Exa Claude Slack

Latest Audit Result

exa-claude-slack does not use exa-js directly; it is a Slack Events API bot using Claude Agent SDK and the hosted Exa MCP server. Current direct exa-js version is null, latest npm exa-js is 2.12.1, and the allowed MCP baseline lockfile resolves exa-js 2.12.1. Default MCP coverage supports search via web_search_exa and get_contents via web_fetch_exa; advanced search types/options require enabling web_search_advanced_exa. Build passes, but npm test is missing, npm audit vulnerabilities remain, several declared capabilities are still not actually available, and the audit report was uploaded to https://kitchen-sink.exa.ai/content-host/view/exa-claude-slack-audit-199cc57b.

Missing Features (13)

• Declared endpoint `find_similar` is still not implemented by exa-claude-slack and is not available in the allowed MCP baseline tools.
• Declared endpoint `research` is still not implemented by exa-claude-slack and the Exa changelog says `/research` is sunset on May 1, 2026; it should not be added as a missing required feature, but any declared `research` capability should be removed or reframed around `/search` type `deep-reasoning` if needed.
• Declared search type `fast` is still not available through the current Slack MCP URL because it does not set `defaultSearchType=fast` and `web_search_advanced_exa` is not enabled by default.
• Declared search type `instant` is still not available because `web_search_advanced_exa` is disabled by default and not enabled in the MCP URL.
• Declared content options `summary` and `subpages` are still not available through the current Slack MCP URL because they are only exposed by `web_search_advanced_exa`, which is not enabled by default.
• Key-file drift is still present: requested `src/index.ts`, `src/slack.ts`, and `src/exa.ts` do not exist; the integration lives under `app/api/slack/events/route.ts` and `lib/*.ts`.
• Slack README/manifest claim DM support, assistant events, slash command `/exa`, interactivity, and session mapping, but the code only handles `app_mention`; `message.im`, `assistant_thread_started`, `assistant_thread_context_changed`, `/api/slack/commands`, `/api/slack/interactivity`, and Redis session-store usage are not implemented.
• DEPRECATED: The allowed MCP baseline still exposes `startCrawlDate` and `endCrawlDate` in `web_search_advanced_exa`, but the Exa changelog says these request parameters are deprecated and will be ignored/removed.
• DEPRECATED: The allowed MCP baseline response types still include `resolvedSearchType` and `highlightScores`, which the Exa changelog says are deprecated/removed response fields; exa-claude-slack itself does not parse them.
• Add or correct the npm test script; package.json still has no test script, so the requested `npm test` command fails.
• Address npm audit findings from installed dependencies; `npm ci`/`npm audit` still report 3 vulnerabilities (1 moderate, 2 high), including Next.js and transitive axios advisories.
• Enable `web_search_advanced_exa` in the MCP URL via the `tools` query parameter if fast/instant search types, summaries, subpages, domain/date filters, or other advanced search controls are expected to work.
• Implement the Slack manifest's declared slash-command and assistant/DM event routes or update the manifest/README to match the implemented app_mention-only surface.