Connect LinkedIn to ChatGPT, and the part where it stops
ChatGPT takes an MCP server as a URL. Its connection dialog asks for an HTTPS endpoint speaking Streamable HTTP and has no field for a local command, so 8 of the 13 LinkedIn servers in this directory are reachable as they ship and the other 5 need Secure MCP Tunnel or a public proxy in front of them first. Only 2 of the reachable ones put no LinkedIn account behind the connection, so on ChatGPT the easy path is also the exposed one. Claude Desktop and Claude Code launch a local process from a config file and reach every record here. If you are picking a client for this job rather than already using one, that is the shorter route.
- Read from
- developers.openai.com ↗
- Last read
If you came for a profile-photo prompt, this is the wrong page and here is the right exit
Worth being blunt about. Pull Google's own completions for the phrase chatgpt linkedin and most of what comes back is a picture: profile photo prompt, profile picture prompt, headshot prompt. The integration demand this page serves sits one level down, in linkedin mcp for chatgpt, and it is a different question with a different answer. There are no image prompts anywhere on this site and none are planned — what it publishes is text prompts, context files and agent packs built on dated LinkedIn pricing and limits data. If the job is a headshot, nothing here helps. If the job is writing, the prompt library is the stop. If it is getting LinkedIn data in front of a model, keep reading.
Completions pulled from Google's autocomplete endpoint for that seed on 20 September 2026. The endpoint only returns a completion above a frequency threshold, so the shape of the set is evidence rather than an impression — and the same pull for claude linkedin returns integration terms end to end, which is why the Claude page is written as a setup guide and this one is not.
Paste a LinkedIn profile URL into ChatGPT and you get invention, because LinkedIn blocks its crawlers by name
This is the failure that sends most people looking for a plugin in the first place, and it is worse than a refusal: a model asked about a page it cannot fetch will often describe that page confidently rather than say it could not open it. The reason is published, machine-readable and one file long.
LinkedIn's robots.txt denies everything by default and then names the assistant crawlers in blocks that disallow the whole site. Both of OpenAI's are in that list — the training crawler and the one that fetches a page during a conversation — alongside every other major assistant and training crawler, Anthropic's and Google's included.
The 2 AI search crawlers LinkedIn does admit are given search-engine-style access and then separately blocked from /public-profile/, /people/search/, /people-guest/ — paths Googlebot and Bingbot are not blocked from. Index the marketing, stay out of the people.
An MCP tool fetches the page through a data vendor, through a signed-out request or through your own session, and hands back a result. That removes the invention. It does not remove LinkedIn's rules about automated access, which is the subject of the route page.
Parsed from LinkedIn robots.txt ↗ on 20 September 2026. LinkedIn publishes no llms.txt, so robots.txt, the User Agreement and the crawl-permission address in its header are the whole of its published position on machine access.
ChatGPT is 3 different places, and only 1 of them runs a server from your own machine
Almost every guide published about this treats ChatGPT as one product. It is a web application that takes a URL, a desktop application carrying a Codex host that takes a command or a URL from a TOML file, and a custom GPT that is not an MCP client at all. A LinkedIn server that works in one of them can be unreachable in another, and the reader finds out from an empty tool list.
| ChatGPT on the web and mobileChat and Work, through a plugin | The Codex hostChatGPT desktop app, Codex CLI, IDE extension | A custom GPTConnected apps or custom actions, never both | |
|---|---|---|---|
| Runs a local stdio server | Tunnel or proxy first | Yes | No |
| Takes a Streamable HTTP URL | Yes | Yes | Not an MCP client |
| Where the configuration lives | No file. A URL typed into the connection dialog at chatgpt.com/plugins. | ~/.codex/config.toml, or a project-scoped .codex/config.toml for trusted projects. | An action against an HTTP API, restricted to workspace-approved domains. |
| What has to be switched on | Developer mode, under Settings → Security and login. | None beyond the plan. The three clients share one configuration. | Workspace policy. With no approved domain, an action cannot execute. |
| LinkedIn servers it can reach | 8 of the 13 as they ship | All 13 | None of them |
The web and Codex rows are read from ChatGPT's own Model Context Protocol page, which states both halves plainly: the Codex host supports stdio servers started by a command as well as Streamable HTTP servers, and ChatGPT on the web does not read local Codex configuration files. The custom-GPT row is from the workspace admin page for GPTs and sharing. Both on 20 September 2026.
