Secure Linear access for AI agents
Issues, projects, documents, cycles, and releases via Linear's official MCP server.
Through Linear, agents can search and read issues, projects, documents, and cycles, and create or update them when you allow it — every call runs through your policies and is logged for audit.
Server URL: https://mcp.linear.app/mcp
Setup
Linear's MCP server supports Dynamic Client Registration, so there's no app to create on Linear's side — the gateway registers an OAuth client automatically per org. See Dynamic client registration below, or Credential modes for how this compares to other catalog resources.
Dynamic client registration
- Navigate to Resources, click Add Resource, and select Linear from the catalog.
- Pick the Per-org dynamic registration card. The gateway self-registers an OAuth client with Linear — no client ID/secret needed — and installs the resource right away.
- Each user authorizes their own Linear account and grants the requested scopes. Manage linked accounts in Connections.
Required scopes
| Scope | Why |
|---|---|
read | List/get teams, issues, projects, documents, cycles, comments, releases |
write | Create/update/delete issues, comments, docs, projects, milestones, labels, attachments, releases |
offline_access | Refresh tokens so connections do not require frequent re-auth |
Available tools
| Tool | Access | Description |
|---|---|---|
list_teams | read | List teams in the workspace |
list_issues | read | List issues |
list_projects | read | List projects |
list_users | read | List workspace users |
list_comments | read | List comments on an issue/project/etc. |
list_cycles | read | List cycles for a team |
list_documents | read | List documents |
list_issue_labels | read | List issue labels |
list_issue_statuses | read | List issue statuses |
list_milestones | read | List project milestones |
list_project_labels | read | List project labels |
list_diffs | read | List diff pull requests |
get_issue | read | Get an issue by ID |
get_issue_status | read | Get an issue status |
get_team | read | Get a team |
get_user | read | Get a user |
get_project | read | Get a project |
get_milestone | read | Get a milestone |
get_document | read | Get a document |
get_status_updates | read | List/get status updates |
get_diff | read | Look up a diff |
get_diff_threads | read | Look up diff threads |
get_attachment | read | Get an attachment |
search_documentation | read | Search Linear docs |
extract_images | read | Extract images from markdown |
save_issue | write | Create/update an issue |
save_comment | write | Create/update a comment |
save_document | write | Create/update a document |
save_project | write | Create/update a project |
save_milestone | write | Create/update a milestone |
save_status_update | write | Create/update a status update |
create_issue_label | write | Create an issue label |
prepare_attachment_upload | write | Prepare a direct file upload |
create_attachment_from_upload | write | Link an uploaded asset as an attachment |
create_attachment | write | Deprecated small-file attachment upload |
delete_attachment | delete | Delete an attachment |
delete_comment | delete | Delete a comment |
delete_status_update | delete | Delete a status update |
list_releases | read | List releases (filter by pipeline/stage/version/text) |
get_release | read | Get a release by ID/slug |
list_release_notes | read | List release notes |
get_release_note | read | Get release notes (markdown) by ID/slug |
list_release_pipelines | read | List release pipelines |
save_release | write | Create/update a release |
save_release_note | write | Create/update release notes |
Policy examples
Every org is created with a seeded Allow all rule at the bottom of the list, so any call your own rules don't match stays allowed. Express restrictions as deny rules above it — new rules are added at the top, so a fresh deny outranks it automatically. See Rule order.
- Read-only access: deny
save_*,create_*,delete_*, andprepare_attachment_uploadon the Linear MCP. Those patterns cover every write and delete in the table above, leaving thelist_*,get_*, andsearch_documentationreads. - Block deletes while allowing read and write: deny
delete_* - No file uploads: deny
prepare_attachment_upload,create_attachment_from_upload, andcreate_attachment
Next steps
- Create a policy — start from the read-only pattern in Policy examples above.
- Credential modes — see how DCR compares to the other modes catalog resources use.