{
  "version": 1,
  "scanner": "letsauth-scanner/0.4.0",
  "generatedAt": "2026-10-19T21:16:21.982Z",
  "recorded": true,
  "target": {
    "url": "https://mcp.slack.com/mcp",
    "server": "slack"
  },
  "revision": {
    "spec": "mcp-authorization",
    "revision": "2026-07-28"
  },
  "method": "passive-scan",
  "requests": [],
  "discovered": null,
  "checks": [
    {
      "feature": "mcp.prm",
      "name": "Protected Resource Metadata served",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; resource: https://mcp.slack.com",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.authorization-servers",
      "name": "PRM lists an authorization server",
      "party": "mcp-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Location",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; authorization_servers: [https://mcp.slack.com]",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.scopes-supported",
      "name": "PRM lists scopes_supported",
      "party": "mcp-server",
      "level": "MAY",
      "section": "Authorization › Scope Selection Strategy",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported: [canvases:read, canvases:write, channels:history, channels:read, channels:write, chat:write, emoji:read, files:read, files:write, groups:history, groups:read, groups:write, im:history, im:read, im:write, lists:…",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.well-known",
      "name": "PRM reachable at a well-known URI",
      "party": "mcp-server",
      "level": "MUST",
      "levelNote": "One of two discovery mechanisms the server must offer.",
      "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; found at the root location",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.www-authenticate",
      "name": "resource_metadata in the 401 challenge",
      "party": "mcp-server",
      "level": "MUST",
      "levelNote": "One of two discovery mechanisms the server must offer.",
      "section": "Authorization Server Discovery › Protected Resource Metadata Discovery Requirements",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/mcp — HTTP 401; WWW-Authenticate resource_metadata: https://mcp.slack.com/.well-known/oauth-protected-resource",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.rs.scope-challenge",
      "name": "Scope in the WWW-Authenticate challenge",
      "party": "mcp-server",
      "level": "SHOULD",
      "section": "Authorization › Scope Selection Strategy",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://mcp.slack.com/mcp — HTTP 401; WWW-Authenticate: Bearer resource_metadata=\"https://mcp.slack.com/.well-known/oauth-protected-resource\", no scope parameter",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.prm.no-offline-access",
      "name": "No offline_access in advertised scopes",
      "party": "mcp-server",
      "level": "SHOULD",
      "section": "Authorization › Refresh Tokens",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-protected-resource — HTTP 200; scopes_supported without offline_access: [canvases:read, canvases:write, channels:history, channels:read, channels:write, chat:write, emoji:read, files:read, files:write, groups:history, groups:read, groups:write, im:history, im…",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.issuer-match",
      "name": "Metadata issuer matches the discovery URL",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.slack.com equals the issuer the PRM named",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.metadata",
      "name": "Authorization server metadata discoverable",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Authorization Server Discovery › Authorization Server Metadata Discovery",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; issuer: https://mcp.slack.com",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.cimd",
      "name": "Client ID Metadata Documents supported",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Client Registration › Client ID Metadata Documents",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; client_id_metadata_document_supported: absent",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.dcr",
      "name": "Dynamic Client Registration offered",
      "party": "authorization-server",
      "level": "MAY",
      "levelNote": "Deprecated; retained for compatibility with clients that cannot use Client ID Metadata Documents.",
      "section": "Client Registration › Dynamic Client Registration",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; registration_endpoint: absent",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.iss-param",
      "name": "Issuer identifier in authorization responses",
      "party": "authorization-server",
      "level": "SHOULD",
      "section": "Authorization › Authorization Response Validation",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "unsupported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; authorization_response_iss_parameter_supported: absent",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.pkce-s256",
      "name": "PKCE with S256 advertised",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Authorization Code Protection",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; code_challenge_methods_supported: [S256]",
      "observedAt": "2026-10-17T01:18:47Z"
    },
    {
      "feature": "mcp.as.https",
      "name": "All endpoints served over HTTPS",
      "party": "authorization-server",
      "level": "MUST",
      "section": "Security Considerations › Communication Security",
      "citation": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization",
      "status": "supported",
      "evidence": "https://mcp.slack.com/.well-known/oauth-authorization-server — HTTP 200; all 2 endpoints use https",
      "observedAt": "2026-10-17T01:18:47Z"
    }
  ],
  "grade": {
    "letter": "C",
    "label": "C",
    "reasons": [
      "SHOULD-level check unsupported: Scope in the WWW-Authenticate challenge",
      "SHOULD-level check unsupported: Client ID Metadata Documents supported",
      "SHOULD-level check unsupported: Issuer identifier in authorization responses"
    ]
  },
  "observations": []
}