Skills/npm/mcp-linear

mcp-linear@1.4.6

CAUTION

Publisher claims: "A Model Context Protocol (MCP) server implementation for the Linear GraphQL API that enables AI assistants to manage Linear projects and search issues by text, state, and date." Observed in sandbox: reads credential files.

Registry npm (MCP server)Publisher tacticlaunch · publishing for 601 daysInstalls 223KLast detonated 14 h ago
What would fix thisWatchDispute verdict

Coverage

Started with a decoy LINEAR_API_TOKEN, LINEAR_API_KEY; tool list observed. Tool calls with a real credential not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup with a tagged decoy in LINEAR_API_TOKEN, LINEAR_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
LINEAR_API_TOKEN, LINEAR_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
LINEAR_API_KEYLINEAR_API_TOKENLINEAR_OAUTH_ACCESS_TOKENLINEAR_OAUTH_CLIENT_IDLINEAR_OAUTH_CLIENT_SECRET or --client-secret / --oauth-tokenConfiguration, not credentials: CALLBACK_PATH, MCP_LINEAR_CONFIG_DIR, MCP_LINEAR_DEBUG
Where it talks to
no vendor host named in the codeAlso linear.app — not the publisher's domain; check what for before connecting.
What the honeypot saw
read ~/.config/mcp-linear/credentials.json · no network
What we could not test
what the tools do when called with a real credential

Connect it only under the guard, with no real credential files on the machine it runs on. It read ~/.config/mcp-linear/credentials.json, which is nothing an MCP server needs from a user. `--contain` makes those directories unreadable.

$vet-skills run --contain --net declared -- npx -y @tacticlaunch/mcp-linear

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios) on 2026-11-13 and scored it 64/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths. Summary: reads credential files.

Behavior trace

Honeypot run · 55 s · 3 scenarios
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
14sprocessdependency install exit 0
34sfilesystemread ~/.config/mcp-linear/credentials.json outside project
34sprocessrelaunched with a decoy LINEAR_API_TOKEN, LINEAR_API_KEY (tagged; nothing real)
54sclaimed198 tools with a decoy LINEAR_API_TOKEN, LINEAR_API_KEY: linear_getViewer, linear_getOrganization, linear_getUsers, linear_getLabels, linear_getTeams, linear_getWorkflowStates, linear_createWorkflowState, linear_updateWorkflowState, linear_updateTeam, linear_getTeamMemberships, linear_createTeam, linear_archiveTeam, linear_addUserToTeam, linear_removeUserFromTeam, linear_updateTeamMembership, linear_getTeamLabels, linear_createTeamLabel, linear_getProjects, linear_getProjectById, linear_createProject, linear_updateProject, linear_createProjectUpdate, linear_updateProjectUpdate, linear_getProjectUpdateById, linear_getProjectUpdates
54stools93e786943aa2a3ac
54stools48ab732c647b2aa7
54stoolsb25f35e06eec0090
54stools3723d38e5be59b8e
54stools724fb7565fe77f1f
54stoolsbad8b11f3783df76
54stools0e0a4559c53af049
54stools801f57a2efd4e024
54stools05314edf98dc714e
54stools6e501913396bf99e
54stools0401a5dc5a8a25f9
54stools1c5495f118920702
54stools6530f87649e380fc
54stools586c2a5ae19541d8
54stools6dbb948170321a2f
54stoolsa1d3d149e6eab5cc
54stoolsdd80637b613daa73
54stoolse464d7bc891ebf92
54stools1f35fb6a59625431
54stoolsf47af6ca3f66dd85
54stoolsf21f04388bd38462
54stools169a6cfeeef42606
54stools9e8553645392eea6
54stoolsee315a543ad469dc
54stools9868d044e8d9734e
54stoolsa503784fb7e5618e
54stools81f9291bf12d6aec
54stoolse0f0df9ac2ab4beb
54stools97fc43246e3c2517
54stools9287756afe8a3108
54stools814a5f53ec9fa1ad
54stools4406bf93e510c97f
54stools14c521c562f43d5b
54stools3777bd3d90d9b9c9
54stools88cd024e3bde49d7
54stoolsaebf740840e14fd5
54stools2a4c7683b75a3728
54stoolsceb336cda12eb9f9
54stools218b99ca6b77ea31
54stools4b5ad338ea40c064
54stoolsc2ecfe3710e55890
54stools658af073e86de3de
54stoolse8962424194bda6b
54stoolsd6777e3e416d440b
54stoolsf4f69665625aa8e4
54stools6699dd7e85101a3b
54stools1d3ca533a1862faa
54stools6bf72ddf15fa98e8
54stools332d0c48bd5a52fe
54stoolsb696d29bec52d88e
54stools63a605ef016ee4ac
54stools0567a2fd12be77fa
54stools61a9db57ea041756
54stools850fd0ec8a03244c
54stools51c59e4fcbcccd7f
54stoolsc984189ce3e73a1d
54stoolse3597d929cff28b0
54stools322bc304b7cf1cd6
54stools5d83c305e3ab0730
54stoolsdd84e42c23eecda5
54stoolsc9bc71b7b644c29c
54stoolscc17668726d00b03
54stoolsaba2f2b23c6c85b2
54stoolsf354386219dd2c12
54stoolsa1b7bd7bd248cdfb
54stoolsa746ec0adc9448a1
54stoolsefdd2fb16bf659f5
54stools736e79a841d14356
54stools7061b632cc8fd838
54stoolsc31e95c4cab2149f
54stools181e85ee8a409c6e
54stools9b50b0185b9a4c93
54stools491d381bab3f73d6
54stools34ee096c4aa36ff0
54stoolscb39bfeaae7f10a9
54stoolsbd46595d243bb250
54stoolsf51f507144bdf816
54stoolsfd3f801c85557b7a
54stoolsaa60de3ff9ff5931
54stools6d8e5d6f0c6f5c30
54sprocessscript backend runs setup only
54sprocesssecond launch, clock +45 days, CI unset

Static findings

HIGH
Access to sensitive file pathsdist/utils/config.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load environment variables from .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

No other findings across 21,463 lines in 64 files.

Cost to the agent

Instructions loaded
≈82 tok
1 file · 64 in bundle
Tool list per prompt
≈25,672 tok
198 tools · 130 per tool
Handshake
8462 ms
launch to tools/list, stdio
Undocumented tools
15
description under 20 chars · avg 49

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @tacticlaunch/mcp-linear@1.4.6 as of 14 h ago. This is the package itself, not its dependencies.

What would make this Verified

16 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
  2. Unclaimed publisher≈ +8 on the totalClaim tacticlaunch: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim tacticlaunchPropose a patch to the maintainer