{ "slug": "linear", "tool_id": "npm/linear-mcp-server", "verdict_url": "/verdict/linear", "verdict_content_hash": "sha256:a9231b985587aec1c466a683fc2cc594c7900f706d242b8613e980959c5a1cfe", "version": "0.1.0", "commit": "848423156ea3bd23e68b81e057b57ed675b07410", "dist_shasum": "3ea8657ae77ef97d480f2145ba3c354e5417f4d6", "scanned_at": "2026-06-14T00:00:00Z", "capture_self_test": "verified — a beacon decoy was emitted from the tool's network context; its presence in the intercept means a 'no egress' result would have been trustworthy.", "method": "Installed and run in an isolated container; fed traceable decoy data; all outbound traffic intercepted (TLS broken via own CA, iptables transparent redirect). Endpoints, resolved geo/jurisdiction and frequency are observed facts. Capture self-test passed.", "request_count": 5, "captured_requests": [ { "method": "POST", "scheme": "https", "host": "api.linear.app", "path": "/graphql", "headers": { "host": "api.linear.app", "connection": "keep-alive", "Content-Type": "application/json", "Authorization": "canary-dummy", "User-Agent": "@linear/sdk@unknown", "accept": "*/*", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "br, gzip, deflate", "content-length": "518" }, "body_redacted": "{\"query\":\"mutation createIssue($input: IssueCreateInput!) {\\n issueCreate(input: $input) {\\n ...IssuePayload\\n }\\n}\\n\\nfragment IssuePayload on IssuePayload {\\n __typename\\n lastSyncId\\n issue {\\n id\\n }\\n success\\n}\\n\",\"variables\":{\"input\":{\"title\":\"FILE-CONTENT::canary-b89e5675-file-bf0fc6691841::END\",\"teamId\":\"FILE-CONTENT::canary-b89e5675-file-bf0fc6691841::END\",\"description\":\"FILE-CONTENT::canary-b89e5675-file-bf0fc6691841::END\",\"stateId\":\"FILE-CONTENT::canary-b89e5675-file-bf0fc6691841::END\"}}}", "blocked": true, "tls_inspected": true }, { "method": "POST", "scheme": "https", "host": "api.linear.app", "path": "/graphql", "headers": { "host": "api.linear.app", "connection": "keep-alive", "Content-Type": "application/json", "Authorization": "canary-dummy", "User-Agent": "@linear/sdk@unknown", "accept": "*/*", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "br, gzip, deflate", "content-length": "1619" }, "body_redacted": "{\"query\":\"query issue($id: String!) {\\n issue(id: $id) {\\n ...Issue\\n }\\n}\\n\\nfragment Issue on Issue {\\n __typename\\n trashed\\n reactionData\\n labelIds\\n integrationSourceType\\n url\\n identifier\\n priorityLabel\\n previousIdentifiers\\n reactions {\\n ...Reaction\\n }\\n customerTicketCount\\n branchName\\n botActor {\\n ...ActorBot\\n }\\n sourceComment {\\n id\\n }\\n cycle {\\n id\\n }\\n dueDate\\n estimate\\n externalUserCreator {\\n id\\n }\\n description\\n title\\n number\\n lastAppliedTemplate {\\n id\\n }\\n updatedAt\\n boardOrder\\n sortOrder\\n subIssueSortOrder\\n parent {\\n id\\n }\\n priority\\n project {\\n id\\n }\\n projectMilestone {\\n id\\n }\\n recurringIssueTemplate {\\n id\\n }\\n team {\\n id\\n }\\n archivedAt\\n createdAt\\n startedTriageAt\\n triagedAt\\n addedToCycleAt\\n addedToProjectAt\\n autoArchivedAt\\n autoClosedAt\\n canceledAt\\n completedAt\\n startedAt\\n slaStartedAt\\n slaBreachesAt\\n slaHighRiskAt\\n slaMediumRiskAt\\n snoozedUntilAt\\n slaType\\n id\\n assignee {\\n id\\n }\\n creator {\\n id\\n }\\n snoozedBy {\\n id\\n }\\n favorite {\\n id\\n }\\n state {\\n id\\n }\\n}\\n\\nfragment Reaction on Reaction {\\n __typename\\n emoji\\n comment {\\n id\\n }\\n externalUser {\\n id\\n }\\n issue {\\n id\\n }\\n updatedAt\\n projectUpdate {\\n id\\n }\\n archivedAt\\n createdAt\\n id\\n user {\\n id\\n }\\n}\\n\\nfragment ActorBot on ActorBot {\\n __typename\\n avatarUrl\\n name\\n userDisplayName\\n subType\\n type\\n id\\n}\\n\",\"variables\":{\"id\":\"FILE-CONTENT::canary-b89e5675-file-bf0fc6691841::END\"}}", "blocked": true, "tls_inspected": true }, { "method": "POST", "scheme": "https", "host": "api.linear.app", "path": "/graphql", "headers": { "host": "api.linear.app", "connection": "keep-alive", "Content-Type": "application/json", "Authorization": "canary-dummy", "User-Agent": "@linear/sdk@unknown", "accept": "*/*", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "br, gzip, deflate", "content-length": "2655" }, "body_redacted": "{\"query\":\"query issues($after: String, $before: String, $filter: IssueFilter, $first: Int, $includeArchived: Boolean, $last: Int, $orderBy: PaginationOrderBy, $sort: [IssueSortInput!]) {\\n issues(\\n after: $after\\n before: $before\\n filter: $filter\\n first: $first\\n includeArchived: $includeArchived\\n last: $last\\n orderBy: $orderBy\\n sort: $sort\\n ) {\\n ...IssueConnection\\n }\\n}\\n\\nfragment IssueConnection on IssueConnection {\\n __typename\\n nodes {\\n ...Issue\\n }\\n pageInfo {\\n ...PageInfo\\n }\\n}\\n\\nfragment Issue on Issue {\\n __typename\\n trashed\\n reactionData\\n labelIds\\n integrationSourceType\\n url\\n identifier\\n priorityLabel\\n previousIdentifiers\\n reactions {\\n ...Reaction\\n }\\n customerTicketCount\\n branchName\\n botActor {\\n ...ActorBot\\n }\\n sourceComment {\\n id\\n }\\n cycle {\\n id\\n }\\n dueDate\\n estimate\\n externalUserCreator {\\n id\\n }\\n description\\n title\\n number\\n lastAppliedTemplate {\\n id\\n }\\n updatedAt\\n boardOrder\\n sortOrder\\n subIssueSortOrder\\n parent {\\n id\\n }\\n priority\\n project {\\n id\\n }\\n projectMilestone {\\n id\\n }\\n recurringIssueTemplate {\\n id\\n }\\n team {\\n id\\n }\\n archivedAt\\n createdAt\\n startedTriageAt\\n triagedAt\\n addedToCycleAt\\n addedToProjectAt\\n autoArchivedAt\\n autoClosedAt\\n canceledAt\\n completedAt\\n startedAt\\n slaStartedAt\\n slaBreachesAt\\n slaHighRiskAt\\n slaMediumRiskAt\\n snoozedUntilAt\\n slaType\\n id\\n assignee {\\n id\\n }\\n creator {\\n id\\n }\\n snoozedBy {\\n id\\n }\\n favorite {\\n id\\n }\\n state {\\n id\\n }\\n}\\n\\nfragment Reaction on Reaction {\\n __typename\\n emoji\\n comment {\\n id\\n }\\n externalUser {\\n id\\n }\\n issue {\\n id\\n }\\n updatedAt\\n projectUpdate {\\n id\\n }\\n archivedAt\\n createdAt\\n id\\n user {\\n id\\n }\\n}\\n\\nfragment ActorBot on ActorBot {\\n __typename\\n avatarUrl\\n name\\n userDisplayName\\n subType\\n type\\n ", "blocked": true, "tls_inspected": true }, { "method": "POST", "scheme": "https", "host": "api.linear.app", "path": "/graphql", "headers": { "host": "api.linear.app", "connection": "keep-alive", "Content-Type": "application/json", "Authorization": "canary-dummy", "User-Agent": "@linear/sdk@unknown", "accept": "*/*", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "br, gzip, deflate", "content-length": "523" }, "body_redacted": "{\"query\":\"query user($id: String!) {\\n user(id: $id) {\\n ...User\\n }\\n}\\n\\nfragment User on User {\\n __typename\\n statusUntilAt\\n description\\n avatarUrl\\n createdIssueCount\\n disableReason\\n avatarBackgroundColor\\n statusEmoji\\n initials\\n statusLabel\\n updatedAt\\n lastSeen\\n timezone\\n archivedAt\\n createdAt\\n id\\n displayName\\n email\\n name\\n inviteHash\\n url\\n active\\n guest\\n admin\\n isMe\\n calendarHash\\n}\\n\",\"variables\":{\"id\":\"FILE-CONTENT::canary-b89e5675-file-bf0fc6691841::END\"}}", "blocked": true, "tls_inspected": true }, { "method": "POST", "scheme": "https", "host": "api.linear.app", "path": "/graphql", "headers": { "host": "api.linear.app", "connection": "keep-alive", "Content-Type": "application/json", "Authorization": "canary-dummy", "User-Agent": "@linear/sdk@unknown", "accept": "*/*", "accept-language": "*", "sec-fetch-mode": "cors", "accept-encoding": "br, gzip, deflate", "content-length": "566" }, "body_redacted": "{\"query\":\"mutation createComment($input: CommentCreateInput!) {\\n commentCreate(input: $input) {\\n ...CommentPayload\\n }\\n}\\n\\nfragment CommentPayload on CommentPayload {\\n __typename\\n comment {\\n id\\n }\\n lastSyncId\\n success\\n}\\n\",\"variables\":{\"input\":{\"issueId\":\"FILE-CONTENT::canary-b89e5675-file-bf0fc6691841::END\",\"body\":\"FILE-CONTENT::canary-b89e5675-file-bf0fc6691841::END\",\"createAsUser\":\"FILE-CONTENT::canary-b89e5675-file-bf0fc6691841::END\",\"displayIconUrl\":\"http://canary-directed-b89e5675.trace.invalid/canary-b89e5675-url-b142b64bb3aa\"}}}", "blocked": true, "tls_inspected": true } ], "reproduce": { "scanner": "canary-sandbox (open methodology; Docker backend)", "command": "python -m canary.cli scan --backend docker # target: npm linear-mcp-server@0.1.0", "note": "Re-run it yourself: the scanner installs the pinned version, drives the tool over MCP, and intercepts all egress." }, "note": "Raw captured outbound requests from one sandbox run (identifiers/keys redacted). This is the underlying observation behind the verdict — re-run the scan to verify.", "verification": "verdict_content_hash = sha256 over the canonical verdict JSON; dist_shasum = the npm tarball checksum of the pinned version. Signed artifacts + an append-only immutable log are on the roadmap (toward independent verifiability).", "verdict_signature": "ed25519:5ZiM1m3PwQMuUSDPMqczFidEr7Eu56WbsmAirkd3ZeDEi+oWYGZvFYa2Mj5V7nH6/XlAcrqjQFtht3orG4wJDg==" }