> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oriant.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Make Linear MCP read-only for a team

> Let one team read Linear through AI, but not create, change or delete anything, with an MCP Policy attached to their directory group.

Read an issue, yes. Close it, no. An MCP Policy decides that per team, separately from what the person can do in Linear themselves.

Oriant uses the labels Linear puts on its own tools: **Read**, **Write** or **Destructive**. A policy's risk level says how far up those labels a team may go.

Linear risk level

Risk level

The tools and labels above are examples; Oriant shows the real ones per connection. A tool the server gives no label is only allowed under **Everything**.

## Set it up

**1. Add Linear**

Add Linear under **MCP Connections**, if it isn't there already.

**2. Make a policy**

Open **MCP Policies**, duplicate the **Read only** preset and name it after the team, for example "Sales".

**3. Attach it to the team's group**

Pick the team's group from your directory. People added to that group in your identity provider get the policy without any work in Oriant.

**4. Put it in order**

The first policy in the list that says something about a tool decides it. Place the team's policy above any broader one that would allow more.

**5. Check it**

Use **View as** on a member of the team. Linear should show only Read tools.

## What the team sees

Their AI client never lists the Write and Destructive tools, so Claude doesn't try them. If a call reaches Oriant anyway, it is refused, never sent to Linear, and shows in the [call log](https://docs.oriant.app/mcp-gateway/call-log.md) with the policy that refused it.

## Go further

* Allow one write tool, such as `save_comment`, with a **tool exception** on the policy.
* Keep the team inside one Linear team with an [argument rule](https://docs.oriant.app/mcp-gateway/argument-rules.md).
* Give a different level on other connections, such as Slack, in the same policy.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.