{ "version": 1, "generatedAt": "2026-10-14T13:29:39.386Z", "license": "CC BY 4.0", "source": "https://letsauth.eu/atlas/mcp/servers/slack/", "spec": { "id": "mcp-authorization", "name": "MCP Authorization", "currentRevision": "2026-07-28", "revisions": [ { "id": "2025-11-25", "date": "2025-11-25", "status": "superseded", "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization", "changes": "Makes OAuth Client ID Metadata Documents the recommended client registration method and adds Enterprise-Managed Authorization (ID-JAG) as an extension.\n" }, { "id": "2026-07-28", "date": "2026-07-28", "status": "current", "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization", "supersedes": "2025-11-25", "changes": "Deprecates Dynamic Client Registration in favour of Client ID Metadata Documents, requires RFC 9207 issuer validation on authorization responses, keys stored client credentials by issuer, requires application_type on DCR requests, and removes session identifiers from the transport. Splits the authorization text into separate pages for discovery, client registration and security considerations.\n" } ] }, "server": { "id": "slack", "name": "Slack", "url": "https://mcp.slack.com/mcp", "homepage": "https://slack.com", "transport": "streamable-http", "listed": "public-directory", "source": "https://github.com/jaw9c/awesome-remote-mcp-servers", "authClaimed": "oauth2.1-no-dcr" }, "features": [ { "id": "mcp.as.cimd", "name": "Client ID Metadata Documents supported", "description": "The authorization server accepts an HTTPS URL as client_id and fetches the client's metadata document, advertising client_id_metadata_document_supported: true.\n", "category": "registration", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Client ID Metadata Documents", "level": "SHOULD", "levelNote": "Became the recommended registration method in this revision." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Client Registration › Client ID Metadata Documents", "level": "SHOULD" } ] }, { "id": "mcp.as.dcr", "name": "Dynamic Client Registration offered", "description": "The authorization server exposes a registration_endpoint (RFC 7591) so clients can register themselves at runtime.\n", "category": "registration", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Dynamic Client Registration", "level": "SHOULD" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Client Registration › Dynamic Client Registration", "level": "MAY", "levelNote": "Deprecated; retained for compatibility with clients that cannot use Client ID Metadata Documents." } ] }, { "id": "mcp.as.https", "name": "All endpoints served over HTTPS", "description": "Every authorization server endpoint listed in its metadata uses HTTPS.\n", "category": "transport", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Communication Security", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Communication Security", "level": "MUST" } ] }, { "id": "mcp.as.iss-param", "name": "Issuer identifier in authorization responses", "description": "The authorization server returns the iss parameter on authorization responses (RFC 9207) and advertises authorization_response_iss_parameter_supported: true.\n", "category": "authorization", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Authorization Response Validation", "level": "SHOULD" } ] }, { "id": "mcp.as.issuer-match", "name": "Metadata issuer matches the discovery URL", "description": "The issuer value inside the metadata document equals the issuer identifier used to construct the well-known URL, so clients can detect a substituted document.\n", "category": "discovery", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Authorization Server Metadata Discovery", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Authorization Server Metadata Discovery", "level": "MUST" } ] }, { "id": "mcp.as.metadata", "name": "Authorization server metadata discoverable", "description": "The authorization server publishes metadata via OAuth 2.0 Authorization Server Metadata (RFC 8414) or OpenID Connect Discovery.\n", "category": "discovery", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Authorization Server Metadata Discovery", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Authorization Server Metadata Discovery", "level": "MUST" } ] }, { "id": "mcp.as.pkce-s256", "name": "PKCE with S256 advertised", "description": "The metadata lists code_challenge_methods_supported including S256, which MCP clients require before they will start an authorization flow.\n", "category": "authorization", "party": "authorization-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Authorization Code Protection", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Authorization Code Protection", "level": "MUST" } ] }, { "id": "mcp.as.preregistration", "name": "Documented pre-registration path", "description": "The provider documents how a client developer obtains pre-registered client credentials when neither CIMD nor DCR is available.\n", "category": "registration", "party": "authorization-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Dynamic Client Registration", "level": "SHOULD", "levelNote": "Pre-registration was the fallback when DCR was unavailable." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Client Registration › Pre-registration", "level": "SHOULD", "levelNote": "Required as a fallback for clients that cannot register dynamically." } ] }, { "id": "mcp.as.refresh-rotation", "name": "Refresh token rotation for public clients", "description": "Refresh tokens issued to public clients are rotated or sender-constrained as OAuth 2.1 requires.\n", "category": "token", "party": "authorization-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Token Theft", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Token Theft", "level": "MUST" } ] }, { "id": "mcp.as.resource-indicator", "name": "Resource indicators honoured", "description": "The authorization server accepts the RFC 8707 resource parameter and binds the audience of issued tokens to the requested MCP server.\n", "category": "token", "party": "authorization-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Token Audience Binding and Validation", "level": "MUST", "levelNote": "Required for the audience binding that the MCP server must enforce." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Token Audience Binding and Validation", "level": "MUST", "levelNote": "Required for the audience binding that the MCP server must enforce." } ] }, { "id": "mcp.prm.authorization-servers", "name": "PRM lists an authorization server", "description": "The authorization_servers field of the PRM document names at least one authorization server issuer.