# linear probes, 2026-09-17T18:06Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.linear.app/mcp
$ curl -sS -i -m 25 -X POST https://mcp.linear.app/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 18:06:09 GMT
content-type: application/json
content-length: 79
cache-control: no-store
www-authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.linear.app/.well-known/oauth-protected-resource/mcp", error="invalid_token", error_description="Missing or invalid access token"
pragma: no-cache
server: cloudflare
cf-ray: a3ca0b0ff9ce0c50-BOS
alt-svc: h3=":443"; ma=86400

{"error":"invalid_token","error_description":"Missing or invalid access token"}

## 2. Protected-resource metadata, GET https://mcp.linear.app/.well-known/oauth-protected-resource/mcp
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 18:06:10 GMT
content-type: application/json
content-length: 166
vary: Origin
server: cloudflare
cf-ray: a3ca0b13b9058f6a-BOS
alt-svc: h3=":443"; ma=86400

{"resource":"https://mcp.linear.app/mcp","authorization_servers":["https://mcp.linear.app"],"scopes_supported":["read","write"],"bearer_methods_supported":["header"]}

## 3. Authorization-server metadata, GET https://mcp.linear.app/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 18:06:11 GMT
content-type: application/json
content-length: 884
server: cloudflare
cf-ray: a3ca0b17af4e903f-BOS
alt-svc: h3=":443"; ma=86400

{"issuer":"https://mcp.linear.app","authorization_endpoint":"https://mcp.linear.app/authorize","token_endpoint":"https://mcp.linear.app/token","registration_endpoint":"https://mcp.linear.app/register","scopes_supported":["read","write","openid","email"],"response_types_supported":["code"],"response_modes_supported":["query"],"grant_types_supported":["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:jwt-bearer"],"authorization_grant_profiles_supported":["urn:ietf:params:oauth:grant-profile:id-jag"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"],"revocation_endpoint":"https://mcp.linear.app/token","code_challenge_methods_supported":["S256"],"client_id_metadata_document_supported":true,"resource":"https://mcp.linear.app/mcp","resource_metadata":"https://mcp.linear.app/.well-known/oauth-protected-resource/mcp"}

## 4. REST, GET https://api.linear.app/graphql, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 400 
date: Thu, 17 Sep 2026 18:06:11 GMT
content-type: application/json; charset=utf-8
content-length: 481
cf-ray: a3ca0b1b984caa97-BOS
cf-cache-status: DYNAMIC
cache-control: private, no-cache, no-store, must-revalidate
etag: W/"1e1-Pj6jukFvCDT/ZBGD/LVdheKiTtk"
server: cloudflare
vary: Accept-Encoding
via: 1.1 google
alt-svc: h3=":443"; ma=86400
x-request-id: a3ca0b1bda914613-BOS

{"errors":[{"message":"This operation has been blocked as a potential Cross-Site Request Forgery (CSRF). Please either specify a 'content-type' header (with a type that is not one of application/x-www-form-urlencoded, multipart/form-data, text/plain) or provide a non-empty value for one of the following headers: x-apollo-operation-name, apollo-require-preflight\n","extensions":{"http":{"status":400,"headers":{}},"code":"BAD_REQUEST","type":"graphql error","userError":true}}]}