Slack MCP: cmd mcp add emits placeholder clientId "command-code" — Slack rejects with "Invalid client_id parameter" #1012

cmd mcp add for the Slack MCP server emits a placeholder clientId, so Slack rejects the OAuth flow before consent. The server is not just unauthenticated — it is unauthenticatable.

Environment

• Command Code 1.81.0 (latest on npm at time of writing)
• macOS 27.0.1, Cursor, sh

Steps to reproduce

1. cmd mcp add --scope user --transport http slack https://mcp.slack.com/mcp
2. Complete the browser authentication step

Expected

Slack consent screen.

Actual

Slack error page:

Something went wrong when authorizing this app.
Try going back and authorizing again. If problems persist, contact support for help.

Error details
Invalid client_id parameter

Evidence

The generated authorize URL contains a placeholder client id:

https://slack.com/oauth/v2_user/authorize
  ?response_type=code
  &client_id=command-code
  &redirect_uri=http%3A%2F%2F127.0.0.1%3A8085%2Fcallback
  &code_challenge=...
  &code_challenge_method=S256
  &scope=...
  &resource=https%3A%2F%2Fmcp.slack.com

and ~/.commandcode/mcp.json stores it verbatim:

"oauth": {
  "authorizationUrl": "https://slack.com/oauth/v2_user/authorize",
  "tokenUrl": "https://slack.com/api/oauth.v2.user.access",
  "clientId": "command-code",
  "scopes": ["..."],
  "resource": "https://mcp.slack.com"
}

command-code is not a Slack client ID. Real Slack client IDs are numeric and dotted, e.g. 1601185624273.8899143856786. Because Slack rejects the request at the first mile, retrying, reloading, and adjusting scopes cannot help.

The rest of the generated block looks correct: oauth/v2_user/authorize endpoint, PKCE with S256, and resource=https://mcp.slack.com (RFC 8707).

Context

Slack's MCP server (mcp.slack.com) uses confidential OAuth — each IDE registers its own Slack OAuth app and passes a real clientId + clientSecret. For comparison, Slack's own slackapi/slack-mcp-plugin ships separate numeric client IDs for Claude Code and Cursor and documents a callbackPort. This looks like the same failure reported against other MCP clients, e.g. anthropics/claude-code#51345.

Ask

Either ship a registered Slack OAuth app for Command Code, or document the bring-your-own-client flow (cmd mcp add-json with oauth.clientId + --client-secret). Note that Slack requires the app be internal or Marketplace-published — unlisted apps are rejected by Slack's MCP server — and that the local callback to register is http://127.0.0.1:8085/callback.