feat: add slackbot mcp client examples with various authentication techniques by zimeg · Pull Request #66 · slack-samples/bolt-python-examples

zimeg · 2026-06-16T06:41:33Z

Summary

This PR adds Slackbot MCP client examples with various authentication methods and rich responses:

Dynamic Client Registration: Notion MCP
External auth provider: GitHub MCP
No auth: Bolt app running an MCP server with a dice roll tool
Slack identity: Bolt app running an MCP server requiring OAuth to show profiles
MCP Apps: Bolt app running an MCP server with a dice roll tool and interactive UI

Architecture

All code examples use Starlette to compose Bolt (via SlackRequestHandler) and MCP (via FastMCP.streamable_http_app()) in a single ASGI process. A SlackSignatureMiddleware verifies request signatures before forwarding to the MCP handler.

Authentication methods (no-auth, slack-identity, DCR, external auth) demonstrate auth alone and respond with plain text. Rich responses (rich-responses/mcp-apps) demonstrate returning an interactive UI.

Preview

📚 https://github.com/slack-samples/bolt-python-examples/tree/feat/mcp-client-examples

Reviewers

Please don't fear the LOC added! Testing steps might review separate steps for focused benefits. I recommend:

Example use cases: Are these meaningful?
Implementations: Do these make sense to understand?
Tests: Should we recommend these patterns?
Documentation: README and comments

Please feel free to follow setup steps included - latest manual tests are confirmed to work! 🔏 ✨

ruff, mypy, and pytest pass for all code examples.

Notes

Docs are kept minimal with hopes that docs.slack.dev references the example with detail!

Requirements

I have ensured the changes I am contributing align with existing patterns and have tested and linted my code
I've read and agree to the Code of Conduct

Add manifests, READMEs, requirements, and static files for all four MCP client examples (no-auth, slack-identity, DCR, external-auth). Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Force-add .env.example files that are excluded by the .env* gitignore pattern to provide template environment configuration. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Fix body-consuming bug in SlackSignatureMiddleware that prevented the downstream MCP handler from reading the request body. Add replay_receive to make the body available after signature verification. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

- Add 4 integration tests for profile card MCP server - Add mcp:connect to OAuth scopes to match manifest - Add MCP examples to CI test matrix with fail-fast: false - Add dependabot entries for both MCP example directories - Update root README with AI/MCP examples section - Make mypy conditional in CI (only if installed) Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

- Add mypy>=2.1.0 to both MCP example requirements - Use ToolAnnotations object instead of dict literal - Handle None case for model_extra in slack-identity - Remove conditional mypy in CI (all examples have it now) Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

- Use Route instead of Mount to serve /mcp directly (eliminates 307 redirect that Slack's MCP client does not follow on POST) - Add _meta.ui.csp with esm.sh domains to dice resource (unblocks script loading in sandboxed iframe) - Document --host-header=rewrite for ngrok (satisfies DNS-rebinding protection allowlist) - Reorder app.py sections to mirror JS examples (MCP first, Bolt second) - Clean up test files (inline MCP_PATH, move helpers to bottom) Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

- Add docstrings mirroring JS examples, remove section comments - Inline bolt_handler, rename tests to match JS equivalents - Replace httpx with httpx2, sort requirements alphabetically - Use os.environ[] instead of fallback empty string for signing secret Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

zimeg · 2026-06-17T22:34:40Z

🏁 Making note here before significant refactors follow! At this point we have stable examples.

Reorganize the Slackbot MCP client examples so authentication methods and rich responses are separate concerns: - Add rich-responses/mcp-apps (dice roller with interactive UI, no_auth) - Strip the interactive UI from no-auth so it demonstrates auth only - Strip Block Kit from slack-identity so it demonstrates auth only - Split the section README into "Authentication methods" and "Rich responses", and point docs links at page anchors - Fix .gitignore ordering so .env.example is no longer ignored - Add rich-responses/mcp-apps to the CI matrix and dependabot Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

Order the dependabot pip directories alphabetically to match the CI test matrix, and keep the not-installed message on a single line. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

zimeg · 2026-06-18T06:49:03Z

🏁 Will merge to mirror slack-samples/bolt-js-examples#83!

zimeg

📣 Thoughts from earlier! We'll delete the branch once confident in adjacent references 🌚

zimeg · 2026-06-16T23:59:06Z

+@contextlib.asynccontextmanager
+async def lifespan(a):
+    async with mcp_server.session_manager.run():
+        yield
+
+
+mcp_app = mcp_server.streamable_http_app()


