Fix Linear MCP inspection

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Author: Copilot

docs/src/content/docs/reference/frontmatter-full.md

@@ -4049,7 +4049,7 @@ tools:
     # Optional Linear API key or OAuth access token secret reference. Defaults to ${{
     # secrets.LINEAR_API_KEY }}.
     # (optional)
-    token: "example-value"
+    token: "${{ secrets.LINEAR_API_KEY }}"
 
     # Linear MCP toolset name(s) to enable. Toolsets are expanded to gateway-enforced
     # allowed tools.
@@ -4068,7 +4068,7 @@ tools:
     # List of allowed Linear MCP tool names or wildcard patterns. When toolsets are
     # set, every pattern must match a tool in those toolsets.
     # (optional)
-    allowed: []
+    allowed: ["*"]
       # Array of strings
 
     # Whether failure to connect to Linear should fail MCP gateway startup. Defaults

pkg/cli/mcp_validation.go

@@ -139,6 +139,15 @@ func validateServerSecrets(config parser.RegistryMCPServerConfig, verbose bool,
 			missingSecrets = append(missingSecrets, secret)
 		}
 	}
+	for _, secret := range availableSecrets {
+		if secret.Value == "" {
+			continue
+		}
+		for key, value := range config.Headers {
+			expression := "${{ secrets." + secret.Name + " }}"
+			config.Headers[key] = strings.ReplaceAll(value, expression, secret.Value)
+		}
+	}
 
 	// Display information about secrets
 	if verbose {

pkg/parser/mcp.go

@@ -298,12 +298,16 @@ func buildLinearBuiltinConfig(toolValue any) (*RegistryMCPServerConfig, error) {
 	if !ok {
 		return nil, errors.New("tools.linear must be an object")
 	}
+	if _, expanded := toolConfig["type"]; expanded {
+		return buildExpandedLinearBuiltinConfig(toolConfig)
+	}
 	for field := range toolConfig {
 		switch field {
 		case "token", "toolsets", "allowed", "required":
 		default:
 			return nil, fmt.Errorf("unknown tools.linear property %q", field)
 		}
+
 	}
 
 	token := constants.LinearMCPDefaultTokenExpr
@@ -343,6 +347,50 @@ func buildLinearBuiltinConfig(toolValue any) (*RegistryMCPServerConfig, error) {
 	return config, nil
 }
 
+func buildExpandedLinearBuiltinConfig(toolConfig map[string]any) (*RegistryMCPServerConfig, error) {
+	for field := range toolConfig {
+		switch field {
+		case "type", "url", "headers", "allowed", "required":
+		default:
+			return nil, fmt.Errorf("unknown expanded tools.linear property %q", field)
+		}
+	}
+	typeName, ok := toolConfig["type"].(string)
+	if !ok || typeName != "http" {
+		return nil, errors.New("expanded tools.linear type must be http")
+	}
+	url, ok := toolConfig["url"].(string)
+	if !ok || url == "" {
+		return nil, errors.New("expanded tools.linear url must be a non-empty string")
+	}
+	config := &RegistryMCPServerConfig{
+		BaseMCPServerConfig: types.BaseMCPServerConfig{Type: typeName, URL: url, Headers: map[string]string{}},
+		Name:                "linear",
+	}
+	if headers, ok := toolConfig["headers"].(map[string]any); ok {
+		for key, value := range headers {
+			header, ok := value.(string)
+			if !ok {
+				return nil, fmt.Errorf("expanded tools.linear header %q must be a string", key)
+			}
+			config.Headers[key] = header
+		}
+	}
+	allowed, err := buildLinearAllowedTools(toolConfig)
+	if err != nil {
+		return nil, err
+	}
+	config.Allowed = allowed
+	if requiredValue, exists := toolConfig["required"]; exists {
+		required, ok := requiredValue.(bool)
+		if !ok {
+			return nil, errors.New("tools.linear.required must be a boolean")
+		}
+		config.Required = &required
+	}
+	return config, nil
+}
+
 func buildLinearAllowedTools(toolConfig map[string]any) ([]string, error) {
 	var toolsetTools []string
 	if toolsetsValue, exists := toolConfig["toolsets"]; exists {