AI for LinkedIn outreach
The highest-demand prompts on the internet and the ones most likely to get an account restricted. Everything here is written against the real field limits and the real send ceilings, which is why the cadences are four touches rather than seven.
The difference is the reference, not the writing
Both are grammatically fine. One references something the recipient actually said; the other could be pasted to anyone on LinkedIn and nobody would notice.
Hi Dana, I hope this finds you well! I came across your profile and wanted to connect. I think our solution could really help your business — would you be open to a quick call this week?
Dana — your post about the five-week close after the acquisition stuck with me. Was it the inter-entity reconciliation that added the time, or the consolidation itself? I keep seeing the first blamed on the second.
One specific, checkable reference, under the 300-character field limit, no pitch.
Research, then message, then cadence, then reply. Writing the sequence before you have written one good first message is optimising the wrong half.
Scaling generation instead of targeting. You can generate a thousand messages an hour; you can send about 100 invitations a week, and LinkedIn lowers that number for accounts whose invitations go unaccepted.
6 for this work
- Prompt
Connection Request Generator
Three connection requests under 300 characters, each with one specific reference, plus a recommendation on whether to send a note at all.
- Prompt
LinkedIn Outreach Personalizer
A first message and its follow-up, built from a stated hypothesis, with every claim traceable to something you actually gave it.
- Prompt
Follow-up Sequence Builder
A three-to-four touch sequence with dates, channels, a stop rule, and a capacity check against what your plan can actually send.
- Prompt
Reply & Objection Handler
A read of what the reply actually means and three responses at different levels of directness, including the one that ends it politely.
- Prompt
InMail Writer
A subject line and body written for a paid message, preceded by an honest verdict on whether to spend the credit at all.
- Prompt
Meeting Prep Brief
A one-page brief you can read in the two minutes before a call, ending in the three questions that decide whether it goes anywhere.
Attach these once instead of retyping
A prompt is consumed once; a context file is read on every turn for months. These are the ones this work depends on.
- Context file
LINKEDIN-LIMITS.md
Your assistant stops proposing 300 connection requests a week, because it now knows the ceiling is about 100.
- Context file
PRODUCT.md
Messages stop describing features and start describing what changes for the person receiving them.
- Context file
OUTREACH.md
Every message an assistant writes comes out at the right length, in the right shape, with the openers you hate already banned.
- Context file
OBJECTIONS.md
The assistant answers the objection you actually get, in the way that has worked, instead of improvising.
- Context file
PERSONAS.md
Messages that speak to what the reader is measured on rather than to a job title.
These are steps in a longer job
From ICP to booked meeting runs 8 steps end to end, and several of them are on this page. Each step names what it hands the next one, which is the part a list of prompts cannot show.
LinkedIn will help you write the message. It will not help you send more of them
Both features here are editors: one drafts a first InMail inside Sales Navigator, the other refines a message before it goes. Neither raises a ceiling, and neither is on the plan most people sending LinkedIn outreach are actually on.
| What LinkedIn calls it | What it does | Availability | What unlocks it | What that costs |
|---|---|---|---|---|
| Message Assist | It drafts a first InMail to a lead. | Beta | Sales Navigator Advanced or Sales Navigator Advanced Plus | $159.99 a month, read from LinkedIn on 12 September 2026 |
| Message Proofreader | It refines a first message to a new connection or a recruiter, including an InMail, before you send it. | Available | Premium Career or Premium Business | $39.99 a month, read from LinkedIn on 10 September 2026 |
Feature names are LinkedIn's own, read from its help centre and product pages on 20 September 2026; the prices come from this site's plan records and carry their own read dates per product family. Availability is LinkedIn's word, not a measurement — a gradual rollout means some accounts have it and LinkedIn does not publish which. The full records, with the ceilings and what LinkedIn declines to disclose, are on the LinkedIn AI features page.
The sequencers send it themselves, and that is the whole difference
A prompt drafts; these send. Which means the activity arrives at LinkedIn as yours, from whatever machine the vendor runs it on — and LinkedIn’s Prohibited Software and Extensions policy names exactly this class and restricts the member account rather than the vendor. The route is the fact worth knowing, so it is the first column.
Narrow by design. The self-serve permissions cover sign-in, email address and posting on your own behalf; Pages, Ads and Sales Navigator partner access are granted through programmes rather than applied for, and nothing on the self-serve list returns people search or another member’s profile.
It reaches whatever the page in front of you shows, and nothing while the browser is closed. LinkedIn’s Prohibited Software and Extensions policy names extensions that automate the site, and enforcement lands on the member account.
The same reach as the extension class and the same clause against it, with one real difference: the session stays on your machine rather than in a vendor’s datacentre. The computer has to be awake for anything to run, and moving it to a rented server to fix that puts the traffic back on a datacentre IP.