Everything below is from OpenAI's documentation rather than from a write-up of it
Each row names the page it was read from. Two of them are the reason this page reaches the conclusion it does — the URL-only connection dialog, and the fact that Developer mode turns on write tools rather than read tools — and one of them is an absence: no plan is named as a requirement anywhere in the flow, only a sentence saying availability can depend on account and workspace policy.
| What OpenAI publishes | In detail | Source |
|---|---|---|
| ChatGPT on the web takes an MCP server as a URL, and nothing else. | The connection step asks for the MCP server URL, including the /mcp path. The documentation states the endpoint requirement plainly: "A public endpoint supports streamable HTTP, typically at /mcp, or the tunnel can reach its configured stdio or HTTP MCP server." There is no field for a local command, so a server that only speaks stdio is not something this flow can be pointed at directly. | OpenAI on connecting and testing a plugin ↗ |
| It is behind Developer mode, and availability is not promised by plan. | The documented path is Settings, then Security and login, then turn on Developer mode. The same page adds one sentence that no third-party tutorial carries: "Developer mode availability can depend on account and workspace policy." It names no plan as a requirement and no plan as sufficient. | OpenAI on connecting and testing a plugin ↗ |
| Developer mode turns on write tools as well as read ones. | The plugin security guidance states it without hedging — "Developer mode enables full MCP access, including write tools" — and recommends validating every input server-side and requiring human confirmation for irreversible operations. On a LinkedIn server that matters more than it does elsewhere, because the irreversible operation is a message sent under a member name. | OpenAI on plugin security and privacy ↗ |
| A local server can be reached, but only through a tunnel or a proxy. | Secure MCP Tunnel connects a private MCP server in developer mode without exposing it to the public internet, and the alternative the documentation gives for a server that must stay private is "deploy a public HTTPS proxy that forwards MCP requests to the private server". Neither satisfies public plugin submission, which requires a stable public HTTPS endpoint supporting the MCP streamable HTTP transport. | OpenAI on building and deploying an MCP server ↗ |
| The Codex host inside the ChatGPT desktop app does take stdio. | The ChatGPT desktop app, Codex CLI and IDE extension are one Codex host sharing one configuration file, and its supported features list names STDIO servers started by a command, with environment variables, alongside Streamable HTTP servers with bearer-token and OAuth authentication. Configuration lives in ~/.codex/config.toml, or a project-scoped .codex/config.toml for trusted projects. The same page states that "ChatGPT web doesn’t read local Codex configuration files". | ChatGPT’s Model Context Protocol page ↗ |
| Plugins, connectors and MCP are listed on the paid plans; Free and Go are not in the table. | The feature-availability matrix compares ChatGPT Plus, ChatGPT Pro, ChatGPT Business, Enterprise / Education and an API key. Plugins, Connectors and MCP are marked available on all four plan columns, with plugins marked limited for an API key under the footnote "Some first party plugins are not available." Free and Go are priced elsewhere on the page and are not columns in that matrix, so it does not say either way about them. | ChatGPT’s feature-availability matrix ↗ |
| A custom GPT is a different mechanism, and it cannot hold both kinds of integration. | The workspace administration page for GPTs states that "GPT builders can use either connected apps or custom actions, but not both in the same GPT", that actions interact with permitted third-party APIs, and that domain approval gates them: "If no domains are allowed, custom GPT actions cannot execute." An action calls an HTTP API. It is not an MCP client, so nothing in this directory installs into one. | ChatGPT’s admin page for GPTs and sharing ↗ |
| Whatever a server returns, ChatGPT treats the service’s own terms as governing. | The plugins page states that "When ChatGPT sends data through an MCP server, that service’s terms and privacy policy apply", and that a workspace administrator can control which plugins and tools are available at all. Neither sentence is about LinkedIn, and both decide what happens when the server on the other end is driving a LinkedIn session. | ChatGPT’s plugins page ↗ |
| The community-maintained extension matrix lists ChatGPT for MCP Apps and partially for Skills. | MCP Apps is checked for ChatGPT alongside Claude, VS Code, Cursor, Goose and others. For Skills over MCP, ChatGPT is marked Partial, as are fast-agent and MCP Inspector; no client at all is checked for OAuth client credentials. The page states that the list is maintained by the community, so an empty cell means nobody filed a change rather than that a client refuses the feature. | The MCP project’s client extension matrix ↗ |
Both OpenAI documentation sites publish a Markdown twin of every page at the same address with .md appended, and every row above was read from that rather than from a rendered page or a summary of one. The research corpus committed with this site could not reach either host and says so; nothing here comes from it.
