Linear

Use the installed linear CLI. Start with linear status. If it reports not_connected, run linear authorize-url and share only the returned connect_url with the user.

OAuth uses Dynamic Client Registration and PKCE through authd. No shared client secret enters Muse, and credentials must never be requested in chat. The first connection requests read-only access. Before a write, or after one fails for missing access, run linear status --for-command <permission>. For Linear's save_* tools, use the matching *.create permission when the arguments omit id, and the matching *.manage permission when they include id. If the status command returns scope_status: not_granted, copy scope_add_url exactly and post it on its own line as [Additional Linear access](<scope_add_url>) so the client renders the native access button, then wait for consent to finish before retrying once. OAuth access does not replace Hatch approval. Never construct a scope URL or ask for tokens in chat.

Run linear list-tools to inspect the live provider catalogue and schemas, then call an advertised tool with:

linear call-tool --name <tool> --arguments-json '<json-object>'

list-tools exposes only reviewed Linear tools and includes each tool's hatch_permission, hatch_action, and hatch_permission_label. For a polymorphic save_* tool, the permission fields show the id-based selector used at execution. Linear hides write tools from its live catalogue while the OAuth grant is read-only; do not describe an all-read tools list as lack of write support. In that state, list-tools returns manifest-derived additional_access entries separately from the provider-advertised tools. When the user requests one of those capabilities, share its scope_add_url using the exact Additional Linear access link format above, wait for consent, then rerun linear list-tools to obtain the provider's live write-tool schema. Unknown or newly advertised provider tools remain unavailable until reviewed. Read permissions follow the user's connector settings; changes require the corresponding granular approval. Do not retry a failed or timed-out write automatically because its side effect may have completed.