gtm-api/linkedin-mcp

It can reach everything you can, which is the point and the problem. Section 8.2 of the User Agreement bars bots and scraping by any means, and enforcement lands on the account rather than on the software.

The server writes to LinkedIn as you, over a route LinkedIn does not sanction. Automated messages and connection requests under a member’s own name are what the enforcement is built to catch, and the account is what it acts on.

A gtm-api account plus a LinkedIn account connected inside the vendor dashboard. You never paste a LinkedIn cookie or password into the MCP client. The MCP credential is either the OAuth consent flow, where there is no key to paste, or a vendor API key sent as a bearer header or read from an environment variable. One mode per connection: with a key attached, the OAuth flow never starts. The connected LinkedIn account is opened in a vendor-run anti-detect cloud browser with a dedicated proxy, which is why this is filed as a browser server.

Nothing local on the default path: no Docker, no Node, no browser, no local LinkedIn session. What it does require is a hosted account — the free plan allows one connected account with no card — and a LinkedIn account connected through the vendor dashboard, which opens it in a vendor-run anti-detect cloud browser with a dedicated proxy. Node and npx are needed only for the stdio launcher, Docker only for the container variant. The Sales Navigator and Recruiter tools need the corresponding paid LinkedIn seat on the connected account.

Claude Desktop; Claude Code; Claude API; ChatGPT (through connectors); Cursor; LangChain; n8n; Any MCP-compatible client; a typed REST API with webhooks is offered as an alternative surface. Where the file goes in each Claude surface. The same block in Cursor. What a ChatGPT connector can and cannot reach.

streamable-http against the remote endpoint; stdio through the launcher, which bridges to it.

A managed service at a remote endpoint. An npx or Docker launcher exists for stdio-only clients, but it bridges to that same endpoint.

Six dedicated tools rather than reused generic ones: Sales Navigator people search, company search, parameter lookup, message send, latest messages and attachment download. A Sales Navigator seat on the connected account is required; the server does not supply one.

Four tools, search and messaging oriented: Recruiter people search, parameter lookup, message send and latest messages. Recent commits add contract-identifier filters to conversation and activity-log search. A Recruiter seat on the connected account is required.

Every write action here runs on a personal LinkedIn account you own, and LinkedIn's User Agreement does not permit third-party automation. The README says this itself, and says no vendor can promise otherwise. Account loss is the real downside, and it falls on you, not the vendor. The write actions are the risk surface; the read actions carry far less. The mitigations are vendor-side, real and unaudited: one isolated anti-detect cloud browser and dedicated proxy per account, programmatic warm-up from a fraction of the platform maximum, per-action daily budgets checked before dispatch across sixteen buckets, randomised pacing between bulk actions, and a mandatory preview-then-confirm step on every outward action. The advertised ban-rate figure is explicitly self-reported and cannot be independently checked, so it is not repeated here. One documented failure mode: the connection-request tool is not idempotent, and a second send while a request is pending returns 409.

The repository's SECURITY.md covers vulnerability disclosure only — where to report, no public issues, receipt confirmed within three business days, reporters credited unless they decline. It says nothing about credential handling, token storage or data retention. Structurally, the LinkedIn session lives on the vendor's infrastructure, so the vendor holds the account session, the message history and the scraped data. The Docker config mounts a named volume for the OAuth token cache. Bearer-token mode puts a long-lived key in a client config file or an environment variable.