{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-11T21:09:20.344Z", "record_id": "VXI-EXT-TOOL-TRUST-LINEAR-01-v1", "record_kind": "external_reference", "title": "Linear MCP: Workspace identity and posting authority", "system": "Linear MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "What should an agent check before using Linear MCP across more than one workspace?", "near_questions": [ "How can an agent avoid updating the wrong workspace?", "Does reconnecting Linear MCP change the workspace?", "Can Linear MCP use a read-only API key?", "Which actor creates work through Linear OAuth?", "Does adding comments require general Linear write access?", "Can one Linear auth context represent two workspaces?", "What can a Linear planning connector create?", "Where does Linear MCP return project information?", "What should be checked before posting a Linear update?", "Does a saved token prove the correct workspace is selected?", "What does a paid Linear review snapshot preserve?", "Does this Linear record test my session?" ], "supported_claims": [ { "claim": "Linear documents a separate authentication context for each workspace; reconnecting alone does not switch an existing session's workspace. Its MCP supports OAuth and direct tokens, including a restricted read-only API key. Check the active workspace, actor and granted scopes before posting or updating work. This profile does not verify your current session.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent tool execution or security testing", "Vendor certification, guaranteed safety or no-training assurance" ], "public_summary": "Linear documents a separate authentication context for each workspace; reconnecting alone does not switch an existing session's workspace. Its MCP supports OAuth and direct tokens, including a restricted read-only API key. Check the active workspace, actor and granted scopes before posting or updating work. This profile does not verify your current session.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-ATLASSIAN-01-v1", "VXI-EXT-TOOL-TRUST-NOTION-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Linear MCP server", "source_url": "https://linear.app/docs/mcp", "checked_on": "2026-10-11", "candidate_record_id": "VXI-EXT-TOOL-TRUST-LINEAR-01-v1", "candidate_record_sha256": "430bb2f9f4d1ed16465f75879b6448a031421e4646021ae6df7f4b140c3e7661", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Linear documents a separate authentication context for each workspace; reconnecting alone does not switch an existing session's workspace. Its MCP supports OAuth and direct tokens, including a restricted read-only API key. Check the active workspace, actor and granted scopes before posting or updating work. This profile does not verify your current session.", "required_buyer_context": "Linear's hosted MCP and documented OAuth scope model; actual client auth context and workspace membership are unspecified. Active workspace, actual actor, key scope, membership and downstream client policy.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Linear MCP", "variant": "Linear's hosted MCP and documented OAuth scope model; actual client auth context and workspace membership are unspecified." }, "review_status": "documentation_review_only", "checked_on": "2026-10-11", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Linear operates the documented hosted MCP.", "source_ids": [ "linear-main", "linear-auth" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Retrieve planning information and manage issues, projects and comments.", "source_ids": [ "linear-main", "linear-auth" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Accessible Linear work information through the authenticated connection.", "source_ids": [ "linear-main", "linear-auth" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Documented workflows create work and post updates; OAuth distinguishes general write from narrower issue/comment creation scopes.", "source_ids": [ "linear-main", "linear-auth" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "OAuth sessions or direct bearer tokens/API keys; a Read-only API key is documented for restricted retrieval.", "source_ids": [ "linear-main", "linear-auth" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Workspace authentication contexts must be separated. OAuth actor and scope settings affect whose authority is used.", "source_ids": [ "linear-main", "linear-auth" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Selected work data is returned to the client; local auth storage does not demonstrate local-only model processing.", "source_ids": [ "linear-main", "linear-auth" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Updating the wrong workspace; unnecessary broad write scopes; confusing an app actor with a user actor.", "source_ids": [ "linear-main", "linear-auth" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Active workspace, actual actor, key scope, membership and downstream client policy.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Do not post updates until workspace and actor match the task; use an approved read-only connection for reporting-only work.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "linear-main", "url": "https://linear.app/docs/mcp", "final_url": "https://linear.app/docs/mcp", "title": "Linear MCP server", "checked_on": "2026-10-11", "sha256": "78fa7cb59b98d551e49c22d471fb0eb56fcd560d8e911b858694d4d777dc6ccd", "bytes": 776747 }, { "source_id": "linear-auth", "url": "https://linear.app/developers/oauth-2-0-authentication", "final_url": "https://linear.app/developers/oauth-2-0-authentication", "title": "Linear OAuth scope reference", "checked_on": "2026-10-11", "sha256": "b274e49be4a0495cce50a0531e51fcb1364d35911d03b53e4801a0d386923415", "bytes": 753476 }, { "source_id": "mcp-hints", "url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "final_url": "https://blog.modelcontextprotocol.io/posts/2026-03-16-tool-annotations/", "title": "MCP tool annotations and enforcement boundaries", "checked_on": "2026-10-11", "sha256": "82888044d831c3bd18f03d87a846ce5d27e028bd67a095edc04ba377fc622163", "bytes": 52715 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Retain workspace, actor and permission questions behind a planning-connector review.", "free": "Complete profile, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Review the effective tool inventory and client data policy before a new integration decision." }, "change_history": [ { "version": 1, "date": "2026-10-11", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#linear-mcp-workspace-identity-trust", "machine_readable_record": "/varexis-index/records/linear-mcp-workspace-identity-trust.json" }