\n", "category": "discovery", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Authorization Server Location", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Authorization Server Location", "level": "MUST" } ] }, { "id": "mcp.prm.no-offline-access", "name": "No offline_access in advertised scopes", "description": "The server does not advertise or request the offline_access scope; refresh-token issuance is left to the authorization server's own policy.\n", "category": "token", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Refresh Tokens", "level": "SHOULD" } ] }, { "id": "mcp.prm.scopes-supported", "name": "PRM lists scopes_supported", "description": "The PRM document advertises the scopes the server understands, so a client can choose an initial scope set before the first request.\n", "category": "discovery", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Flow › Scope Selection Strategy", "level": "MAY" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Scope Selection Strategy", "level": "MAY" } ] }, { "id": "mcp.prm.well-known", "name": "PRM reachable at a well-known URI", "description": "The metadata document is served at the path-aware or root well-known location derived from the MCP server URL, so a client can find it without a prior 401.\n", "category": "discovery", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements", "level": "MUST", "levelNote": "One of two discovery mechanisms the server must offer." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements", "level": "MUST", "levelNote": "One of two discovery mechanisms the server must offer." } ] }, { "id": "mcp.prm.www-authenticate", "name": "resource_metadata in the 401 challenge", "description": "An unauthenticated request receives a 401 whose WWW-Authenticate header carries a resource_metadata parameter pointing at the PRM document.\n", "category": "discovery", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements", "level": "MUST", "levelNote": "One of two discovery mechanisms the server must offer." }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements", "level": "MUST", "levelNote": "One of two discovery mechanisms the server must offer." } ] }, { "id": "mcp.prm", "name": "Protected Resource Metadata served", "description": "The MCP server publishes an OAuth 2.0 Protected Resource Metadata document (RFC 9728) that tells clients which authorization servers protect it.\n", "category": "discovery", "party": "mcp-server", "observable": "passive", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Server Discovery › Authorization Server Location", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization Server Discovery › Authorization Server Location", "level": "MUST" } ] }, { "id": "mcp.proxy.consent", "name": "Per-client consent on proxy servers", "description": "An MCP server that acts as a proxy with a static upstream client id obtains the user's consent for each dynamically registered client before forwarding.\n", "category": "consent", "party": "mcp-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Confused Deputy Problem", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Confused Deputy Problem", "level": "MUST" } ] }, { "id": "mcp.rs.401-on-invalid", "name": "401 for missing or invalid tokens", "description": "Requests without a token, or with an invalid or expired one, receive HTTP 401 Unauthorized.\n", "category": "token", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Access Token Usage › Token Handling", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Token Handling", "level": "MUST" } ] }, { "id": "mcp.rs.audience-validation", "name": "Audience validation", "description": "The MCP server rejects tokens that were not issued for it, so a token obtained for another resource cannot be replayed against this server.\n", "category": "token", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Access Token Privilege Restriction", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Access Token Privilege Restriction", "level": "MUST" } ] }, { "id": "mcp.rs.bearer-header", "name": "Bearer token only in the Authorization header", "description": "The MCP server accepts access tokens only in the Authorization: Bearer header and rejects tokens passed in the query string.\n", "category": "token", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Access Token Usage › Token Requirements", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Access Token Usage", "level": "MUST" } ] }, { "id": "mcp.rs.insufficient-scope", "name": "403 insufficient_scope for step-up", "description": "When a valid token lacks a required scope the server answers 403 with error=\"insufficient_scope\" and the scopes needed, enabling step-up authorization.\n", "category": "authorization", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Flow › Scope Challenge Handling", "level": "SHOULD" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Scope Challenge Handling", "level": "SHOULD" } ] }, { "id": "mcp.rs.no-passthrough", "name": "No token passthrough to upstream APIs", "description": "The MCP server never forwards the client's access token to upstream APIs; it obtains its own credentials for downstream calls.\n", "category": "delegation", "party": "mcp-server", "observable": "manual", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Security Considerations › Access Token Privilege Restriction", "level": "MUST" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Security Considerations › Access Token Privilege Restriction", "level": "MUST" } ] }, { "id": "mcp.rs.scope-challenge", "name": "Scope in the WWW-Authenticate challenge", "description": "The 401 challenge includes a scope parameter naming the scopes a client should request.