Linear is an issue-tracking and product-planning platform for teams. Use OAuth when access should follow a user, or use a personal API key only for a dedicated service identity with limited team membership.
This guide covers Linear-side setup for an MCP server. The Linear agent template is a separate deployment of the Dome configuration.
Choose a connection method
Choose OAuth when access should follow a Linear member. For a static bearer credential, Linear also accepts an existing OAuth access token or a personal API key; use an API key with only the Read permission for a read-only automation. See Linear's MCP documentation.
Recommended: OAuth
OAuth keeps the server aligned with the authorizing user's Linear workspace and team permissions. The interactive MCP flow uses OAuth 2.1 with Dynamic Client Registration, so the client registers automatically. Use a dedicated test member and test team for the first authorization.
- Add
https://mcp.linear.app/mcp/readonlyto the OAuth-capable MCP client. - Start authorization from the MCP client and sign in as the test member.
- Approve the intended workspace and verify access to a known issue in the test team.
- Try an issue from an unshared team; it should be unavailable.
Alternative: Existing OAuth access token
If your application already obtains a Linear OAuth access token, it can send that token directly as Authorization: Bearer <token>. Keep the application's scopes and the authorizing member's workspace/team membership narrow.
Alternative: Personal API key
For an automation that cannot complete OAuth, create a personal API key under a dedicated member. Enable only Read, use the /readonly endpoint, and keep the member's team access narrow.
- Open the vendor's credential documentation as the dedicated least-privileged identity.
- Create a named credential for the intended test workspace, project, organization, or account—never reuse an owner or administrator credential.
- Select the minimum scopes, repositories, projects, or resources the MCP server needs; begin read-only whenever the product supports it.
- Copy the secret once into the MCP client's secret store, record its owner and rotation date, then test both an allowed record and a denied boundary.
Verify Linear MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Linear MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Linear boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
A successful token with missing issues usually indicates team membership or private-team visibility, not an MCP error. Correct the test member's access rather than switching to an administrator key.
Next steps
Deploy the Linear agent template to create a governed agent in Dome that can work with the approved teams and issues, with the template's included model, tools, and rules.
