{
  "schemaVersion": 1,
  "methodology": "https://ionbin.com/interfaces/methodology/#evaluations",
  "evaluation": {
    "id": "linear-mcp",
    "testedOn": "2026-10-18",
    "coverage": "remote-boundary",
    "summary": "Both Linear routes required authentication. The read-only route's public metadata advertised read alone, while the default route advertised read and write.",
    "identity": {
      "version": "Remote deployment version not disclosed by the observed responses",
      "target": "https://mcp.linear.app/mcp",
      "integrity": "HTTPS certificate verification enabled. Public resource-metadata body SHA-256: e3325bb8652b7855922bbe682f1ecc4a34f97dbc60895d078c188833d8e3c97a. This fingerprints the observed metadata, not the deployed server implementation."
    },
    "environment": [
      "Windows 11 build 26200; Python 3.12.10 urllib; OpenSSL 3.0.16.",
      "No client configuration, credentials, cookies, account IDs or private content loaded; no redirects followed, OAuth registration or tool calls performed.",
      "Observed 2026-10-19T00:47:10.611440+00:00 through 2026-10-19T00:47:52.509957+00:00 UTC.",
      "One request per listed check; 20-second timeout and 64-KiB response cap. Initial sandbox DNS failures were retained separately and resolved with approved network access; they are not endpoint failures."
    ],
    "checks": [
      {
        "id": "linear-mcp-initialize",
        "name": "Credential-free initialization",
        "method": "POST https://mcp.linear.app/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-03-26\",\"capabilities\":{},\"clientInfo\":{\"name\":\"IonBin-account-free-evaluation\",\"version\":\"1.0.0\"}}}",
        "expected": "Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.",
        "observed": "HTTP 401 at 2026-10-19T00:47:10.611440+00:00. WWW-Authenticate: Bearer; resource_metadata=https://mcp.linear.app/.well-known/oauth-protected-resource/mcp. Advertised challenge scope: read write. Empty response body.",
        "outcome": "pass"
      },
      {
        "id": "linear-mcp-resource-metadata",
        "name": "Public authentication discovery",
        "method": "GET https://mcp.linear.app/.well-known/oauth-protected-resource/mcp; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.",
        "expected": "Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.",
        "observed": "HTTP 200 at 2026-10-19T00:47:20.626366+00:00; Content-Type: application/json. Resource: https://mcp.linear.app/mcp. 2 supported scopes: read, write. Authorization server: https://mcp.linear.app. Bearer methods: header.",
        "outcome": "pass"
      },
      {
        "id": "linear-mcp-readonly-initialize",
        "name": "Read-only variant: Credential-free initialization",
        "method": "POST https://mcp.linear.app/mcp/readonly; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream. Content-Type: application/json; MCP-Protocol-Version: 2025-03-26; body: {\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-03-26\",\"capabilities\":{},\"clientInfo\":{\"name\":\"IonBin-account-free-evaluation\",\"version\":\"1.0.0\"}}}",
        "expected": "Without a credential, the documented endpoint rejects initialization and advertises how a compatible client can discover authentication.",
        "observed": "HTTP 401 at 2026-10-19T00:47:24.673580+00:00. WWW-Authenticate: Bearer; resource_metadata=https://mcp.linear.app/.well-known/oauth-protected-resource/mcp/readonly. Advertised challenge scope: read write. Empty response body.",
        "outcome": "pass"
      },
      {
        "id": "linear-mcp-readonly-resource-metadata",
        "name": "Read-only variant: Public authentication discovery",
        "method": "GET https://mcp.linear.app/.well-known/oauth-protected-resource/mcp/readonly; no Authorization or Cookie header; redirects disabled; Accept: application/json, text/event-stream.",
        "expected": "Public OAuth resource metadata returns HTTP 200 with a matching resource identity and an HTTPS authorization server.",
        "observed": "HTTP 200 at 2026-10-19T00:47:52.509957+00:00; Content-Type: application/json. Resource: https://mcp.linear.app/mcp/readonly. 1 supported scopes: read. Authorization server: https://mcp.linear.app. Bearer methods: header.",
        "outcome": "pass"
      }
    ],
    "findings": [
      {
        "title": "Read-only discovery is narrower than the default",
        "basis": "observed",
        "severity": "informational",
        "detail": "Both routes returned 401. Default resource metadata listed read and write; /mcp/readonly metadata listed read only. The read-only route's initial WWW-Authenticate challenge nevertheless said read write. We did not obtain a token or test a write.",
        "practicalAdvice": "Use the documented read-only endpoint for research and inspect the consent request. Do not treat the generic challenge, or our discovery check, as proof of the granted permission set."
      },
      {
        "title": "Tool selection and credential scope are distinct",
        "basis": "documented",
        "severity": "informational",
        "detail": "Linear documents a read-only endpoint, read-only OAuth scope and restricted API-key permissions. The default /mcp route provides read-write access.",
        "practicalAdvice": "Choose both the intended endpoint and the narrowest credential. Keep separate authentication storage when switching between workspaces."
      }
    ],
    "caveats": [
      "Prefer Streamable HTTP for new setups; the SSE route is a deprecated compatibility fallback.",
      "An issue or document can contain untrusted instructions. Review a proposed issue change before enabling or approving a write."
    ],
    "notTested": [
      "OAuth consent, restricted API keys, workspace membership, token refresh or revocation.",
      "Actual read-only tool exposure or write rejection, issue search, project changes and prompt-injection resistance.",
      "Legacy SSE transport and the authenticated planning examples.",
      "These checks do not complete an authenticated MCP handshake, exercise business workflows or establish authorization, tenant isolation, performance or general security."
    ],
    "sources": [
      {
        "label": "Official endpoints, read-only setup and workspace guidance",
        "url": "https://linear.app/docs/mcp"
      },
      {
        "label": "Official OAuth permission model",
        "url": "https://linear.app/developers/oauth-2-0-authentication"
      }
    ],
    "reportUrl": "/interface-evaluations/linear-mcp.json"
  }
}