@@ -103,6 +103,9 @@ The package is designed for use both in the main CLI binary and in WebAssembly c
 | `ExtractMCPConfigurations` | `func(frontmatter map[string]any, serverFilter string) ([]RegistryMCPServerConfig, error)` | Extracts all MCP server configurations from frontmatter |
 | `ParseMCPConfig` | `func(toolName string, mcpSection any, toolConfig map[string]any) (RegistryMCPServerConfig, error)` | Parses a single MCP server entry |
 | `IsMCPType` | `func(typeStr string) bool` | Validates an MCP transport type string |
+| `IsSimpleSecretExpression` | `func(value string) bool` | Reports whether `value` is a direct `${{ secrets.NAME }}` GitHub Actions reference without additional expression operators |
+| `ParseLinearToolsets` | `func(value any) ([]string, error)` | Validates and expands `tools.linear.toolsets` (a name or array of names) into the corresponding sorted, deduplicated MCP tool names; `"all"` expands to `["*"]` |
+| `ValidateLinearAllowedForToolsets` | `func(allowed, toolsetTools []string) error` | Checks that every `tools.linear.allowed` glob pattern matches at least one tool in the configured toolsets (the `"*"` toolset accepts any pattern) |
 
 #### Schedule Parsing
 
@@ -363,12 +366,15 @@ This appendix is generated from the current non-test Go source files in this pac
 | `import_cache.go` | `(*ImportCache).Set` | `func (*ImportCache).Set(owner, repo, path, sha string, content []byte) (string, error)` | Set stores a new cache entry by saving the content to the cache directory sha parameter should be the resolved commit SHA |
 | `import_error.go` | `(*FormattedParserError).Unwrap` | `func (*FormattedParserError).Unwrap() error` | Exported function or method declared in `import_error.go`. |
 | `schema_validation.go` | `IsImportSafeSharedWorkflowOn` | `func IsImportSafeSharedWorkflowOn(onValue any) bool` | IsImportSafeSharedWorkflowOn validates whether an imported `on:` block is restricted to safe shared-workflow triggers. |
+| `mcp.go` | `IsSimpleSecretExpression` | `func IsSimpleSecretExpression(value string) bool` | Reports whether value is a direct GitHub Actions secrets reference without additional expression operators. |
+| `linear_toolsets.go` | `ParseLinearToolsets` | `func ParseLinearToolsets(value any) ([]string, error)` | Validates and expands Linear toolsets into MCP tool names. |
+| `linear_toolsets.go` | `ValidateLinearAllowedForToolsets` | `func ValidateLinearAllowedForToolsets(allowed, toolsetTools []string) error` | Checks that every allowed pattern selects at least one tool from the configured Linear toolsets. |
 
 <!-- END SOURCE-VERIFIED EXPORT COVERAGE -->
 
 ## Source Synchronization
 
-Reviewed against recent source updates on 2026-07-24; no additional public-contract deltas were identified beyond the sections above. Re-verified on 2026-08-14; no public-contract changes since the last review (only internal schema-suggestions refactoring landed). Re-verified on 2026-08-29; no public-contract deltas since the last review. Re-verified on 2026-09-03; no public-contract deltas since the last review.
+Reviewed against recent source updates on 2026-07-24; no additional public-contract deltas were identified beyond the sections above. Re-verified on 2026-08-14; no public-contract changes since the last review (only internal schema-suggestions refactoring landed). Re-verified on 2026-08-29; no public-contract deltas since the last review. Re-verified on 2026-09-03; no public-contract deltas since the last review. Re-verified on 2026-09-08; added `ParseLinearToolsets`, `ValidateLinearAllowedForToolsets`, and `IsSimpleSecretExpression` (Linear toolset support and secret-expression validation) to the MCP Configuration public API table, which were previously undocumented.
 
 ---
 
 
@@ -44,7 +44,7 @@ Both functions are pure and stateless; they MAY be called concurrently without s
 
 ## Source Synchronization
 
-Reviewed against source on 2026-07-26; no public-contract deltas identified. Re-verified on 2026-08-14; still no public-contract deltas. Re-verified on 2026-08-29; still no public-contract deltas. Re-verified on 2026-09-03; still no public-contract deltas.
+Reviewed against source on 2026-07-26; no public-contract deltas identified. Re-verified on 2026-08-14; still no public-contract deltas. Re-verified on 2026-08-29; still no public-contract deltas. Re-verified on 2026-09-03; still no public-contract deltas. Re-verified on 2026-09-08; still no public-contract deltas.
 
 ---
 
 
@@ -158,7 +158,7 @@ semverutil.IsCompatible("v6.0.0", "v5") // false
 
 ## Source Synchronization
 
-Reviewed against recent source updates on 2026-07-24; `NormalizeGitDescribeSemver` added to Public API section. Re-verified on 2026-08-14; no further public-contract deltas identified. Re-verified on 2026-08-29; no public-contract deltas identified. Re-verified on 2026-09-03; no public-contract deltas identified.
+Reviewed against recent source updates on 2026-07-24; `NormalizeGitDescribeSemver` added to Public API section. Re-verified on 2026-08-14; no further public-contract deltas identified. Re-verified on 2026-08-29; no public-contract deltas identified. Re-verified on 2026-09-03; no public-contract deltas identified. Re-verified on 2026-09-08; no public-contract deltas identified.
 
 ---
 
 
@@ -77,7 +77,7 @@ All functions in this package are pure and stateless — they create and return
 
 ## Source Synchronization
 
-Reviewed against source on 2026-07-26; no public-contract deltas identified. Re-verified on 2026-08-14; still no public-contract deltas. Re-verified on 2026-08-29; still no public-contract deltas. Re-verified on 2026-09-03; still no public-contract deltas.
+Reviewed against source on 2026-07-26; no public-contract deltas identified. Re-verified on 2026-08-14; still no public-contract deltas. Re-verified on 2026-08-29; still no public-contract deltas. Re-verified on 2026-09-03; still no public-contract deltas. Re-verified on 2026-09-08; still no public-contract deltas.
 
 ---