Guide Slack setup through the Agents & AI Apps MCP toggle (stacked on #2617)

[benjaminshafii]

Summary

Stacked on #2617. Slack's MCP server rejects connections unless the Slack app has Features → Agents & AI Apps → Model Context Protocol toggled on (https://api.slack.com/apps/<APP_ID>/app-assistant) — users hit this as a runtime error ('app is not enabled for MCP') with no guidance from us.

• Slack OAuth app panel now uses the same numbered 'how to set it up' pattern as the Google Workspace dialog:
  1. create/use an internal or directory-published Slack app (link to api.slack.com/apps)
  2. open Agents & AI Apps and turn on Model Context Protocol — called out as required
  3. paste Client ID/secret; redirect URL comes after creation
• fraimz Frame 5 now asserts 'Agents & AI Apps' and 'Model Context Protocol' are visible before creation.

Ref: https://docs.slack.dev/ai/slack-mcp-server/developing/ ('Enable the app for MCP by navigating to the Agents & AI Apps sidebar section and toggling On the Model Context Protocol feature.')

Validation

• pnpm --filter @openwork-ee/den-web build
• node --check evals/flows/google-slack-oauth-ux.flow.mjs
• git diff --check
• OPENWORK_EVAL_DEN_PORT=8895 OPENWORK_EVAL_DEN_WEB_URL=http://127.0.0.1:3015 OPENWORK_EVAL_DEN_MYSQL_CONTAINER=openwork-web-local-mysql pnpm fraimz --flow google-slack-oauth-ux --stack den — PASSED (all 6 frames)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview, Comment	Jul 9, 2026 5:48am
openwork-den	Ready	Preview, Comment	Jul 9, 2026 5:48am
openwork-den-worker-proxy	Ready	Preview, Comment	Jul 9, 2026 5:48am
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 9, 2026 5:48am

[benjaminshafii]

fraimz — ✅ PASSED

1 passed · 0 failed · 0 skipped — run 2026-07-09T05-47-29-251Z

Full frame proof with validated screenshots: evals/results/2026-07-09T05-47-29-251Z/fraimz.html (re-run: pnpm fraimz --flow google-slack-oauth-ux)

✅ google-slack-oauth-ux — Google and Slack OAuth setup tells admins exactly what to do next

User-facing flow demo

1. The Google Workspace dialog gives admins the exact OAuth setup instructions and redirect URI

   🎙 “I open Connections and choose Google Workspace. OpenWork shows exactly how to create the Google OAuth app, including the redirect URI I need to copy, so I’m not guessing between Cloud Console tabs.”

2. The dialog includes the redirect URI, copy button, and Google Console/API instructions.

   🎙 “I open Connections and choose Google Workspace. OpenWork shows exactly how to create the Google OAuth app, including the redirect URI I need to copy, so I’m not guessing between Cloud Console tabs.”

   • 📸 google-slack-oauth-ux-01-google-workspace-oauth-setup-guide.png — 10 validations passed
   

3. A stale Google Workspace save opens the security check with a clear retry path

   🎙 “When I save Google Workspace settings and OpenWork needs a fresh security check, the dialog gives me one obvious next step: Continue with Google. After I confirm, OpenWork retries the save automatically.”

4. The security check explains why it appeared and gives a clear way to continue before retrying the save.

   🎙 “When I save Google Workspace settings and OpenWork needs a fresh security check, the dialog gives me one obvious next step: Continue with Google. After I confirm, OpenWork retries the save automatically.”

   • 📸 google-slack-oauth-ux-02-google-workspace-reauth-security-check.png — 7 validations passed
   
   • ✅ After reauth, the pending Google Workspace save retried and returned to the configured card.

5. Admins can make a permissions-only Google edit without re-entering saved credentials

   🎙 “Later I reopen Google Workspace to make a permissions-only edit. The app shows that credentials are already saved, and I can save the edit without pasting the client ID or secret again.”

6. The dialog shows saved credentials and the permissions-only save button without blank credential fields.

   🎙 “Later I reopen Google Workspace to make a permissions-only edit. The app shows that credentials are already saved, and I can save the edit without pasting the client ID or secret again.”

   • 📸 google-slack-oauth-ux-03-google-workspace-permissions-only-save.png — 10 validations passed
   

7. Google credential fields only become editable when the admin chooses Replace credentials

   🎙 “If I really need to rotate the Google credentials, I choose Replace credentials. Only then do the client ID and client secret fields become editable and required again.”

8. Replace credentials reveals the credential form and keeps saving disabled until both fields are filled.

   🎙 “If I really need to rotate the Google credentials, I choose Replace credentials. Only then do the client ID and client secret fields become editable and required again.”

   • 📸 google-slack-oauth-ux-04-google-workspace-replace-credentials.png — 9 validations passed
   

9. The Slack quick-add explains the pre-registered Slack OAuth app requirement before creation

   🎙 “I add Slack from quick add, and OpenWork explains Slack’s requirement up front: Slack MCP needs a pre-registered Slack app because Slack does not support automatic app registration.”

   • ✅ Visible text includes "Slack MCP"
   • ✅ Visible text includes "pre-registered Slack app"
   • ✅ Visible text includes "automatic app registration"
   • ✅ Visible text includes "Slack OAuth app"
   • ✅ Visible text includes "Agents & AI Apps"
   • ✅ Visible text includes "Model Context Protocol"
   • ✅ Visible text includes "Client ID"
   • ✅ Visible text includes "Client secret"

10. Slack quick-add names Slack MCP, the Slack app requirement, and the client ID/secret fields up front.

🎙 “I add Slack from quick add, and OpenWork explains Slack’s requirement up front: Slack MCP needs a pre-registered Slack app because Slack does not support automatic app registration.”

• 📸 google-slack-oauth-ux-05-slack-quick-add-preregistered-oauth-copy.png — 13 validations passed

11. Creating a Slack-style OAuth-client connection shows the exact redirect URL handoff and Copy button

🎙 “After I create the Slack connection, OpenWork shows the exact redirect URL to add to the Slack app and gives me a copy button. I know which URL to whitelist before teammates connect.”

• ✅ Visible text includes "redirect URL"
• ✅ Visible text includes "/connect/callback"
• ✅ Visible text includes "Copy"

12. After creation, OpenWork shows the exact redirect URL and a Copy button before teammates connect.

🎙 “After I create the Slack connection, OpenWork shows the exact redirect URL to add to the Slack app and gives me a copy button. I know which URL to whitelist before teammates connect.”

• 📸 google-slack-oauth-ux-06-slack-style-redirect-url-copy-handoff.png — 9 validations passed

• ✅ Script frame 1 narrated: "“I open Connections and choose Google Workspace. OpenWork shows exactly how to create th"
• ✅ Script frame 2 narrated: "“When I save Google Workspace settings and OpenWork needs a fresh security check, the di"
• ✅ Script frame 3 narrated: "“Later I reopen Google Workspace to make a permissions-only edit. The app shows that cre"
• ✅ Script frame 4 narrated: "“If I really need to rotate the Google credentials, I choose Replace credentials. Only t"
• ✅ Script frame 5 narrated: "“I add Slack from quick add, and OpenWork explains Slack’s requirement up front: Slack M"
• ✅ Script frame 6 narrated: "“After I create the Slack connection, OpenWork shows the exact redirect URL to add to th"