ChatGPT on the web: Developer mode, then a URL
There is no config file to edit and no block to paste, which is the one place this flow is simpler than every other client in the directory. What it costs is the local half of the directory: a server that starts as a command on your machine cannot be typed into this dialog.
- 1Pick a server that publishes an endpoint, not a command
A URL is the only thing the connection dialog accepts. 8 of the 13 servers in the directory ship a Streamable HTTP endpoint; the other 5 start as a local process and need Secure MCP Tunnel or a public HTTPS proxy in front of them before this flow can see them at all.
- 2Turn on Developer mode
Open Settings, select Security and login, turn on Developer mode. OpenAI’s own page adds that availability can depend on account and workspace policy, so a workspace administrator can remove the option without any error appearing in the client.
- 3Add the server at chatgpt.com/plugins
Select the plus button, enter a user-facing name and description, and under Connection enter the MCP server URL including the /mcp path — or select Tunnel and choose an available tunnel. Then review the tools and metadata discovered from the server.
- 4Read the tool list before the server holds a LinkedIn session
Developer mode enables full MCP access, including write tools, and a LinkedIn server’s write tools send messages and connection requests under your own name. Check what arrived, and check whether any of it can act, before an agent runs unattended.
The sequence is OpenAI's own, from its page on connecting and testing a plugin, read 20 September 2026. The same flow is written out against a public example server on the plugins quickstart, which is the safer place to confirm the dialog behaves before a LinkedIn credential is anywhere near it.
The Codex host takes a command, which puts all 13 back within reach
The ChatGPT desktop app, Codex CLI and the IDE extension share one MCP configuration, and that configuration accepts a local stdio server as well as a URL. This is where a reader who wants the no-credential servers — the signed-out reader, the vendor-key ones — installs them without standing up a tunnel. The command form below is OpenAI's own; so is the TOML.
codex mcp add <server-name> --env VAR1=VALUE1 --env VAR2=VALUE2 -- <stdio server-command>Verbatim from ChatGPT's Model Context Protocol page, read 20 September 2026. The same page gives codex mcp list for what is registered and codex mcp login <server-name> for a server behind OAuth, and says configuration lives in ~/.codex/config.toml or, for a trusted project, .codex/config.toml.
[mcp_servers.example]
url = "https://mcp.example.com"
[mcp_servers.example.oauth]
client_id = "my-client"
callback_url = "http://127.0.0.1/callback"Also verbatim from that page: what Codex writes for a remote server with a pre-registered OAuth client. It is the shape, not a server to install — the URL and client id are the documentation's placeholders. Take the real values from the profile page of whichever server you chose.
Linked API MCP ships a Codex command in its vendor documentation
Of the 6 servers naming ChatGPT, this is the only one whose own documentation carries a command for an OpenAI client rather than a sentence saying it is supported. Note what rides in the query string, and note that it is a Browser session server with High account exposure: the connection drives your own LinkedIn account.
codex mcp add linkedapi \
--url "https://mcp.linkedapi.io?linked-api-token={YOUR_LINKED_API_TOKEN}&identification-token={YOUR_IDENTIFICATION_TOKEN}&client=codex"Copied whole from the project's own documentation, not written here. Two long-lived tokens travel as URL query parameters, so they land in shell history and in any proxy log on the way — the full record, including what those tokens can do to the workspace behind them, is on its profile.
