Slack holds most organisations' entire informal record, and a public client — one where the credential lives on the user's machine — would make that reachable by anything the user installs. Requiring a registered app with a secret puts the connection under the workspace's existing app approval process, where an admin can see it and revoke it. That is why you cannot just paste this URL into a client, and why you should be suspicious of anything claiming you can. Per-tool scopes are the second half: read without write is expressible here.
Slack's official endpoint, spoken over streamable HTTP. It is not something an individual points a client at: the connection is made by a registered Slack app.
- Search — messages, files, users, channels and emoji
- Messages — send, draft, read history, work in threads, create conversations, add reactions
- Canvas — create, update and read
- User management — profiles and channel membership
- A confidential OAuth client, meaning a Slack app with a client ID and secret — directory-published or internal only
- Scopes are per tool, so an app can hold search access without the ability to post
- As an end user you connect through a partner app; your workspace admin approves it like any other Slack app
Paste a URL, then authorize — add the endpoint to your client, then approve the OAuth consent screen