Linear MCP server security: read-only by URL, by scope or by key

The short answer

Use https://mcp.linear.app/mcp/readonly for any agent that only needs to read issues. That endpoint only ever exposes read tools.¹ If the agent must create or update issues, use the default endpoint, keep your client’s approval prompt on for write tools, and connect each Linear workspace in its own session.

Read-write is the default

Linear’s docs are direct about it: read-write access is provided through https://mcp.linear.app/mcp by default, and the server has tools for finding, creating and updating issues, projects and comments.¹ For a coding agent that’s often more than it needs. Reading the issue it’s working on, and the comments under it, covers most coding tasks. Writing back status changes and comments is useful, but it’s also how a confused agent closes the wrong ticket or posts a summary of a private repository into a shared project.

Three ways to make it read-only

The first is the simplest, and it works with every client that can take a URL. The second and third are stronger in one respect: the limit is on the credential, so even a tool that slipped through couldn’t write. If you can, combine them: the read-only endpoint plus a read-only key.

Setups

Claude Code, read-only, project scope:

Code Commands typed in a terminal. The text around it says what happens.

claude mcp add --transport http --scope project linear-ro https://mcp.linear.app/mcp/readonly

That writes the server into .mcp.json at the project root, shared through version control.² Everyone on the team gets the read-only connection by default.

Cursor, read-only:

Code Data in JSON, the format software uses to pass records and settings.

{
  "mcpServers": {
    "linear": { "url": "https://mcp.linear.app/mcp/readonly" }
  }
}

Saved in .cursor/mcp.json for the project or ~/.cursor/mcp.json for every project.³

A Read-only API key instead of the browser sign-in:

Code Data in JSON, the format software uses to pass records and settings.

{
  "mcpServers": {
    "linear": {
      "url": "https://mcp.linear.app/mcp/readonly",
      "headers": { "Authorization": "Bearer ${LINEAR_API_KEY}" }
    }
  }
}

In Claude Code’s .mcp.json, ${LINEAR_API_KEY} is expanded from the environment in url and headers, so the key isn’t written into the file.² Cursor uses ${env:LINEAR_API_KEY} for the same thing.³

When the agent does need to write

Some workflows want write access: an agent that files bugs it found, or updates the issue it just fixed. For those:

1. Keep the client’s approval on for write tools. Creating and updating issues should show you the change before it happens. Don’t pick “always allow” for them.
2. One workspace per connection. Linear authenticates each session with OAuth, and reconnecting doesn’t switch workspaces inside an existing session; each workspace needs its own authentication context.¹ That’s a feature: an agent connected to your company’s workspace can’t drift into a client’s.
3. Separate the reading agent from the writing one. A triage agent that reads many issues is exposed to text written by many people. If it can also write, that’s untrusted content steering a write tool. Simon Willison’s “lethal trifecta” (private data, untrusted content, a way to communicate externally) is the frame to use when deciding what one agent should hold.⁴

A worked decision table

The last row is where accidents happen. A bulk update driven by a model’s reading of free-text issue titles will get some wrong. Review the list it intends to change before approving, or do that one by hand. A bulk change that touches thirty issues is thirty separate edits to find and undo by hand if it goes wrong, so it’s worth a minute of review first.

What a config scanner sees

Like other remote servers, a Linear entry is just a URL to a file-based scanner. In our run of deedglass 0.13.0’s scan, the Linear server added no write paths to the grade.⁵ A scanner can’t tell /mcp from /mcp/readonly by what the server will do. Check that suffix by eye; it’s the single most useful thing in the file.

A quick way to check every config in a repository and your home directory:

Code Commands typed in a terminal. The text around it says what happens.

grep -rn "mcp.linear.app" .mcp.json .cursor .vscode ~/.cursor 2>/dev/null

Any line that ends in /mcp without /readonly deserves a second look, and a reason written next to it in your team’s notes.

Questions people ask

Does the Linear MCP server have a read-only mode?

Yes. https://mcp.linear.app/mcp/readonly only ever exposes read tools. A read OAuth scope or a Read-only API key also keep the token away from write APIs.¹

Can I use a Linear API key instead of OAuth?

Yes. The server accepts OAuth tokens and API keys in the Authorization: Bearer header. For read-only use, create the key with only the Read permission.¹

Can one connection reach two Linear workspaces?

No. Each workspace needs its own authentication context; reconnecting alone doesn’t switch workspaces within an existing session.¹

Similar setups for other services: GitHub MCP read-only mode and Sentry MCP scopes. Where each client keeps the file is in the MCP config paths table, what a smaller reach buys you is under blast radius, and the full review is the ten-minute MCP config audit.

To see what the rest of your agent setup can change, run npx deedglass scan in the repository (what the grade means), or watch the checks in the playground.

Written with AI assistance and checked against our claims register.