Which of the 13 ChatGPT can reach, and what each one holds while it does
The second column is derived from the transport each project publishes, not from its marketing: a server that only speaks stdio is not unreachable, it is reachable through Secure MCP Tunnel or a public HTTPS proxy, which is a piece of infrastructure rather than a setting. The third is the project's own claim about ChatGPT, quoted, because the claims differ in strength far more than a support matrix suggests.
| Server | From the ChatGPT connection dialog | What the project says about ChatGPT | Account exposure |
|---|---|---|---|
| Subio Scrape | Tunnel or proxy first — stdio only | Does not name ChatGPT anywhere | Low |
| Bright Data MCP (LinkedIn tools) | Directly, by URL — stdio and Streamable HTTP | Does not name ChatGPT anywhere | Low |
| Anysite MCP Server | Directly, by URL — stdio and Streamable HTTP | ChatGPT | Low |
| Insaight | Tunnel or proxy first — stdio only | Does not name ChatGPT anywhere | Low |
| LinkedIn Ads MCP Server | Tunnel or proxy first — stdio only | ChatGPT and Cursor are named in the repository description and the hosted tip, with no setup instructions in this repository | Medium |
| eliasbiondo/linkedin-mcp-server | Directly, by URL — stdio and Streamable HTTP | Does not name ChatGPT anywhere | Medium |
| stickerdaniel/linkedin-mcp-server | Directly, by URL — stdio and Streamable HTTP | Does not name ChatGPT anywhere | High |
| La Growth Machine MCP | Directly, by URL — Streamable HTTP | ChatGPT (per the vendor MCP page) | High |
| Linked API MCP | Directly, by URL — stdio and Streamable HTTP | ChatGPT (connector) | High |
| gtm-api/linkedin-mcp | Directly, by URL — stdio and Streamable HTTP | ChatGPT (through connectors) | High |
| LinkedGrow | Directly, by URL — Streamable HTTP | ChatGPT (connector settings: URL plus bearer token) | High |
| southleft/linkedin-mcp | Tunnel or proxy first — stdio only | Does not name ChatGPT anywhere | High |
| linkedincli | Tunnel or proxy first — stdio only | Does not name ChatGPT anywhere | High |
1 of the 6 that name ChatGPT is stdio-only, and the claim is worth reading in full before acting on it: LinkedIn Ads MCP Server names ChatGPT in its repository description and ships no setup instructions for it anywhere in the repository. A support claim on a README is not a tested path. Exposure is the registry's derived value, from the credential the server holds and whether it writes to LinkedIn — the rule is on the directory, applied identically to every row.
Every wall in the last three sections is ChatGPT's. These are LinkedIn's, and they hold whatever you connect
A reader who solves the transport problem has solved a transport problem. What a LinkedIn MCP server can reach is decided on LinkedIn's side, by a permission list most people assume is far longer than it is, and by one clause in the User Agreement that is written against automated access by any means.
LinkedIn's own access page lists exactly three permissions any developer can obtain without review: profile and email, through Sign In with LinkedIn using OpenID Connect, and w_member_social, through Share on LinkedIn. In practice an individual developer can get sign-in and posting on their own behalf, and nothing else. LinkedIn on getting API access ↗
Nothing on the public access list lets an application search members or read an arbitrary member's profile. That single gap is what separates the official servers in this directory from every other one. LinkedIn on getting API access ↗
It is restricted to approved partners, and the documentation states that "A message must be associated with a specific member action. Member actions do not include an automated or scheduled event." The member must be able to edit any prepared draft and take an affirmative action to send. The only message type is member-to-member; there is no InMail. The accurate statement is not that LinkedIn has no messaging API, but that the one it has is partner-gated and prohibits the thing an agent would do with it. LinkedIn’s Messages API documentation ↗
The agreement effective 3 November 2025 prohibits using bots or other automated methods to access the service, add or download contacts, send or redirect messages, or create, comment on, like, share or re-share posts. It separately prohibits software, scripts or robots used to scrape or copy the service, naming browser plugins and add-ons. Section 8.2 of the User Agreement ↗
Read from LinkedIn's own documentation and legal pages on 20 September 2026. The member-side ceilings are separate again and apply whether or not anything is connected — invitations a week, InMail allowances, the 2,500-result search cap — and they are on the LinkedIn limits page. Nothing on this page tells anyone to run a server against LinkedIn; it describes what each route reaches and what it exposes.
ChatGPT's built-in browser can sign in to LinkedIn, and that is the clause rather than a way around it
It deserves saying out loud, because it is the obvious workaround and it is the highest-exposure thing on this page. The built-in browser runs on a profile separate from your ordinary one and you sign in directly when a task needs an account. That makes it a driven browser session on your own LinkedIn account — the same class as the browser-driven servers in the directory, with the same clause pointed at it and none of their confirmation gates.
