isn't listed in the Slack Marketplace yet, which is why Slack labels it “not approved by Slack”.