Smithery is now a part of Arcade.dev! Read more in our announcement here
Create your first Linear issue and query using the GraphQL API. Use when making initial API calls, testing Linear connection, or learning basic Linear operations. Trigger with phrases like "linear...
Verify endpoint, auth mode, viewer identity, and visible team count without spending the first test on a production write.
Use Read, Glob, and Grep to inspect code, configuration, and evidence. Use WebFetch only for current first-party Linear documentation and package metadata. Use Write or Edit only for requested implementation with known target files. Never write credentials, customer content, unrestricted environment output, or unredacted GraphQL variables.
https://api.linear.app/graphql and supports introspection.Authorization: <API_KEY> without Bearer; OAuth access tokens use Authorization: Bearer <ACCESS_TOKEN>.apiKey or accessToken in LinearClient.Use a personal API key only for owner-controlled scripts, OAuth with PKCE for user-delegated applications, or an enabled client-credentials grant for approved automation. Personal keys use Authorization: <API_KEY>; OAuth tokens use Authorization: Bearer <ACCESS_TOKEN>. Store credentials server-side in an approved secret manager.
Treat app approval, team access, scope changes, credential creation, rotation, revocation, and production access as owner-approved actions.
@linear/sdk range or construct a minimal GraphQL request using the correct authorization form.Do not create, reveal, rotate, or revoke credentials; authorize an OAuth app; change scopes or team access; create, mutate, archive, or delete workspace data; configure or re-enable webhooks; import or export data; change roles, SCIM, or audit streaming; transmit diagnostics; change paid entitlements; or perform another production mutation without explicit approval from the accountable owner. Keep diagnosis read-only unless implementation was requested.
Return the workspace and team scope, auth mode without credential value, files and contracts inspected, exact operation names, evidence collected, validation result, sensitive fields redacted, remaining risk, accountable owner, approval state, and rollback or next action.
| Condition | Response |
|---|---|
| 401 | Verify secret injection and the auth-header form without printing the credential. |
| Viewer succeeds, teams empty | Check workspace membership and team access; do not create into a fallback team. |
| GraphQL errors with data | Report the error path and treat the proof as incomplete. |
| SDK incompatible | Compare the installed package and Node version with current package metadata. |
Use a compact handoff that makes scope, mutation authority, and verification evidence reviewable.
Input:
runtime=node20; client=sdk; auth=personal-key-reference; operation=viewer+teams(first:5)
Expected handoff:
endpoint=verified; viewer=present; visible-teams=count-only; mutations=0
