identifier: gtm-api-linkedin\nname: gtm-api-linkedin\nversion: 1.0.0\nauthor: gtm-api\nauthorUrl: https://github.com/gtm-api\nhomepage: https://gtm-api.com/linkedin-mcp-server/\nrepository: https://github.com/gtm-api/linkedin-mcp\nicon: https://gtm-api.com/wp-content/themes/gtm-api/assets/img/icon-hdr-512.png\nlicense: MIT\ntags:
\nLinkedIn publishes no public API for invitations, member messages or open profile search. The\nmanaged server at mcp.gtm-api.com exposes those actions as MCP tools running against a LinkedIn\naccount the user connected and controls, with pacing and limits enforced on the server before\nanything reaches LinkedIn.
Read this before your first call. The two mistakes that cost the most are guessing tool names\ninstead of discovering them, and retrying an action the limit check just rejected.
\nUse it when the task names LinkedIn and needs an action taken or data pulled: find people or\ncompanies, send or accept connection requests, send messages, read the inbox, enrich a profile,\nreact to or comment on posts, or report what an account is still allowed to do today.
\nDo not use it to operate an account the user does not own. There is no shared account pool, and\nevery action is attributed to the connected account.
\nThe endpoint is https://mcp.gtm-api.com/mcp over streamable HTTP. The user needs an account at\napp.gtm-api.com with a LinkedIn account connected. There is a free plan and no card is required\nto reach a working connection.
Two auth modes, and they must not be mixed.
\nOAuth, for interactive clients. Point the client at the URL with no credential. The first call\nreturns a WWW-Authenticate challenge, the client registers itself, and a consent page opens in\nthe user's browser.
![https://gtm-api.com/wp-content/themes/gtm-api/assets/img/icon-hdr-512.png](\"https://gtm-api.com/wp-content/themes/gtm-api/assets/img/icon-hdr-512.png\"){kind=link}
{\n \"mcpServers\": {\n \"gtm-api\": { \"url\": \"https://mcp.gtm-api.com/mcp\" }\n }\n}\nFor Claude Code that is one line:
\nclaude mcp add --transport http gtm-api https://mcp.gtm-api.com/mcp\nAPI key, for headless runs. A key minted in the app (gtm_live_...) authenticates both the\nREST API and this endpoint. Pass it as Authorization: Bearer gtm_live_..., or give the stdio\nlauncher GTM_API_KEY and skip the browser entirely:
{\n \"mcpServers\": {\n \"gtm-api\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@gtm-api/linkedin-mcp\"],\n \"env\": { \"GTM_API_KEY\": \"gtm_live_...\" }\n }\n }\n}\nThe launcher also ships as gtmapi/linkedin-mcp on Docker Hub. Mount a volume on the token cache\n(/home/node/.mcp-auth) in OAuth mode, or the consent step repeats on every container start.
The gotcha: in OAuth mode, passing --header Authorization to the stdio bridge overwrites the\nOAuth token and the connection fails in a way that looks like a server problem. Pick one mode. In\nkey mode the launcher still logs a line about discovering the OAuth server configuration; that is\nharmless, because the header connects on the first try and the flow never starts.
A key is also the credential for the REST API, which mirrors every tool as a typed endpoint with\nwebhooks. Reference: docs.gtm-api.com.
The server exposes three tools, not hundreds. Everything else is discovered at runtime, which is\nwhy the schema footprint stays small enough to keep in context.
\nCall them in this order:
\nlist_toolsets takes no arguments and returns the domains, for example linkedin.messaging.get_toolset_tools takes toolset, and optionally verbose: true. The default is a lite\nlisting of name, title and a one-line summary. Pass verbose when you need full descriptions,\nsafety flags and parameter names, which you do before your first call to any tool.call_tool takes name and arguments and runs the action. Arguments are validated against\nthat action's own schema, so a typo comes back as a typed error rather than a silent no-op.Never guess a tool name. The catalog changes as toolsets ship, and a guessed name is a failed\ncall at best. Discover, then invoke. If you need one action twice in a session, keep the name and\nits parameter list from the verbose listing rather than re-reading it.
Anything that leaves the account (connection request, message, InMail, comment, reaction) is\nmarked dangerous and runs a two-step gate.
\nCall the action once with its normal arguments. Instead of sending, it returns a preview of what\nwould happen and a commit_token. Call it again with the same arguments plus commit_token to\ncommit. The token belongs to that one preview.
commit_token does not appear in the tool's own input schema. That is deliberate: the gate adds\nit. Passing it on the first call is not how you skip the preview.
The preview checks the arguments against the backend before it hands out a token. If the real call\nwould be refused for them (a missing field, a combination the action does not take, a permission you\ndo not hold), the preview returns that same error and no token, so fix the arguments and preview\nagain. validated: true in the preview means the arguments passed that check. It does not promise\nthe action will succeed: the daily budget, a Sales Navigator seat, whether the person is connected\nare only known when the action runs.
Show the preview to the user before committing anything that reaches another person. The gate\nexists so an over-eager agent cannot burn an account, and committing without reading it gives that\nprotection away.
\nEvery outward action passes a server-side budget check before dispatch. Allowances depend on how\nold the connected account is and how it has been behaving: a new account starts well under the\nplatform maximum and is raised as it builds history. Bulk work is spread with randomized gaps,\nbecause a fixed cadence is itself a detectable pattern.
\nWhen the check rejects an action, that is the system working.
\nAn agent that retries into a limit is the failure mode the whole safety layer exists to prevent.
\nFailures come back as a typed envelope with a machine-readable code, not prose to parse. Branch on\nthe code.
\n401 with an OAuth challenge means no credential arrived. In key mode, the header is missing or\nmalformed.401 invalid_token on a key means the key is wrong, revoked, or the account is suspended.get_toolset_tools verbose: true rather than guessing the shape.Read the code, act on it once, and surface it. Retrying an auth or permission failure never\nchanges the answer.
\nLinkedIn's User Agreement does not permit third-party automation, so every tool in this space\ncarries risk and no vendor can honestly promise otherwise. The managed setup reduces it by acting\nonly on owned accounts, in an isolated anti-detect browser with a dedicated proxy per account,\nwith warm-up and enforced limits. 20,000+ accounts run on that stack, and under 1% of them have ever been\nrestricted. This is not legal advice.
\nTell the user what an action will do before it goes out. That is the whole job.
\nhttps://docs.gtm-api.comhttps://github.com/gtm-api/linkedin-mcphttps://app.gtm-api.com/signup