The widest reach of any class and the highest exposure. It runs without you, the credential sits with somebody else, and every action is attributable to your account — which is also the thing LinkedIn can restrict.
Unknown, which is the point. Nothing in this directory treats an unread claim as a capability, and nothing treats an unanswered question as a reassurance.
| Tool | How it reaches LinkedIn | What it does with your account | Account exposure |
|---|---|---|---|
| Salesloft | Official API | Sends under your name | Low |
| Amplemarket | Chrome extension | Sends under your name | High |
| Linked Helper 2 | Desktop app | Sends under your name | High |
| Closely | Vendor cloud | Sends under your name | High |
| lemlist | Not established | Sends under your name | High |
One tool per route, alphabetically first within each, so nothing here reads as a pick — and exposure is derived from the route and whether the tool sends, not typed next to the vendor it flatters. All 17 in this group, filterable, are in the LinkedIn Outreach AI directory; every record was read from the vendor's own pages on 20 September 2026.
7 MCP servers reach LinkedIn messaging, and none of them does it through a route LinkedIn opened
LinkedIn’s Messages API exists and is restricted to approved partners, and its own documentation says a message must be tied to a member action, where member actions do not include an automated or scheduled event. So every server that sends is driving a session instead.
A hosted service whose meta-tools expose more than 160 LinkedIn actions, discovered at runtime, including Sales Navigator and Recruiter messaging. The ones that write reach a real account, behind a server-side preview-then-confirm gate.
The operational half of an outbound platform, driven from a chat window: audiences, campaign drafts, inbox triage and SQL over your own funnel. Most of its tools never touch LinkedIn, and none of them launches a campaign.
A paid cloud-browser service whose tools cover messaging, connections, search, fetching, posting, engagement and Sales Navigator, plus admin tools that let an agent manage seats and rate limits. The MIT repository alone does nothing without the vendor.
A self-hostable four-container outbound application whose MCP server is a route on your own instance. Its read tools touch nothing on LinkedIn; its write tools start real invitations, messages and scheduled posts under your name.
4 of the 7 servers filed under messaging and connections, ordered by account exposure, lowest first. That is an ordering, not a recommendation: LinkedIn publishes no MCP server of its own and its User Agreement prohibits automated access by any means, so the directory puts that clause beside each record rather than ranking them. Read 20 September 2026.
Where a prompt stops and a decision starts
Stated here rather than left for a reader to discover, because the gap between what a prompt does and what people expect it to do is where the time goes.
Nothing on this page touches LinkedIn. That is a property of the format, not a limitation being apologised for: a text file cannot get an account restricted, and the tools that can are described elsewhere on this site with the clause they sit against.
Roughly 100 a week, on every plan including Recruiter Corporate, and LinkedIn adjusts it per account based on acceptance rate — so a low-acceptance account gets less, never more. No message improves the ceiling; a better-targeted one improves the acceptance rate the ceiling is set from. The ceiling, and what moves it.
A vendor’s assurance about pacing is not a statement of LinkedIn policy, and Section 8.2 of the User Agreement carves out nothing for well-paced automation. The honest framing is that the risk is real and lands on the account, whatever the sending speed. What each sequencer does to the account it holds.
The questions people arrive with, answered directly
What is a good AI prompt for a LinkedIn connection request?
One that is given something real to reference and forbidden from inventing one. The connection note field is 300 characters, which is roughly two sentences: one specific, checkable reference to something the person said or shipped, and one reason to connect. A prompt that takes only a name and a job title will produce the message everyone ignores, because it is the message everyone sends.
How many LinkedIn messages can I send a week?
Invitations are the binding limit: roughly 100 a week on every plan, adjusted down per account when acceptance is low. InMail is separate and finite — it is a monthly credit allowance that varies by plan, credits expire after 90 days, and a credit comes back if the recipient replies within that window. Cadences here are built to fit both rather than to fill a calendar.
Will an AI outreach tool get my LinkedIn account restricted?
It can, and the exposure is not spread evenly. 18 of the 42 tools in the directory send under your name and 12 hold your session on their own servers, which is the arrangement LinkedIn’s enforcement is built around. 13 put no LinkedIn account behind them at all. This site describes those routes; it does not recommend taking one.
Can AI personalise outreach at scale?
It can personalise, and scale is the wrong axis. The bottleneck is not drafting — a model writes more good messages in an hour than the week has room for — it is the 100 invitations a week the platform allows, and the acceptance rate that decides whether that number holds. Spend the AI on picking who, and on the one reference that makes the message checkable.
Everything for outreach, in one folder
The Starter Pack bundles the twelve context files and the twelve most-used prompts as a zip — including the ones on this page. Free, and the ungated link sits under the form.