Atlas / MCP servers / cline / Linear

LinearSAFE

Name: Linear
Author: cline

mcp/cline/linear-19

MCP server by cline · Audited 2026-10-07

⚑ Report / re-scan Source ↗

a private MCP server for accessing Linear

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

22 11r · 8w · 3d

Transport

stdio

License

—

Stars

134

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

An MCP server for interacting with Linear's API. This server provides a set of tools for managing Linear issues, projects, and teams through Cline.

Setup Guide

1. Environment Setup

Clone the repository
Install dependencies:

npm install

Copy .env.example to .env:

cp .env.example .env

2. Authentication

The server supports two authentication methods:

API Key (Recommended)

Go to Linear Settings
Navigate to the "Security & access" section
Find the "Personal API keys" section
Click "New API key"
Give the key a descriptive label (e.g. "Cline MCP")
Copy the generated token immediately
Add the token to your .env file:

LINEAR_API_KEY=your_api_key

OAuth Flow (Alternative) NOT IMPLEMENTED

Create an OAuth application at https://linear.app/settings/api/applications
Configure OAuth environment variables in .env:

LINEAR_CLIENT_ID=your_oauth_client_id
LINEAR_CLIENT_SECRET=your_oauth_client_secret
LINEAR_REDIRECT_URI=http://localhost:3000/callback

3. Running the Server

Build the server:

npm run build

Start the server:

npm start

4. Cline Integration

Open your Cline MCP settings file:
macOS: ~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json
Windows: %APPDATA%/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json
Linux: ~/.config/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json

Add the Linear MCP server configuration:

{
"mcpServers": {
"linear": {
"command": "node",
"args": ["/path/to/linear-mcp/build/index.js"],
"env": {
"LINEAR_API_KEY": "your_personal_access_token"
},
"disabled": false,
"autoApprove": []
}

Read from source at commit 3a285248b732OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add linear-mcp --env LINEAR_API_KEY=${LINEAR_API_KEY} --env LINEAR_AUTH_CODE=${LINEAR_AUTH_CODE} --env LINEAR_CLIENT_SECRET=${LINEAR_CLIENT_SECRET} --env LINEAR_REFRESH_TOKEN=${LINEAR_REFRESH_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "linear-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "LINEAR_API_KEY": "${LINEAR_API_KEY}",
        "LINEAR_AUTH_CODE": "${LINEAR_AUTH_CODE}",
        "LINEAR_CLIENT_SECRET": "${LINEAR_CLIENT_SECRET}",
        "LINEAR_REFRESH_TOKEN": "${LINEAR_REFRESH_TOKEN}"
      }
    }
  }
}

Exposed tools (22)

11 read · 8 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`linear_auth`	read	Initialize OAuth flow with Linear
`linear_auth_callback`	read	Handle OAuth callback
`linear_bulk_update_issues`	write	Update multiple issues at once
`linear_create_comment`	write	Create a new comment on an issue or reply to an existing comment
`linear_create_issue`	write	Create a new issue in Linear
`linear_create_issues`	write	Create multiple issues at once
`linear_create_project_milestone`	write	Create a new project milestone in Linear
`linear_create_project_milestones`	write	Create multiple project milestones at once
`linear_create_project_with_issues`	write	Create a new project with associated issues. Note: Project requires teamIds (array) not teamId (single value).
`linear_delete_issue`	destructive	Delete an issue
`linear_delete_issues`	destructive	Delete multiple issues
`linear_delete_project_milestone`	destructive	Delete a project milestone
`linear_get_issue_comments`	read	Get comments for a specific issue, including threaded replies
`linear_get_project`	read	Get project information
`linear_get_project_milestone`	read	Get information about a specific project milestone
`linear_get_project_milestones`	read	Get all milestones for a specific project
`linear_get_teams`	read	Get all teams with their states and labels
`linear_get_user`	read	Get current user information
`linear_search_issues`	read	Search for issues with filtering and pagination
`linear_search_project_milestones`	read	Search for project milestones with filtering and pagination
`linear_search_projects`	read	Search for projects by name
`linear_update_project_milestone`	write	Update an existing project milestone

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (2 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (8)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

linear_delete_issue, linear_delete_issues, linear_delete_project_milestone

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.no_license · CWE-1104

Why it matters. no LICENSE file and no repo licence

Fix. add a licence