imbi-slackbot
A Slack bot for the Imbi DevOps service management platform. It behaves like the Imbi assistant — giving Claude live access to Imbi data and actions through tools — but speaks Slack and acts as the Slack user who asked, so every answer and action respects that user's Imbi permissions.
How It Works
The bot connects to Slack over Socket Mode (an outbound websocket, so no public ingress is required). When a user mentions the bot or DMs it, the bot:
- Resolves the Slack user to an Imbi user. It looks up the Slack user's
email (
users.info), finds the matching active ImbiUserin the graph, and mints a short-lived per-user JWT access token signed with the sharedIMBI_AUTH_JWT_SECRET— exactly the token the Imbi API issues at login. The resolution is cached with a TTL. Users with no matching Imbi account get a friendly explanation instead. - Reconstructs the thread context from Slack (
conversations.replies) so follow-up questions in a thread keep their history. Nothing is persisted server-side; the Slack thread is the conversation. - Runs Claude with the Imbi toolset. Tools are built at startup from the
Imbi API's
openapi.jsonvia an in-process FastMCP server, using the sharedimbi_common.mcpexclusion policy (auth/MFA/status/thumbnail and anyx-imbi-ai-tool: falseoperations are filtered out). The user's minted token is forwarded on every tool call, so the API enforces their permissions. - Replies in-thread with Claude's answer.
A tiny FastAPI app exposes /status (port 8004) for health checks; the Socket
Mode connection runs as a background task alongside it.
Configuration
| Environment variable | Purpose |
|---|---|
SLACK_BOT_TOKEN |
Slack bot token (xoxb-…) |
SLACK_APP_TOKEN |
Slack app-level token for Socket Mode (xapp-…) |
ANTHROPIC_API_KEY |
Anthropic API key (enables the bot when set) |
IMBI_AUTH_JWT_SECRET |
Shared HS256 secret used to mint per-user tokens |
IMBI_INTERNAL_API_URL |
In-cluster base URL of the Imbi API |
IMBI_UI_URL |
Public base URL of the Imbi UI, used to build deep links |
IMBI_INTERNAL_UI_URL |
In-cluster UI address for fetching llms.txt (e.g. the Caddy frontend); falls back to IMBI_UI_URL |
POSTGRES_URL |
Imbi graph (Apache AGE) connection URL |
IMBI_SLACKBOT_MODEL |
Claude model (default claude-sonnet-4-6) |
See src/imbi_slackbot/settings.py for the full set.
Development
moon run root:setup # install deps + pre-commit hooks
moon run slackbot:test # run the test suite with coverage
moon run slackbot:lint slackbot:typecheck slackbot:format # ruff + basedpyright + format check
uv run --env-file .env.test imbi-slackbot serve # run the bot
Releasing
[project].version in pyproject.toml is the single source of truth (the git
tag does not set it). To cut a release:
- Bump the version and re-lock in one step:
uv version <new-version>(updatespyproject.tomlanduv.lock). If a shared-library pin changed (e.g.imbi-common==<version>), update it first so the re-lock picks it up. - Commit, open a PR, and merge to
mainonce CI is green. - Create a GitHub release whose tag is
v<version>matching the bumped version. Publishing the release runs.github/workflows/publish.yml, which verifies the tag matches the package version before building and uploading to PyPI — so an un-bumped release fails fast instead of trying to re-publish an existing filename (which PyPI rejects with a 400).
Release files for imbi-slackbot 2.29.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| imbi_slackbot-2.29.1.tar.gz | 41.3 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| imbi_slackbot-2.29.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 77.2 kB
Release files / imbi_slackbot-2.29.1.tar.gz
| Download URL | imbi_slackbot-2.29.1.tar.gz |
|---|---|
| Size | 41.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
34d37e52c68bcc1cc00600a0936e17622154e12e82f696d4a0abe0ca99376811
|
|
BLAKE2b-256 checksum How to use checksums |
05241e9b8d0049adcafdc959924ecfeee31c6c8193d8eeece8367368f917809a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 22, 2026.
Transparency logRelease files / imbi_slackbot-2.29.1-py3-none-any.whl
| Download URL | imbi_slackbot-2.29.1-py3-none-any.whl |
|---|---|
| Size | 35.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
475168b5da426a4b8d05e0748284ab73df70a1698367af02f68be6e1117843aa
|
|
BLAKE2b-256 checksum How to use checksums |
8c7043c29d850437be855420184bf45a787497cb530435276aaf8df505018ab5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 22, 2026.
Transparency log
