Back to Home
iceener icon

linear-streamable-mcp-server

Verified Safe

by iceener

Overview

This server allows Language Models (LLMs) to interact with Linear.app, managing issues, projects, teams, cycles, and comments through a streamable HTTP Model Context Protocol (MCP).

Installation

Run Command
bun dev

Environment Variables

  • PORT
  • HOST
  • NODE_ENV
  • MCP_TITLE
  • MCP_INSTRUCTIONS
  • MCP_VERSION
  • MCP_PROTOCOL_VERSION
  • MCP_ACCEPT_HEADERS
  • AUTH_STRATEGY
  • AUTH_ENABLED
  • AUTH_REQUIRE_RS
  • AUTH_ALLOW_DIRECT_BEARER
  • AUTH_RESOURCE_URI
  • AUTH_DISCOVERY_URL
  • API_KEY
  • API_KEY_HEADER
  • BEARER_TOKEN
  • CUSTOM_HEADERS
  • OAUTH_CLIENT_ID
  • OAUTH_CLIENT_SECRET
  • OAUTH_SCOPES
  • OAUTH_AUTHORIZATION_URL
  • OAUTH_TOKEN_URL
  • OAUTH_REVOCATION_URL
  • OAUTH_REDIRECT_URI
  • OAUTH_REDIRECT_ALLOWLIST
  • OAUTH_REDIRECT_ALLOW_ALL
  • OAUTH_EXTRA_AUTH_PARAMS
  • PROVIDER_CLIENT_ID
  • PROVIDER_CLIENT_SECRET
  • PROVIDER_API_URL
  • PROVIDER_ACCOUNTS_URL
  • LINEAR_ACCESS_TOKEN
  • LINEAR_MCP_INCLUDE_JSON_IN_CONTENT
  • RS_TOKENS_FILE
  • RS_TOKENS_ENC_KEY
  • RPS_LIMIT
  • CONCURRENCY_LIMIT
  • LOG_LEVEL

Security Notes

The codebase demonstrates good security practices including AES-256-GCM encryption for token storage (using Web Crypto API or Node.js crypto), secure file permissions (0o600 for files, 0o700 for directories), and input validation. It implements origin and protocol version validation for MCP requests. The README explicitly warns about hardening for production deployments, indicating awareness of remaining responsibilities for the deployer. Sensitive data redaction is also applied in logging. A key risk factor is if `RS_TOKENS_ENC_KEY` is not provided in production, leading to unencrypted token storage (which the server warns about).

Similar Servers

Stats

Interest Score49
Security Score8
Cost ClassMedium
Avg Tokens1500
Stars51
Forks8
Last Update2026-01-14

Tags

LinearMCPAI AgentIssue TrackingProject Management