TableTop

Inspiration

Most small teams will never spend $10,000 on a consultant-led crisis exercise. But nonprofits, schools, and early-stage startups still deal with real incidents. A donor rumor spreads online. A production deployment breaks during renewal week. A major deal starts falling apart before leadership even knows there’s a problem.

Most security training teaches people not to click suspicious links. That’s useful, but it doesn’t show you how your team will communicate, make decisions, and assign responsibility when something actually goes wrong.

I built TableTop because that response will probably happen in Slack. Teams that can’t afford a consultant should still be able to practice in the same place they already work from.

What it does

TableTop runs crisis simulations directly inside Slack. An admin configures the organization once with /tabletop setup, then starts an exercise using /tabletop run.

TableTop only reads the channels selected during setup, not the entire workspace. It uses that context to create a scenario based on what the organization is actually working on, such as an important sales deal or an upcoming deployment. The exercise is posted in a dedicated channel and clearly marked as a simulation.

The team then responds as they would during a real incident. TableTop tracks who participates, how quickly the team reacts, whether information is verified before being shared, and whether the right people are brought into the conversation. It can introduce up to two new developments as the exercise progresses.

At the end, TableTop produces a debrief with a score, what the team handled well, where the response broke down, and specific next steps. The feedback is connected to messages the team actually sent during the drill.

How I built it

I started with the Bolt JS starter agent and built the simulation engine around it.

On the Slack side, I used slash commands, setup modals, message event listeners, and Block Kit. The engine manages the full drill lifecycle: starting the exercise, observing messages, introducing escalations, and generating the final debrief. A background workspace pulse keeps the selected channel context current.

Claude handles scenario planning, reply classification, curveball generation, and debrief writing. Real-Time Search provides current workspace context when a drill begins. The Slack MCP server searches messages and identifies relevant people through the Claude Agent SDK.

A large part of the work went into prompts and guardrails. The scenario has to fit the organization, so a nonprofit shouldn’t receive a production deployment crisis. Workspace signals also need to be ranked carefully so casual conversation doesn’t become the basis of an incident. The scoring system had to recognize that actions such as drafting a holding statement or asking the CEO for approval are signs of good process, not failures.

Challenges I ran into

Making the scenarios feel believable was harder than I expected. Early versions kept falling back on the same storylines, usually viral posts or reporters asking questions. This happened most often when the selected channels didn’t contain much useful context.

I added signal ranking, drill history to prevent repeated scenarios, and density-aware planning. When the workspace is quiet, Claude now fills in reasonable details instead of forcing weak channel activity into the storyline.

Pacing was another problem. At first, curveballs would arrive while the team was still discussing the opening incident. In other cases, they wouldn’t appear at all because the conversation stayed active. I separated scheduled escalations from reactive ones and added a trigger based on periods of inactivity.

The first scoring system was also too harsh. It sometimes penalized teams for drafting responses or tagging senior leaders for approval, even though those were often the correct actions. I added role-aware mention resolution and rewrote the debrief instructions so planning, escalation, and approval are judged in context.

Accomplishments that I’m proud of

TableTop isn’t a fixed quiz with predetermined answers. The exercise changes based on the organization and how the team responds.

The scenarios can reference real workspace context. In the demo, I seeded an Acme enterprise deal in #sales, and TableTop used that deal in the opening incident.

I also connected Claude, Real-Time Search, and MCP in one application, with each system handling a clear part of the workflow.

The final debrief can cite actual messages and turn Slack mentions into useful context, such as identifying that the CEO was tagged for approval.

Most importantly, TableTop can provide much of the value of a consultant-led exercise through a single /tabletop run command.

What I learned

I learned that crisis exercises work better when they happen inside the tools a team already uses. Most people don’t want to log into another training platform and pretend it reflects how they would respond during a real incident.

I also learned how important consent and visibility are. Admins choose exactly which channels TableTop can read, every exercise is clearly labeled as a simulation, and the app never posts anything outside Slack.

LLMs also need much more direction than “make this realistic.” Good facilitation requires rules for organization type, scenario variety, evidence, pacing, and scoring.

The biggest weakness exposed during most drills wasn’t technical. It was usually a failure to verify information before responding or confusion over who owned external communication. Those are the kinds of gaps TableTop is designed to reveal.

I also came away seeing Slack differently. With agents and MCP services, it can do much more than make communication easier. It can become the place where teams run complex workflows, make decisions, and interact with intelligent systems without leaving their workspace.

What’s next for TableTop

Next, I want to add scenario templates for specific industries, score tracking across quarterly drills, and a self-serve mode that allows communications or HR teams to run exercises without engineering support.

I also plan to export debrief actions into Slack canvases or checklists so the results turn into actual follow-up work. Longer term, I want to distribute TableTop through the Slack Marketplace with multi-workspace OAuth support.

Built With

• slack-ai-capabilities-&-agent-builder
• slack-mcp-(model-context-protocol)
• slack-real-time-search-(rts)-api