Posting and engagement — read 20 September 2026

southleft/linkedin-mcp

It layers credentials rather than picking one: official OAuth for posting and analytics, a browser session for messaging and search, and a paid scraper API for research. The session path is what carries the account risk. Four credentials at once. Posting and analytics run on your own LinkedIn developer app; messaging, connections and search run on a session taken from a signed-in browser.

High account riskStalev0.2.0

Source: github.com/southleft/linkedin-mcp ↗
Last read: 20 September 2026

✓ Read from the repository, not from a directory listing✓ Write actions separated from read actions✓ Status derived from the last code change, not the maintainer's word✓ Every source URL published below

83 tools registered

23 write to LinkedIn

41 GitHub stars, 20 September 2026

2 clients documented

Where it fits

What it is built for, and the jobs it cannot do

The second card is the one a repository README never contains. Both are written from the project's own documentation and source, read on 20 September 2026.

Use it for

A single operator who wants Claude to draft, schedule and publish content on their own LinkedIn account, then read back first-party analytics on how it performed — the content loop the README explicitly designs for. Also reasonable for one-off profile and company research if you are willing to pay for a scraper plan.

Do not use it for

Outbound at volume. There is no Sales Navigator, Recruiter, Premium or InMail support of any kind. Bulk connection requests and mass messaging are exactly what the README tells you not to do, and the tools that would do it run on an extracted browser session. Also not for teams or unattended servers: stdio-only against a local checkout, remote deployment is an unmerged pull request, and the default branch has had no commit since March 2026.

Publisher: Southleft, LLC — a front-end web development agency, publishing one of its 31 public repositories — not affiliated with LinkedIn or Microsoft.
Licence: MIT — open source
Version: 0.2.0
Runs: Self-hosted
Transport: stdio
Repository: github.com/southleft/linkedin-mcp
Last read: 20 September 2026

Hosting and transport are as the project documents them: Runs from a local source checkout over stdio. Docker files exist in the repository but the README never mentions them, and remote or headless deployment is an unmerged pull request.

Authentication — the thing that decides everything else

Four credentials at once. Posting and analytics run on your own LinkedIn developer app; messaging, connections and search run on a session taken from a signed-in browser.

A session taken from your own signed-in browser, replayed against the internal API the LinkedIn website itself uses.

What this route cannot do, however well the server is written

The same reach as a browser session and the same clause against it, with two additions: the session is a credential equivalent to full account access wherever it is stored, and it is invalidated whenever LinkedIn decides the client does not look like a browser.

High account risk

The server writes to LinkedIn as you, over a route LinkedIn does not sanction. Automated messages and connection requests under a member’s own name are what the enforcement is built to catch, and the account is what it acts on.

It holds more than one credential

Alongside the class above it also uses OAuth 2.0 and Vendor API key and Browser session. The class this page files it under is the one that carries the risk, not the one the README leads with.

What it does with the credential

The README carries a required-accounts table with four rows: a LinkedIn account, required; a LinkedIn developer app, required, covering posting, analytics and profile data through OAuth; a RapidAPI account with API subscriptions, marked highly recommended, covering profile and company research, search and articles; and browser session data, marked optional. A separate feature matrix marks that last one as required rather than optional for messaging, connection management and job search. A Playwright browser is listed as a fifth, optional row, used as an automation fallback. The developer app must be associated with a Company Page and carry the Share and Sign In products; the Community Management API is needed for comments and reactions, and the README notes its approval can take days. Session data is pulled from a signed-in desktop browser with a command the project ships, and the README says it needs refreshing every 24 to 48 hours.

Account risk is derived from the authentication class and from whether the server writes to LinkedIn — not judged per project. The 5 classes and the rule that maps them are on the LinkedIn MCP server directory; the ceilings LinkedIn enforces on any account, automated or not, are on LinkedIn limits. What this particular server exposes, and what it does with your credentials, is below.

Exposed tools

23 of its 23 write actions land on LinkedIn under your own account

These are the tool names the server registers, as a client sees them. An assistant can call any tool the server exposes once it is connected, so the list below is the whole surface, not a feature summary.

get_my_profile
get_profile
get_profile_contact_info
get_profile_skills
get_similar_profiles
get_profile_articles
get_profile_views
get_network_stats
batch_get_profiles
update_profile_headline
update_profile_summary
upload_profile_photo
add_profile_skill
get_company
get_company_by_domain
get_company_updates
get_school
search_people
search_companies
search_jobs
search_ads
get_job
get_conversations
get_conversation
send_message
get_invitations
send_connection_request
reply_invitation
remove_connection
create_post
create_image_post
create_video_post
create_document_post
create_poll
edit_post
delete_post
create_comment
delete_comment
create_reaction
delete_reaction
mark_conversation_as_seen
upload_background_photo
create_draft
publish_draft
schedule_post
get_feed
get_post_analytics
analyze_engagement
analyze_optimal_posting_times
generate_engagement_report
get_auth_status
check_browser_automation_status

52 of the 83 tools it registers are named above. An abridged list. A CAPABILITIES.md in the repository enumerates 83 tools across 14 categories; the names above are the ones a reader is most likely to reach for.