🦠 ramble: Implementation concern but this is kept closer toward app start instead of the existing MCP setup for sake of mirroring the JS pattern:

https://github.com/slack-samples/bolt-js-examples/blob/5b7f42976822412b397c7085d9b565f84687f160/ai/slackbot-mcp-client/no-auth/src/app.js

zimeg · 2026-06-17T00:05:34Z

+## Setup
+
+```sh
+$ ngrok http 3000 --host-header=rewrite  # Update manifest with new URL


👾 note: This is a requirement to broken app configurations due to unexpected host validation. We prefer to claim proxied requests are from localhost.

zimeg · 2026-06-17T05:10:34Z

+        state_store=FileOAuthStateStore(
+            expiration_seconds=600,
+            base_dir="./states",
+        ),


🔭 note: We don't have an equivalent ClearStateStore so use the file state store in this example.

zimeg · 2026-06-18T06:35:49Z

🎲 note: Interactive UI is moved to rich-responses/mcp-apps for a more focused example!

zimeg and others added 14 commits June 15, 2026 23:11

feat: scaffold ai/slackbot-mcp-client directory structure

ca4a3cf

Add manifests, READMEs, requirements, and static files for all four MCP client examples (no-auth, slack-identity, DCR, external-auth). Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

feat: track .env.example files for MCP client examples

9ca5919

Force-add .env.example files that are excluded by the .env* gitignore pattern to provide template environment configuration. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

feat(no-auth): implement Bolt + MCP dice game server

1974f67

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

feat(slack-identity): implement Bolt + MCP profile card server

f5f3e28

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

fix: correct DCR link in root README to match directory name

d45246f

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

fix: match root README format to JS examples repo

e3d33cd

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

ci: sort showcase examples alphabetically

4e61225

refactor: polish to mirror adjacent example

bebe344

style: add missing blank line before class definition

a26e658

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

zimeg self-assigned this Jun 16, 2026

zimeg added the enhancement New feature or request label Jun 16, 2026

zimeg and others added 12 commits June 16, 2026 14:44

fix: correct MCP SDK quickstart link in docstrings

a6cac92

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

style: remove docstrings and section comments from tests

6c45bf5

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

fix: pin exact dependency versions to match repo convention

f237146

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

test: mirror JS test request IDs and resource assertions

c5a97ae

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

test: match JS Accept header in signed requests

3e3eb76

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

refactor: mirror JS sign_request return shape in tests

e7e1448

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

docs: clarify ngrok and manifest setup comments

e73d797

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

test: match JS auth.test mock response

c1a0e3d

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

test: align slack-identity mock data and assertions with JS

2a944f1

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

refactor: simplify slack-identity app and align storage dirs with JS

4832f25

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

style: keep missing-context message on a single line

2b14b57

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

refactor: expect missing auth with inline request handler

5cb4071

zimeg changed the title ~~feat: add MCP client examples (no-auth, slack-identity, DCR, external-auth)~~ feat: add slackbot mcp client examples with various authentication techniques Jun 17, 2026

zimeg marked this pull request as ready for review June 18, 2026 06:33

zimeg requested a review from a team as a code owner June 18, 2026 06:33

chore: alphabetize dependabot entries and inline install message

00794e8

Order the dependabot pip directories alphabetically to match the CI test matrix, and keep the not-installed message on a single line. Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

zimeg merged commit 65a62f9 into main Jun 18, 2026
7 checks passed

zimeg deleted the feat/mcp-client-examples branch June 18, 2026 06:49

zimeg restored the feat/mcp-client-examples branch June 18, 2026 06:49

zimeg commented Jun 18, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add slackbot mcp client examples with various authentication techniques#66

feat: add slackbot mcp client examples with various authentication techniques#66
zimeg merged 28 commits into
mainfrom
feat/mcp-client-examples

zimeg commented Jun 16, 2026 •

edited

Loading

Uh oh!

zimeg commented Jun 17, 2026

Uh oh!

zimeg commented Jun 18, 2026

Uh oh!

Uh oh!

zimeg left a comment

Uh oh!

zimeg Jun 16, 2026

Uh oh!

zimeg Jun 17, 2026

Uh oh!

zimeg Jun 17, 2026

Uh oh!

zimeg Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

zimeg commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Architecture

Preview

Reviewers

Notes

Requirements

Uh oh!

zimeg commented Jun 17, 2026

Uh oh!

zimeg commented Jun 18, 2026

Uh oh!

Uh oh!

zimeg left a comment

Choose a reason for hiding this comment

Uh oh!

zimeg Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

zimeg Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

zimeg Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

zimeg Jun 18, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

zimeg commented Jun 16, 2026 •

edited

Loading