Secure Linear access for AI agents
Issues, projects, documents, cycles, and releases via Linear's official MCP server.
Through Linear, agents can search and read issues, projects, documents, and cycles, and create or update them when you allow it – every call runs through your policies and is logged for audit.
Server URL: https://mcp.linear.app/mcp
Credential modes
Linear supports per-org dynamic registration only, so there is no app to create on Linear's side and no client ID or secret to enter. See Credential modes for how it compares with Use SecureAuth's app and Bring your own app.
Before you begin
- A Linear account that can reach the teams and issues your agents need.
- Administrator access to your Agent Authority workspace, to add the resource.
Setup
- In the Agent Authority console, go to Resources and click Add Resource.
- Select Linear from the catalog.
- On Choose how to install Linear, click Per-org dynamic registration. Selecting it adds the resource right away with its tools pre-configured.
Dynamic client registration
When you add the resource, the gateway registers its own OAuth client with Linear – the credential that lets it sign users in. Linear's own workspace and team permissions still apply, so an agent can only reach what the person who signed in could already reach.
Verify the connection
The gateway syncs the Linear tools automatically. To check the connection end to end, ask your agent to run a request:
List my Linear teamsIf your teams come back, the connection is working.
How users connect
Access is per user. Each additional user connects their own Linear account the first time their agent calls a Linear tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.
Each user grants the requested scopes when they authorize.
Available tools
| Tool | Access | Description |
|---|---|---|
list_teams | read | List teams in the workspace |
list_issues | read | List issues |
list_projects | read | List projects |
list_users | read | List workspace users |
list_comments | read | List comments on an issue/project/etc. |
list_cycles | read | List cycles for a team |
list_documents | read | List documents |
list_issue_labels | read | List issue labels |
list_issue_statuses | read | List issue statuses |
list_milestones | read | List project milestones |
list_project_labels | read | List project labels |
list_diffs | read | List diff pull requests |
get_issue | read | Get an issue by ID |
get_issue_status | read | Get an issue status |
get_team | read | Get a team |
get_user | read | Get a user |
get_project | read | Get a project |
get_milestone | read | Get a milestone |
get_document | read | Get a document |
get_status_updates | read | List/get status updates |
get_diff | read | Look up a diff |
get_diff_threads | read | Look up diff threads |
get_attachment | read | Get an attachment |
search_documentation | read | Search Linear docs |
extract_images | read | Extract images from markdown |
save_issue | write | Create/update an issue |
save_comment | write | Create/update a comment |
save_document | write | Create/update a document |
save_project | write | Create/update a project |
save_milestone | write | Create/update a milestone |
save_status_update | write | Create/update a status update |
create_issue_label | write | Create an issue label |
prepare_attachment_upload | write | Prepare a direct file upload |
create_attachment_from_upload | write | Link an uploaded asset as an attachment |
create_attachment | write | Deprecated small-file attachment upload |
delete_attachment | delete | Delete an attachment |
delete_comment | delete | Delete a comment |
delete_status_update | delete | Delete a status update |
list_releases | read | List releases (filter by pipeline/stage/version/text) |
get_release | read | Get a release by ID/slug |
list_release_notes | read | List release notes |
get_release_note | read | Get release notes (markdown) by ID/slug |
list_release_pipelines | read | List release pipelines |
save_release | write | Create/update a release |
save_release_note | write | Create/update release notes |
Required scopes
The gateway requests these scopes automatically when it registers the client, so there is nothing for you to configure. Linear decides what to grant, and any scopes it returns during registration replace the list below.
| Scope | Why |
|---|---|
read | List/get teams, issues, projects, documents, cycles, comments, releases |
write | Create/update/delete issues, comments, docs, projects, milestones, labels, attachments, releases |
offline_access | Refresh tokens so connections do not require frequent re-auth |
Policy examples
Every org is created with a seeded Allow all rule at the bottom of the list, so any call your own rules don't match stays allowed. Express restrictions as deny rules above it – new rules are added at the top, so a fresh deny outranks it automatically. See Rule order.
- Read-only access: deny
save_*,create_*,delete_*, andprepare_attachment_uploadon the Linear MCP. Those patterns cover every write and delete in the table above, leaving thelist_*,get_*, andsearch_documentationreads. - Block deletes while allowing read and write: deny
delete_* - No file uploads: deny
prepare_attachment_upload,create_attachment_from_upload, andcreate_attachment
Next steps
- Create a policy – start from the read-only pattern in Policy examples above.
- Policies – how first-match-wins rule order and the seeded Allow all rule interact.