What it can read

11 read actions, written as what they return rather than as the tool signature.

Your own profile, another profile, its contact information, skills, interests, articles and similar profiles.
Profile views, network statistics, a batch profile fetch and a profile-completeness score.
Company by name or domain, company updates, organisation followers, and school lookup.
People, company and job search; the LinkedIn Ad Library by advertiser or keyword.
Job details and job skill matching.
Your conversations, one conversation, and its details.
Your incoming invitations.
A post's reactions and comments; your feed and a profile's posts.
Post analytics, engagement analysis, content-performance analysis, optimal posting times, audience and hashtag analysis, and a generated engagement report.
Your drafts and scheduled posts, and a draft content analysis.
Authentication status, rate-limit status, cache statistics and browser-automation status.

What it can write, and where the write lands

23 of the 23 write actions land on LinkedIn itself. Those are the rows that carry the account risk: an automated message, invitation, post or campaign change is activity under your own name, and Section 8.2 of the User Agreement bars sending it by automated means. Section 8.2 of the User Agreement ↗

Action	Where it lands	What it does
`create_post`	Your LinkedIn account	Publishes a text post, through the official API.
`create_image_post`	Your LinkedIn account	Publishes an image post, through the official API.
`create_video_post`	Your LinkedIn account	Publishes a video post, through the official API.
`create_document_post`	Your LinkedIn account	Publishes a document post, through the official API.
`create_poll`	Your LinkedIn account	Publishes a poll.
`edit_post`	Your LinkedIn account	Rewrites one of your published posts.
`delete_post`	Your LinkedIn account	Deletes one of your posts.
`publish_draft`	Your LinkedIn account	Publishes a stored draft immediately.
`schedule_post`	Your LinkedIn account	Schedules a post for a later slot.
`create_comment`	Your LinkedIn account	Publishes a comment. Needs Community Management API approval.
`delete_comment`	Your LinkedIn account	Deletes one of your comments.
`create_reaction`	Your LinkedIn account	Reacts to a post. Needs Community Management API approval.
`delete_reaction`	Your LinkedIn account	Removes a reaction.
`send_message`	Your LinkedIn account	Sends a message. Runs on the browser session, not the official API. The README states that "LinkedIn's terms of service prohibit automated mass messaging".
`mark_conversation_as_seen`	Your LinkedIn account	Marks a thread read, which the other party can see.
`send_connection_request`	Your LinkedIn account	Sends a connection request on the browser session. The README: "Sending mass requests violates LinkedIn's terms and damages your professional reputation."
`reply_invitation`	Your LinkedIn account	Accepts or ignores an incoming invitation.
`remove_connection`	Your LinkedIn account	Removes an existing connection.
`update_profile_headline`	Your LinkedIn account	Changes your own headline.
`update_profile_summary`	Your LinkedIn account	Changes your own summary.
`upload_profile_photo`	Your LinkedIn account	Replaces your profile photo.
`upload_background_photo`	Your LinkedIn account	Replaces your background photo.
`add_profile_skill`	Your LinkedIn account	Adds a skill to your profile.

Read the middle column before the third. A write that lands off LinkedIn — a vendor workspace, a CRM, a local file — is undone by deleting a row. A write that lands on LinkedIn has already been seen by another member.

Setup — hard

Installing it, in the project's own commands

Every command and every configuration block below is the project's own, copied unchanged on 20 September 2026. Where a project publishes no config block, this page says so rather than composing one — a snippet written here would be a snippet the maintainer never tested.

From source

Shell

git clone https://github.com/southleft/linkedin-mcp.git
cd linkedin-mcp
uv venv && source .venv/bin/activate
uv pip install -e .

git clone https://github.com/southleft/linkedin-mcp.git
cd linkedin-mcp
uv venv && source .venv/bin/activate
uv pip install -e .

There is no published package and no hosted endpoint; the client config points at a path inside your own checkout.