The browser is available in ChatGPT on the web and in the desktop app, keeps its own profile and history rather than sharing your regular browser session, and its documentation carries the instruction that matters here: treat page content as untrusted context, and review the site and the proposed action before allowing ChatGPT to act. ChatGPT's browser documentation ↗
Section 8.2 is written against automated methods rather than against any particular program, so a driven browser sits inside it exactly as a script does — and the consequence is not filed against the software. LinkedIn's prohibited-software page bars "bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages, create, comment on, like, share, or re-share posts, or otherwise drive inauthentic engagement", and states that members who use them risk having their accounts restricted or shut down. LinkedIn’s prohibited-software page ↗
A headline, an About section, a post body and an inbound message are all text a stranger wrote, arriving as context. The projects in this directory that take it seriously wrap tool results in an untrusted-content marker; a browser session does not. Subio Scrape goes as far as naming prompt injection a reportable vulnerability in its own security policy, in exactly those terms.
What to do next, by what you were actually trying to do
None of them is “install the most popular one”. The credential decides the ceiling and who carries the consequence, and ChatGPT's transport decides which of those credentials you can reach without extra infrastructure.
The part that works on ChatGPT. Anysite MCP Server publishes a hosted endpoint and takes a vendor key rather than a LinkedIn login, so it drops straight into the connection dialog. Bright Data MCP (LinkedIn tools) also runs remote and is the same trade: the exposure moves from your account to a vendor's relationship with LinkedIn. Both are on the directory with what they cost and what they hold.
The servers built for this — including stickerdaniel/linkedin-mcp-server, which carries the most GitHub stars of the 13 here, 3,551 on 20 September 2026, a count of attention rather than installs — are local stdio processes driving a browser signed in as you. On ChatGPT that means the desktop app's Codex host or a tunnel, and either way it means a client that can read your entire inbox and send under your name. The route page carries what that costs.
A live connection is not the only way to get LinkedIn work out of ChatGPT, and for a large share of it the paste is better: no server, no credential, nothing that can be restricted. The prompt library and the rest of the toolkit are built on the same dated limits data as the tables here, so a plan a model hands back is one an account can survive.
The questions people arrive with, answered directly
Can ChatGPT connect to LinkedIn?
Only through a third-party MCP server you add yourself, and only one that publishes a URL. LinkedIn ships no MCP server and no ChatGPT connector, so there is nothing on its side to connect to. On ChatGPT's own side the connection dialog accepts an HTTPS endpoint speaking Streamable HTTP and has no field for a local command, which is why 8 of the 13 servers in this directory are reachable as they ship and 5 need a tunnel or a proxy first. ChatGPT also cannot simply read a LinkedIn URL you paste: LinkedIn's robots.txt blocks GPTBot and ChatGPT-User outright.
Is there a LinkedIn plugin for ChatGPT?
Not one LinkedIn publishes. 6 of the 13 servers in this directory name ChatGPT among their supported clients, all of them built by someone else, and 5 of those put your own LinkedIn account behind the connection. What each one claims is in the table on this page, quoted in the project's own words rather than ours — because one of them names ChatGPT in a repository description and ships no setup instructions for it anywhere.
What do I need to turn on before ChatGPT will take an MCP server?
Developer mode: Settings, then Security and login, then Developer mode. OpenAI’s documentation adds that availability can depend on account and workspace policy, and its feature-availability matrix lists Plugins, Connectors and MCP as available on ChatGPT Plus, Pro, Business and Enterprise or Education. Free and Go are not columns in that matrix, so it makes no statement about them either way. Developer mode also enables full MCP access including write tools, which on a LinkedIn server means the tools that send.
Can a custom GPT read LinkedIn profiles?
No, and there are two separate walls rather than one. A custom GPT uses connected apps or custom actions and cannot hold both in the same GPT; an action calls an HTTP API, not an MCP server, so nothing in this directory installs into one. Point an action at LinkedIn’s own API instead and the second wall arrives: no permission on LinkedIn’s self-serve list lets an application search members or read an arbitrary member’s profile, and the list is sign-in, email and posting on your own behalf. A workspace also has to approve the domain before an action can execute at all, so in a managed workspace the question is settled before either wall is reached.
