letsauth

Server

Slack

Endpoint
https://mcp.slack.com/mcp
Transport
Streamable HTTP
Authentication as listed
oauth2.1-no-dcr (the source's own label, not an observation)
Why it is listed
Listed because it appears in a public directory of MCP servers. Source
Homepage
https://slack.com
  • Supported 5
  • Unsupported 1
  • Unknown 17

Contribute a correctionWithdraw this serverJSON

Status against MCP Authorization 2026-07-28 (current revision). Older revisions: 2025-11-25

MCP server features

FeatureLevelStatusObservedEvidence
Protected Resource Metadata servedmcp.prm · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "https://mcp.slack.com/.well-known/oauth-protected-resource" (The page lists this URL as the protected resource metadata document for the server.)
PRM lists an authorization servermcp.prm.authorization-servers · Discovery · Authorization Server Discovery › Authorization Server LocationMUSTUnknown (no observation)no observation yet
PRM lists scopes_supportedmcp.prm.scopes-supported · Discovery · Authorization › Scope Selection StrategyMAYUnknown (no observation)no observation yet
PRM reachable at a well-known URImcp.prm.well-known · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "https://mcp.slack.com/.well-known/oauth-protected-resource" (Documented at the root well-known location of the MCP host (server URL is https://mcp.slack.com/mcp).)
resource_metadata in the 401 challengemcp.prm.www-authenticate · Discovery · Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMUSTUnknown (no observation)no observation yet
403 insufficient_scope for step-upmcp.rs.insufficient-scope · Authorization · Authorization › Scope Challenge HandlingSHOULDUnknown (no observation)no observation yet
Scope in the WWW-Authenticate challengemcp.rs.scope-challenge · Authorization · Authorization › Scope Selection StrategySHOULDUnknown (no observation)no observation yet
No offline_access in advertised scopesmcp.prm.no-offline-access · Tokens · Authorization › Refresh TokensSHOULDUnknown (no observation)no observation yet
401 for missing or invalid tokensmcp.rs.401-on-invalid · Tokens · Authorization › Token HandlingMUSTUnknown (no observation)no observation yet
Audience validationmcp.rs.audience-validation · Tokens · Security Considerations › Access Token Privilege RestrictionMUSTUnknown (no observation)no observation yet
Bearer token only in the Authorization headermcp.rs.bearer-header · Tokens · Authorization › Access Token UsageMUSTUnknown (no observation)no observation yet
No token passthrough to upstream APIsmcp.rs.no-passthrough · Delegation · Security Considerations › Access Token Privilege RestrictionMUSTUnknown (no observation)no observation yet
Per-client consent on proxy serversmcp.proxy.consent · Consent · Security Considerations › Confused Deputy ProblemMUSTUnknown (no observation)no observation yet

Authorization server features

FeatureLevelStatusObservedEvidence
Metadata issuer matches the discovery URLmcp.as.issuer-match · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTUnknown (no observation)no observation yet
Authorization server metadata discoverablemcp.as.metadata · Discovery · Authorization Server Discovery › Authorization Server Metadata DiscoveryMUSTSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "If your MCP client supports OAuth 2.0 Authorization Server Metadata (RFC 8414) per MCP spec, you can rely on that." (Page lists the metadata URL https://mcp.slack.com/.well-known/oauth-authorization-server.)
Client ID Metadata Documents supportedmcp.as.cimd · Registration · Client Registration › Client ID Metadata DocumentsSHOULDUnknown (no observation)no observation yet
Dynamic Client Registration offeredmcp.as.dcr · Registration · Client Registration › Dynamic Client RegistrationMAYUnsupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "We do not support SSE-based connections or Dynamic Client Registration at this time."
1 earlier observation
  1. Unsupported · Vendor claim · jbspeakr · evidence
Documented pre-registration pathmcp.as.preregistration · Registration · Client Registration › Pre-registrationSHOULDSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "MCP clients must be backed by a registered Slack app with a fixed app ID and hardcode that app ID. Slack supports confidential OAuth for MCP clients. You'll need to use your app's `client_id` and `client_secret` for Slack OAuth." (Only directory-published (Slack Marketplace) or internal apps may use MCP; unlisted apps are prohibited.)
Issuer identifier in authorization responsesmcp.as.iss-param · Authorization · Authorization › Authorization Response ValidationSHOULDUnknown (no observation)no observation yet
PKCE with S256 advertisedmcp.as.pkce-s256 · Authorization · Security Considerations › Authorization Code ProtectionMUSTSupportedVendor claim · jbspeakr (documentation pass with Claude Code)source— "code_challenge_method must be set to S256, as that is the only supported hashing algorithm for now." (The MCP server page states 'Looking to use desktop clients? PKCE support is now available!' and links to this PKCE guide; enabling PKCE marks the Slack app as a public client.)
Refresh token rotation for public clientsmcp.as.refresh-rotation · Tokens · Security Considerations › Token TheftMUSTUnknown (no observation)no observation yet
Resource indicators honouredmcp.as.resource-indicator · Tokens · Security Considerations › Token Audience Binding and ValidationMUSTUnknown (no observation)no observation yet
All endpoints served over HTTPSmcp.as.https · Transport · Security Considerations › Communication SecurityMUSTUnknown (no observation)no observation yet