Optional browser fallback

Shell

playwright install chromium

playwright install chromium

Authenticate

Shell

linkedin-mcp-auth oauth
linkedin-mcp-auth oauth --community-management
linkedin-mcp-auth extract-cookies --browser chrome
linkedin-mcp-auth status

linkedin-mcp-auth oauth
linkedin-mcp-auth oauth --community-management
linkedin-mcp-auth extract-cookies --browser chrome
linkedin-mcp-auth status

The third command takes a session out of a signed-in desktop browser. The README says that session needs refreshing every 24 to 48 hours.

The configuration block

Client config keys are not interchangeable, and a block pasted under the key a different client expects fails silently rather than erroring. That is why the blocks below are the project's own, in the clients it names, rather than one block normalised here.

Local clone

JSON

{
  "mcpServers": {
    "linkedin": {
      "command": "/path/to/linkedin-mcp/.venv/bin/python",
      "args": ["-m", "linkedin_mcp.main"],
      "cwd": "/path/to/linkedin-mcp",
      "env": {
        "LINKEDIN_CLIENT_ID": "your_client_id",
        "LINKEDIN_CLIENT_SECRET": "your_client_secret",
        "LINKEDIN_API_ENABLED": "true",
        "THIRDPARTY_RAPIDAPI_KEY": "your_api_key",
        "PYTHONPATH": "/path/to/linkedin-mcp/src",
        "LOG_LEVEL": "INFO"
      }
    }
  }
}

{
  "mcpServers": {
    "linkedin": {
      "command": "/path/to/linkedin-mcp/.venv/bin/python",
      "args": ["-m", "linkedin_mcp.main"],
      "cwd": "/path/to/linkedin-mcp",
      "env": {
        "LINKEDIN_CLIENT_ID": "your_client_id",
        "LINKEDIN_CLIENT_SECRET": "your_client_secret",
        "LINKEDIN_API_ENABLED": "true",
        "THIRDPARTY_RAPIDAPI_KEY": "your_api_key",
        "PYTHONPATH": "/path/to/linkedin-mcp/src",
        "LOG_LEVEL": "INFO"
      }
    }
  }
}

What it needs before it will start

Python 3.11 or newer and the uv package manager, installed from a source clone. A Chromium install is optional, for the browser fallback and the headless message transport added in March 2026. No published package, no npx one-liner, no hosted endpoint. Docker is available but undocumented: three Docker files sit in the repository root and the README never mentions any of them. A paid RapidAPI subscription is effectively required for the research tools to be useful beyond the free tier.

Clients the project documents

Claude Desktop; Claude Code. Where the file goes in each Claude surface.

How it talks to the client

stdio only. The Docker Compose file exposes an HTTP port, but nothing in the documentation covers it.

Where the process runs

Runs from a local source checkout over stdio. Docker files exist in the repository but the README never mentions them, and remote or headless deployment is an unmerged pull request.

What it costs to run

The vendor's own figures, quoted rather than computed

The server itself is free and MIT-licensed. The paid dependencies are RapidAPI subscriptions, quoted in the README as: a professional network data API at free for limited requests, $50 a month for search and higher limits, $175 for higher rate limits and $500 for the highest; and a fallback LinkedIn data API at around $10 and around $45 a month. These are the README's own figures as of 20 September 2026 and were not independently checked against the marketplace.

Sales Navigator — Not supported

Not supported. The term does not appear anywhere in the README.

Recruiter — Not supported

Not supported. Neither Recruiter nor InMail appears in the README. The job tools are limited to public job search and job detail lookups, over the browser-session path.

None of the figures above are LinkedIn's. They are third-party prices in the currency and the tiering each project publishes, read on 20 September 2026 and quoted rather than converted.

Repository signals, read 20 September 2026

Nobody has changed the code in months

179 days between the last code change and the day these figures were read. Between 90 days and a year since the last code change. It may still work; nobody has checked.

How far the project has got

Created December 2025; the latest changelog entry is 0.2.0 in February 2026. No commits on the default branch in roughly six months, with eight open pull requests including the one that would add remote deployment.

How this status was decided

Active means code changed within 90 days of the observation date; stale means up to 365 days. It is measured from the last change to code, not to the README, and never from the maintainer's own adjective. Anything past a year is dropped from this directory rather than published as dormant.

Stars: 41 — 8 forks, 0 watchers.
Last commit: 25 March 2026 — On the default branch. The API's pushed_at of August 2026 is four seconds after a Dependabot pull request was opened, so it records a push to a PR branch rather than a commit on the default branch.
Open issues: 1 — The API's count of 9 includes 8 open pull requests: seven Dependabot version bumps and one feature branch adding remote and headless deployment, all unmerged.
Status: Stale
Observed: 20 September 2026

Every figure in this section was read from GitHub on 20 September 2026, and star and issue counts move daily. The issue count is the Issues tab, not the API field of the same name — that one counts pull requests as issues and overstates every repository in this directory.

