Engineering Stack Linear bundle
14 Dtwo policies across 4 apps that compose into a starting posture for Engineering Stack Linear — attach the bundle to cover the surface, then tune.
On this page
For software engineering, SRE, and platform teams who work in GitHub, track work in Linear, and run observability on Datadog and Splunk, and want to give engineers an AI assistant over MCP. The goal: let the agent read code, logs, and tickets, open PRs and issues, and write up what it finds, while keeping secrets out of commits and out of its context, and keeping merges, CI changes, and destructive operations with people.
These policies act on agent traffic that flows through the gateway. Web-UI logins, native integrations, and in-app permissions are outside their reach by design.
What this bundle covers
| Policy | App | Direction | Purpose |
|---|---|---|---|
| block-secrets-commits | github | ingress | Blocks commits, PRs, issues, comments, and gists that contain a live credential. |
| redact-secrets-egress | github | egress | Masks credentials in file contents, code search, CI logs, commits, and PR diffs before the agent sees them. |
| require-human-approval-merge | github | ingress | Agents can't merge or approve pull requests. |
| protect-default-branch | github | ingress | Agents can't commit straight to main / master; changes go through a pull request. |
| block-workflow-edits | github | ingress | Agents can't create, change, or delete GitHub Actions workflows or local actions, which run with your repo's secrets. |
| deny-public-exposure-repos | github | ingress | New repos stay private; no public gists or forks of org code into personal accounts. |
| redact-secrets-writes | linear | ingress | Masks credentials in everything the agent writes to Linear: issue titles and descriptions, comments, and projects. |
| redact-secrets-egress | linear | egress | Masks credentials already sitting in issues when the agent reads them. |
| read-only-except-notebooks | datadog | ingress | Datadog is read-only for the agent, except it can create and edit notebooks. |
| cap-search-window | datadog | ingress | Datadog searches look back at most 7 days. Transform-only. |
| redact-secrets-egress | datadog | egress | Masks credentials and email addresses in Datadog responses. |
| block-write-commands | splunk | ingress | Splunk searches can't use commands that delete, write, or send data (delete, collect, outputlookup, sendemail, …). |
| cap-search | splunk | ingress | Every Splunk search gets a time range: 24 hours when none is given, never more than 7 days. Transform-only. |
| redact-secrets-egress | splunk | egress | Masks credentials and email addresses in Splunk responses. |
Policy bodies live under apps/; this page only links to them.
How bundle membership works
Bundle membership is declared in each policy's policy.md frontmatter (the policy lists engineering-stack-linear among its bundles). This page is a human-readable landing page; the generated manifest.json is the machine-readable source of truth.
What's intentionally not in the bundle
- Jira. Teams that track work in Jira should use Engineering Stack: Jira instead; the GitHub, Datadog, and Splunk policies are the same.
- Other Linear policies. The other Linear policies in the catalog target the community
mcp-linearserver (freeze-destructive-ops,guard-webhook-persistence) or rely on tool names not yet verified on Linear's hosted server (redact-customer-pii-egress,fence-roadmap-egress), so they're not in this bundle. - Identity-gated writes.
github/role-gate-writes-engineeringneeds an IdP group name configured, so it's left out of this starter set. - Tenant-specific scoping. The server name prefixes (
github,datadog,splunk, and so on) are defaults — change them if your gateway registers a server under a different name.
Notes
- Datadog write access. Datadog ships MCP Write Access switched off.
read-only-except-notebooksis what lets you turn it on for notebooks without also handing over dashboards and monitors. - Experimental policies. The Linear redaction policies, the Datadog and Splunk policies, and the two new GitHub policies (
protect-default-branch,block-workflow-edits) are marked experimental: they compile and pass their tests, but confirm them against your own instance of each app before relying on them.
Compliance note. This policy supports alignment with the cited framework controls on the MCP path only. No policy or bundle makes an organization compliant with any framework; web-UI, native-API, and in-app access are outside the gateway's reach by design. Validate against your own compliance program before relying on it.
Included policies (14)
Datadog
Cap the Time Window of Datadog SearchesKeeps Datadog searches to a recent window. The agent can search logs, spans, RUM, and events as much as it likes, but each call looks back at most 7 days .Datadog Read-Only Except NotebooksKeeps Datadog read-only for the agent, with one exception: it can create and edit notebooks.Datadog: Redact Secrets and Emails from ResponsesLogs are where secrets actually leak: a debug line that prints a request header, a stack trace with a connection string, a config dump at startup.
GitHub
Block Agent Edits to GitHub Actions WorkflowsStops the agent from creating, changing, or deleting GitHub Actions workflows and local actions.Block Secrets in GitHub Commits & PRsBlocks GitHub write tool calls whose payload looks like it carries a live credential into a repository, gist, pull request, or comment.GitHub: Redact Secrets from Read ResponsesScans the responses of GitHub's crown-jewel read tools and masks known credential shapes with a fixed [REDACTED-SECRET] marker before the text enters agent…Prevent Public Exposure of GitHub Repos, Gists & ForksStops the agent from exposing private code to the public across three GitHub write tools, at ingress — before the call reaches the GitHub MCP server, so a…Protect the Default Branch from Direct Agent CommitsStops the agent from committing straight to main or master. Changes have to land on another branch and go through a pull request, where a person reviews them.Require Human Approval: GitHub Merges & ApprovalsKeeps a human in the loop on the two GitHub actions that consummate a code change: merging a pull request and approving one .
Linear
Linear: Redact Secrets from Ticket ReadsOld issues are full of pasted credentials: a .env dump in a bug report, a connection string in a comment, a token in a stack trace.Linear: Redact Secrets from Ticket WritesEngineers paste logs, stack traces, and config snippets into issues all the time, and an agent filing a bug from an incident does the same.
Splunk
Block SPL Commands That Write or Send DataMost people assume a Splunk search can only read.Bound the Time Range of Splunk SearchesMakes sure every Splunk search the agent runs has a bounded time range.Splunk: Redact Secrets and Emails from ResponsesLogs are where secrets actually leak: a debug line that prints a request header, a stack trace with a connection string, a config dump at startup.