Why does ChatGPT invent things when I paste a LinkedIn profile URL?
Because it has nothing to read. LinkedIn's robots.txt denies everything by default and names GPTBot and ChatGPT-User in blocks that disallow the whole site. OAI-SearchBot and Claude-SearchBot are admitted with search-engine-style access and then separately shut out of /public-profile/, /people/search/, /people-guest/ — paths the traditional search engines are not blocked from. A model asked about a page it cannot fetch produces a confident description of a page it has not seen. An MCP server changes that by fetching the page itself and handing back the result as a tool output.
ChatGPT or Claude for LinkedIn work?
For this one job, Claude, and not by a small margin. Claude Desktop and Claude Code launch a local process from a config file, so every server in the directory is reachable there, including the ones that hold no LinkedIn credential at all. ChatGPT on the web takes a URL, which leaves 8 of the 13 reachable directly and only 2 of those putting no LinkedIn account behind them — so the easy path on ChatGPT is also the higher-exposure one. The ChatGPT desktop app closes the gap, because its Codex host does take stdio servers from a config file. If you are choosing a client for this, the setup is on the Claude page.
I wanted a ChatGPT prompt for my LinkedIn profile photo.
Most people searching this phrase do, and this page is not that. There are no image prompts anywhere on this site: what it publishes is text prompts, context files and agent packs built on dated LinkedIn pricing and limits data, plus this directory of MCP servers. The prompt library is the right stop if the job is writing rather than a headshot.
Does ChatGPT’s built-in browser get around the block?
It is a different route rather than a way around the same one, and it lands in the clause every server on this site sits under. The built-in browser runs on a profile separate from your regular browser, and you sign in directly when a task needs an account — which makes it a driven browser session on your own LinkedIn account, the same class as the browser-driven servers in this directory and without their confirmation gates. Section 8.2 of the User Agreement is written against automated methods rather than against any particular program, and LinkedIn’s prohibited-software page says a member who uses one risks having the account restricted or shut down. ChatGPT’s own documentation adds the other half: treat page content as untrusted context, and review the site and the proposed action before allowing it to act.
The two current transports are stdio and Streamable HTTP. HTTP+SSE, the transport most published guides still describe, is in the specification's registry of deprecated features with a migration path to Streamable HTTP — The specification’s deprecated-features registry ↗. That is why the connection dialog asks for the shape it asks for, and why a guide offering an SSE endpoint as the way in is describing the previous model rather than a choice.
The Codex configuration fields, so a server's own block can be read rather than copied blind
Quoted from the configuration reference rather than assembled into an example file. A TOML block written here to look complete would be a config nobody at OpenAI has run, which is the failure this section exists to prevent: every field below is under [mcp_servers.<id>], and the first four are the stdio half while the next three are the HTTP half.
| Field | Type | What it does |
|---|---|---|
command | string | Launcher command for an MCP stdio server. |
args | array<string> | Arguments passed to the MCP stdio server command. |
env | map<string,string> | Environment variables forwarded to the MCP stdio server. |
cwd | string | Working directory for the MCP stdio server process. |
url | string | Endpoint for an MCP streamable HTTP server. |
bearer_token_env_var | string | Environment variable sourcing the bearer token for an MCP HTTP server. |
http_headers | map<string,string> | Static HTTP headers included with each MCP HTTP request. |
enabled_tools | array<string> | Tool allow list. |
disabled_tools | array<string> | Tool deny list (applied after enabled_tools). |
default_tools_approval_mode | auto | prompt | writes | approve | Default approval behavior for tools from this server. The writes mode prompts for tools that aren’t marked read-only. |
Field names and descriptions quoted from the Codex configuration reference, read 20 September 2026. The last three are the ones worth setting on a LinkedIn server before an agent runs unattended: an allow list, a deny list, and an approval mode that prompts for every tool not marked read-only.
Pick the client for the job, then the credential
ChatGPT reaches 8 of the 13 directly, and 2 of those hold no LinkedIn credential at all. Claude Desktop and Claude Code reach every record here from a config file. If the client is not already settled, that is the shorter route; if it is, the credential the server holds still decides more than the client does.