Credential handling and known problems

What to check before you point it at a real account

Both cards below are read from the repository and its own security documentation. A project saying what it does with a session is evidence of intent, not proof of behaviour.

What running it exposes

Account risk is concentrated in the write tools, which act as the connected personal account. Posting, commenting and reacting go through LinkedIn's official OAuth APIs, so they are sanctioned but rate-limited and tied to app approval. Messaging, connection management, job search and people search do not use an official API: they run on a session taken from a signed-in browser, with a headless-browser fallback. The README states that the session-based paths are "prone to LinkedIn's bot detection" and that the session needs refreshing every 24 to 48 hours. It also states plainly: "Messaging features are designed for maintaining existing professional relationships. LinkedIn's terms of service prohibit automated mass messaging", and, on connections, "Sending mass requests violates LinkedIn's terms and damages your professional reputation." In practice: any write executed over the session path carries a restriction or ban risk on the personal account whose session was taken.

How it handles your credentials

The README states that OAuth tokens are "Stored securely in system keychain", session data in "Encrypted local storage", credentials come from "Environment variables only", and there is "No data collection: Everything runs locally". Two caveats. Claude Desktop does not read environment files, so the documented setup puts the client secret and the RapidAPI key in plaintext inside the client config. And the undocumented Docker Compose file passes a LinkedIn username and password as environment variables — raw account credentials, a model the current README's flow no longer uses; that file appears stale relative to the rest of the project.

2 things that will waste an hour

Small, checkable and specific to this project — a stale package name, a broken link, a manifest that advertises something the code removed.

Three Docker files and a Compose service exist with no README coverage, and the Compose file's credential model contradicts the documented one.
The default branch has had no commit since March 2026, while eight pull requests sit unmerged.

If this is not the one

The servers that do a comparable job, and how they differ

Same rows, same sources, same observation date. The first column is this server.

southleft/linkedin-mcp compared with its alternatives
	southleft/linkedin-mcpv0.2.0	linkedincliv0.1.6	LinkedGrowv2.0.0
Authenticates with	Session cookie	Session cookie	Browser session
Account risk	High	High	High
Writes to LinkedIn	23 actions	17 actions	5 actions
Tools registered	83	43	26
Sales Navigator tools	No	No	No
Recruiter tools	No	No	No
Runs	Self-hosted	Self-hosted	Either
Last code change	25 March 2026 — stale	22 August 2026 — active	14 September 2026 — active
Licence	MIT, open source	MIT, open source	AGPL-3.0, open source

linkedincli
Session cookie
Profile data, the feed, messaging, connections and engagement, on a session taken from your own browser. No rate limiting, no throttle, no dry run and no confirmation step, and the maintainer forbids running it on a server.
High riskActive
stdio43 toolsRead 20 September 2026
LinkedGrow
Browser session
A self-hostable four-container outbound application whose MCP server is a route on your own instance. Its read tools touch nothing on LinkedIn; its write tools start real invitations, messages and scheduled posts under your name.
High riskActive
Streamable HTTP26 toolsRead 20 September 2026

Provenance

Every page this profile was read from

8 pages — the repository, its documentation and, where one exists, the vendor's own pricing page. Nothing on this profile is summarised from another directory or from a blog post about the project.

All of them read on 20 September 2026. A repository moves faster than a price does: if a tool list or a command here no longer matches the project, the project changed and this page has not been re-read yet.

Where to next

Read the write table before you connect it

23 of this server's actions land on LinkedIn under your own account, on a session cookie. That is high account risk, and the account is what enforcement acts on.

Compare all 13 serversGrouped by what each one hands LinkedIn, not by star count.The limits LinkedIn enforcesWhat any account can do in a week, automated or not.

southleft/linkedin-mcp

What it is built for, and the jobs it cannot do

Four credentials at once. Posting and analytics run on your own LinkedIn developer app; messaging, connections and search run on a session taken from a signed-in browser.

23 of its 23 write actions land on LinkedIn under your own account

What it can read

What it can write, and where the write lands

Installing it, in the project's own commands

From source

Optional browser fallback

Authenticate

The configuration block

Local clone

The vendor's own figures, quoted rather than computed

Nobody has changed the code in months

What to check before you point it at a real account

2 things that will waste an hour

The servers that do a comparable job, and how they differ

linkedincli

LinkedGrow

Every page this profile was read from

Continue researching

Read the write table before you connect it