Slack Enterprise Grid auth rejected: "commands" scope requested but not approvable/configurable in Claude connector settings

[tamagodo-fu]

MCP server URL or name
https://mcp.slack.com/mcp (Slack)

How are you connecting to this server?
From browsing the MCP server directory

Where does the issue occur?
In the authorization screen (after selecting the Slack workspace and clicking "Authorize" on Slack's side)

When did you last reproduce this?
2026-06-13 20:00 JST

Browser and OS
Google Chrome on macOS

Describe the issue
Authorizing a Slack Enterprise Grid workspace to Claude.ai through the Slack MCP connector fails at Slack's authorization step.

Observed (confirmed):

• After selecting the workspace and clicking "Authorize," Slack rejects the request with an error message that names the commands scope.
• commands is a real Slack scope (slash-command permission), but it does not appear as an item that can be approved or configured anywhere in the Claude connector settings screen, so there is no way to grant it from the Claude side.

Possible cause (unconfirmed — speculation, not verified):

• It is unclear why the Claude.ai Slack connector requests, or causes Slack to require, the commands scope.

Error details

An unauthorized permission was requested: commands

Expected behavior
The Slack Enterprise Grid authorization should complete. Either the connector should not request the commands scope, or the Claude connector settings should surface commands as an approvable/configurable item so the Enterprise Grid authorization can be satisfied.

Additional context

• Slack Enterprise Grid (long-standing; not a recent migration to Grid).
• Claude app ID: A08SF47R6P4
• During the same connection flow, the following error was also observed (possibly a missing required OAuth state parameter):

{"type":"error","error":{"type":"invalid_request_error","message":"state: Field required"},"request_id":"req_011Cc1GM3ZYnu77w2hJuXdJ2"}

[tamagodo-fu]

Additional evidence: The Claude app's declared scopes (App Management → permissions page for app A08SF47R6P4) do not include commands anywhere — only scopes like chat:write, search:read.*, channels:history, channels:read, users:read, etc. So commands is not a scope the app is configured to use.

The OAuth authorize request nonetheless appears to send a commands scope that is absent from the app manifest, which is why Slack rejects it as an unauthorized permission ("An unauthorized permission was requested: commands").

Implication: this cannot be resolved by org-level or workspace-level app approval — you can't approve a scope the app doesn't declare. It looks like a connector-side bug where the authorize request includes a scope outside the app's registered scope set. The fix would be on the Claude connector side: stop requesting commands (or register it in the app manifest if it is actually required).

[tamagodo-fu]

Update — primary-source evidence points to the Slack side, not a scope the client requests.

Per Slack's own docs, the Slack MCP server (mcp.slack.com) is built and operated by Slack, and Slack defines the required OAuth scopes ("MCP clients must be backed by a registered Slack app with a fixed app ID"). commands is not in Slack's documented scope list.

I also captured the live user-token authorize URL that claude.ai generates:

https://slack.com/oauth/v2_user/authorize?...&scope=search:read.public search:read.private search:read.mpim search:read.im search:read.files search:read.users chat:write channels:history groups:history mpim:history im:history canvases:read canvases:write users:read users:read.email reactions:write reactions:read emoji:read files:read channels:write groups:write im:write mpim:write channels:read groups:read mpim:read&resource=https://mcp.slack.com/&redirect_uri=https://claude.ai/api/mcp/auth_callback

— commands is not requested here either.

So commands is absent from (a) Slack's documented MCP scope list, (b) the app's declared scopes (App Management permissions page for app A08SF47R6P4), and (c) the live user-token authorize request. The "An unauthorized permission was requested: commands" rejection therefore appears to originate on the Slack Enterprise Grid side during authorization, rather than from a scope the Claude client requests. (The app declares assistant:write; Slack's Grid validation for assistant/agent apps may expect a commands scope the app doesn't declare.)

Since the MCP server and its scope definitions are Slack's, this likely needs Slack's attention or Anthropic↔Slack coordination rather than a fix purely on the Claude connector side. Remaining unknown: the bot-token authorize leg (not yet captured).

[tamagodo-fu]

Filed on the Slack side as well, since the MCP server and scope definitions are Slack's: slackapi/slack-skills-plugin#49.

[tamagodo-fu]

Update: resolved on our end. After waiting some time and retrying the Slack connection later, the authorization completed successfully without the commands rejection — most likely an Enterprise Grid app-approval propagation delay (and/or an org-side policy update on our side). Closing as resolved; will reopen if it recurs. Thanks!