\n", "category": "authorization", "party": "mcp-server", "observable": "active", "revisions": [ { "spec": "mcp-authorization", "revision": "2025-11-25", "section": "Authorization Flow › Scope Selection Strategy", "level": "SHOULD" }, { "spec": "mcp-authorization", "revision": "2026-07-28", "section": "Authorization › Scope Selection Strategy", "level": "SHOULD" } ] } ], "cells": [ { "server": "slack", "feature": "mcp.as.issuer-match", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.metadata", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.prm", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.prm.authorization-servers", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.prm.scopes-supported", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.prm.well-known", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.prm.www-authenticate", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.cimd", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.dcr", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.preregistration", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.pkce-s256", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.insufficient-scope", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.scope-challenge", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.refresh-rotation", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.resource-indicator", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.401-on-invalid", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.audience-validation", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.bearer-header", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.https", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.no-passthrough", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.proxy.consent", "revision": "2025-11-25", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.issuer-match", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.metadata", "revision": "2026-07-28", "status": "supported", "derived": false }, { "server": "slack", "feature": "mcp.prm", "revision": "2026-07-28", "status": "supported", "derived": false }, { "server": "slack", "feature": "mcp.prm.authorization-servers", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.prm.scopes-supported", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.prm.well-known", "revision": "2026-07-28", "status": "supported", "derived": false }, { "server": "slack", "feature": "mcp.prm.www-authenticate", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.cimd", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.dcr", "revision": "2026-07-28", "status": "unsupported", "derived": false }, { "server": "slack", "feature": "mcp.as.preregistration", "revision": "2026-07-28", "status": "supported", "derived": false }, { "server": "slack", "feature": "mcp.as.iss-param", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.pkce-s256", "revision": "2026-07-28", "status": "supported", "derived": false }, { "server": "slack", "feature": "mcp.rs.insufficient-scope", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.scope-challenge", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.refresh-rotation", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.resource-indicator", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.prm.no-offline-access", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.401-on-invalid", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.audience-validation", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.bearer-header", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.as.https", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.rs.no-passthrough", "revision": "2026-07-28", "status": "unknown", "derived": true }, { "server": "slack", "feature": "mcp.proxy.consent", "revision": "2026-07-28", "status": "unknown", "derived": true } ], "observations": [ { "server": "slack", "feature": "mcp.as.dcr", "revision": "2026-07-28", "status": "unsupported", "method": "vendor-claim", "observedAt": "2026-10-13T00:00:00Z", "observedBy": "jbspeakr", "evidence": "https://github.com/jaw9c/awesome-remote-mcp-servers lists the server as OAuth 2.1 without Dynamic Client Registration (lock marker)." }, { "server": "slack", "feature": "mcp.as.dcr", "revision": "2026-07-28", "status": "unsupported", "method": "vendor-claim", "observedAt": "2026-10-14T00:00:00Z", "observedBy": "jbspeakr (documentation pass with Claude Code)", "evidence": "https://docs.slack.dev/ai/slack-mcp-server/ — \"We do not support SSE-based connections or Dynamic Client Registration at this time.\"" }, { "server": "slack", "feature": "mcp.as.preregistration", "revision": "2026-07-28", "status": "supported", "method": "vendor-claim", "observedAt": "2026-10-14T00:00:00Z", "observedBy": "jbspeakr (documentation pass with Claude Code)", "evidence": "https://docs.slack.dev/ai/slack-mcp-server/ — \"MCP clients must be backed by a registered Slack app with a fixed app ID and hardcode that app ID. Slack supports confidential OAuth for MCP clients. You'll need to use your app's `client_id` and `client_secret` for Slack OAuth.\" (Only directory-published (Slack Marketplace) or internal apps may use MCP; unlisted apps are prohibited.)" }, { "server": "slack", "feature": "mcp.as.metadata", "revision": "2026-07-28", "status": "supported", "method": "vendor-claim", "observedAt": "2026-10-14T00:00:00Z", "observedBy": "jbspeakr (documentation pass with Claude Code)", "evidence": "https://docs.slack.dev/ai/slack-mcp-server/ — \"If your MCP client supports OAuth 2.0 Authorization Server Metadata (RFC 8414) per MCP spec, you can rely on that.\" (Page lists the metadata URL https://mcp.slack.com/.well-known/oauth-authorization-server.)" }, { "server": "slack", "feature": "mcp.prm", "revision": "2026-07-28", "status": "supported", "method": "vendor-claim", "observedAt": "2026-10-14T00:00:00Z", "observedBy": "jbspeakr (documentation pass with Claude Code)", "evidence": "https://docs.slack.dev/ai/slack-mcp-server/ — \"https://mcp.slack.com/.well-known/oauth-protected-resource\" (The page lists this URL as the protected resource metadata document for the server.)" }, { "server": "slack", "feature": "mcp.prm.well-known", "revision": "2026-07-28", "status": "supported", "method": "vendor-claim", "observedAt": "2026-10-14T00:00:00Z", "observedBy": "jbspeakr (documentation pass with Claude Code)", "evidence": "https://docs.slack.dev/ai/slack-mcp-server/ — \"https://mcp.slack.com/.well-known/oauth-protected-resource\" (Documented at the root well-known location of the MCP host (server URL is https://mcp.slack.com/mcp).)" }, { "server": "slack", "feature": "mcp.as.pkce-s256", "revision": "2026-07-28", "status": "supported", "method": "vendor-claim", "observedAt": "2026-10-14T00:00:00Z", "observedBy": "jbspeakr (documentation pass with Claude Code)", "evidence": "https://docs.slack.dev/authentication/using-pkce — \"code_challenge_method must be set to S256, as that is the only supported hashing algorithm for now.\" (The MCP server page states 'Looking to use desktop clients? PKCE support is now available!' and links to this PKCE guide; enabling PKCE marks the Slack app as a public client.)" } ] }