linkedincli

The same reach as a browser session and the same clause against it, with two additions: the session is a credential equivalent to full account access wherever it is stored, and it is invalidated whenever LinkedIn decides the client does not look like a browser.

The server writes to LinkedIn as you, over a route LinkedIn does not sanction. Automated messages and connection requests under a member’s own name are what the enforcement is built to catch, and the account is what it acts on.

You supply your own live LinkedIn session. The documented and supported route reads it out of a local Chrome profile with a login command, which needs a local SQLite binary and prompts for a keychain unlock on first run; it works on macOS and Linux but not on Windows, where Chrome 127 and later block it. The session can also come from environment variables or a stored config file written by the login command. Sessions expire after a few weeks and can be invalidated immediately if the client does not look enough like Chrome — see the risk note, which is the project's own flagship open issue.

Light and local. Node.js 18 or newer and npm — that is the whole mandatory stack. No Docker, no Python, no headless browser or Playwright, no paid API key, no hosted account, no database, no server. Optional, local-only, and needed in practice for sessions to survive: a SQLite binary for the Chrome import, and a browser-impersonating curl build for the transport workaround. Windows cannot use the Chrome import at all.

Claude Code; Cursor; Windsurf; OpenClaw; Any MCP client that can launch a local stdio server. Where the file goes in each Claude surface. The same block in Cursor.

stdio only. The client launches the installed command as a local process, which is the only arrangement the project supports — it forbids running on a server.

Local machine only, and the README says so at length. A section titled "Local harness only" forbids cloud deployment: a live LinkedIn session must run on the operator's own computer, and cloud agents or remote runners may only install the CLI or call a server already running on that local machine.

No Sales Navigator tool, surface or lead-list capability exists anywhere in the source. People search hits the standard consumer search, not a Sales Navigator one.

No Recruiter tools, no project or pipeline management, no candidate sourcing beyond ordinary people search.

This drives a real personal LinkedIn account through LinkedIn's private, undocumented internal API, using a session taken from your own browser. It is not an official integration, and the repository's own disclaimer states it "is not affiliated with or endorsed by LinkedIn" and that "the authors are not responsible for any account restrictions that may result from automated usage". The write actions carry the account risk: posting, commenting, reacting, sharing, sending and accepting connection requests, and sending messages all happen under your own name and are indistinguishable from you acting personally. Automated connection requests and messaging are the classic triggers for restrictions, and the tool ships no rate limiting, no throttling, no dry-run mode and no confirmation step — an agent can loop a connection request or a new message as fast as the server answers. The read actions carry less risk but still collect LinkedIn data in a way the User Agreement prohibits. Separately, session stability is a documented, unresolved problem: the default HTTP client presents a network fingerprint that is not Chrome, and LinkedIn frequently detects it and invalidates the session on the first call. The maintainer's two mitigations are explicitly opt-in workarounds, and an open issue reports them still failing on Windows.

The credential is a full LinkedIn session, which is equivalent to full account access: anyone holding it can act as the member without a password or a second factor. It is stored in plaintext in a config file in your home directory, and the README's own client config example puts it in the client's environment block, meaning it typically ends up in a plaintext editor or agent config file that may be synced or committed. There is no encryption at rest and no keychain storage for the tool's own config. To the maintainer's credit: the values are never printed to standard output or error, redirects are never followed so an expired session surfaces as a 3xx rather than leaking through a login redirect, a verify command classifies login and challenge redirects as an invalid session, and the project's central security stance is architectural — the README and its agent guide both insist the session must never leave the local machine and must not be placed in a cloud or remote-runner environment.