Linear MCP server and Dome

1. 01

   Add the Linear MCP server

   Credentials are per user, through OAuth. Each engineer consents on their first call.

   $ dome tools add --name linear \
     --url https://mcp.linear.app/mcp \
     --auth-method oauth --credential-type per-user \
     --oauth-authorize-url https://mcp.linear.app/authorize \
     --oauth-token-url https://mcp.linear.app/token \
     --oauth-registration-url https://mcp.linear.app/register \
     --oauth-default-scope read --oauth-default-scope write \
     --gateway eng-gateway

2. 02

   Sync the catalog

   The sync calls Linear as you, so finish your own sign-in first. Skip it and agents get “tool not available in this gateway”.

   $ dome tools catalog sync linear

3. 03

   Apply the rules

   Try the Support rule on one agent with --agent, and simulate a save_issue for another team before you deploy.

   $ dome rules apply linear-args.cedar \
     --agent support-triager --name linear-per-team

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Linear itself, see Linear's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "linear" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "linear" &&
  resource.tool_name == "save_issue" &&
  resource has arguments && resource.arguments has team &&
  resource.arguments.team != "Support"
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "linear" &&
  resource.tool_name == "delete_comment"
};