LinkedIn MCP servers: browser session or official API?

By Jithin Palepu, founder of First100. Published 2026-09-27. Last updated 2026-09-27.

A LinkedIn MCP server comes in two kinds. One drives your logged-in LinkedIn session in a browser, so it can read profiles and send messages, but LinkedIn's User Agreement forbids that kind of automation. The other calls LinkedIn's official API over OAuth, so it can publish posts safely but cannot read profiles, messages or post metrics.

Key takeaways

• LinkedIn's User Agreement (effective November 3, 2025) bans bots that "send or redirect messages, create, comment on, like, share, or re-share posts" in section 8.2.
• The open-source linkedin-mcp-server had 3.6k GitHub stars when we checked in September 2026, and its README warns that accounts using it "can be restricted or banned."
• LinkedIn's official Share on LinkedIn product grants the w_member_social permission and caps each member at 150 requests in a window that resets every 24 hours.
• LinkedIn closed the r_member_social permission, so official-API tools, First100 included, get no per-post metrics for personal profiles.
• First100 publishes LinkedIn text, image, video and PDF document posts from Claude, Cursor or Codex, up to 3,000 characters per post.

What is a LinkedIn MCP server?

A LinkedIn MCP server is a program that gives an AI agent tools for LinkedIn through the Model Context Protocol. The agent sees tools such as "publish a post" or "get a profile" and calls them while it works. What those tools can do depends on one design choice: does the server act through your browser session, or through LinkedIn's official API with an OAuth token? That choice sets the feature list, the risk to your account and the setup work.

Both kinds look the same from inside Claude Code or Cursor. You add a server, the agent lists its tools, and you ask for something in plain words. The difference only shows up when LinkedIn decides whether it allows the traffic.

I build First100, which is the second kind. I will try to be fair to the first kind anyway. Browser-session servers do things an official-API server cannot, and some people will want those things.

How do browser-session LinkedIn MCP servers work?

A browser-session server logs in as you and clicks through linkedin.com the way a person would. It reuses the cookies from a signed-in browser, or opens a login window once and keeps the session. Every tool call becomes page loads, clicks and text extraction. Because it sees what you see, it can read almost anything on the site.

The best-known example is stickerdaniel/linkedin-mcp-server, licensed Apache 2.0. Its README says it "controls a real browser session" through Patchright, a Playwright-based library. Its tools include:

• get_person_profile, search_people and get_company_employees for reading people and companies.
• get_inbox, get_conversation and send_message for LinkedIn messages.
• search_jobs and get_job_details for job listings.
• connect_with_person for connection requests.
• get_feed and search_posts for reading posts.

Other servers do the same with Selenium or a plain Playwright script. The setup is local: you install the server, a browser engine and your session. Nothing asks LinkedIn for permission, because nothing goes through LinkedIn's developer platform.

That is the appeal. You get profile lookups, inbox access and job search, none of which LinkedIn offers to ordinary apps. It is also the problem.

What does LinkedIn's User Agreement say about automation?

LinkedIn's User Agreement, effective November 3, 2025, lists the forbidden behaviour in section 8.2, the "Don'ts". Two clauses cover browser-session MCP servers directly. One bans software that scrapes the site. The other bans bots that message people or create, like and share posts. A server that reads profiles and sends messages through your session does both.

The exact text of section 8.2, item 2, forbids you to:

"Develop, support or use software, devices, scripts, robots or any other means or processes (such as crawlers, browser plugins and add-ons or any other technology) to scrape or copy the Services"

Item 13 forbids you to:

"Use bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages, create, comment on, like, share, or re-share posts, or otherwise drive inauthentic engagement"

LinkedIn's help page on prohibited software and extensions spells out the consequence. Members who use such tools "risk having their accounts restricted or shut down." The page also says LinkedIn works to stop these tools without warning.

The stickerdaniel README is honest about this. Its disclaimer reads: "LinkedIn's User Agreement prohibits automated access, and accounts using automated tools can be restricted or banned. Use at your own risk; there is no guarantee of account safety."

So the risk sits with the account holder, not the server author. If your LinkedIn profile is where your customers find you, weigh that before you point an agent at it.

How do official-API LinkedIn MCP servers work?

An official-API server never touches linkedin.com pages. You authorize it once through LinkedIn's OAuth consent screen, and LinkedIn issues an access token for the permissions you approved. The server then calls LinkedIn's REST endpoints with that token. LinkedIn knows which app made each call and what the member let it do.

For posting on a personal profile, the permission is w_member_social. The Share on LinkedIn documentation describes it as "Required to create a LinkedIn post on behalf of the authenticated member." Any developer can add that product to an app in the LinkedIn Developer Portal.

The same page lists the limits. A member gets 150 requests and an app gets 100,000, and both counters reset every 24 hours at midnight UTC. Text, link, image and video posts go through the ugcPosts endpoint.

PDF documents, the "carousel" posts, use a newer API. The Documents API accepts PDF, PPT, PPTX, DOC and DOCX files up to 100 MB and 300 pages. It requires a LinkedIn-Version header in YYYYMM format, and LinkedIn retires each version about 12 months after release. The page itself warns that version 202510 sunsets on October 15, 2026.

Tokens expire. LinkedIn's OAuth documentation says "all access tokens are issued with a 60-day lifespan." Programmatic refresh tokens are "available for a limited set of partners," so most apps ask you to sign in again after 60 days. An authorization code, the short-lived value exchanged for the token, lasts 30 minutes.

What can't an official-API server do on LinkedIn?

An official-API server can only do what LinkedIn's granted permissions allow. For an ordinary app that means posting as the member who signed in. It cannot read other people's profiles, cannot open your inbox and cannot send messages. It also cannot read the likes, comments and impressions on your own posts.

That last gap surprises people. Reading your own post engagement needs r_member_social. LinkedIn's Marketing API FAQ says: "r_member_social is a closed permission, and we're not accepting access requests this time due to resource constraints." Full profile access, r_full_profile, is closed the same way.

So any LinkedIn MCP server that shows you personal-profile post metrics is either a LinkedIn partner with special access or is reading them from the website. Ask which one before you trust the numbers.

Browser session vs official API: how do they compare?

The two kinds trade capability against account safety. A browser-session server reads more of LinkedIn and can act in more ways, but its automated actions fall under section 8.2 of the User Agreement. An official-API server does less, mostly publishing, and every action is one LinkedIn approved. The table sets them side by side as of September 2026.

If you need to read LinkedIn, only the first column does it, and it does it against the rules. If you need to publish on LinkedIn from an agent, the second column does it without putting the account at risk.

What does First100 do on LinkedIn?

First100 is an official-API LinkedIn MCP server. It connects your LinkedIn profile over OAuth with the scopes openid profile email w_member_social, and nothing else. Your agent writes the post. First100 stores it, checks it, schedules it and publishes it at the time you chose. The server never generates text itself.

What a LinkedIn post through First100 can carry:

• Text up to 3,000 characters. First100 tells the agent to aim for 800 to 1,300 characters, which is 27% to 43% of the limit, with a two-line hook and at most one link.
• One image (JPEG, PNG, GIF or WebP) up to 8 MB.
• One MP4 video up to 50 MB and 10 minutes long. First100 waits until LinkedIn has processed it before posting.
• One PDF document, shown as a swipeable carousel, up to 100 MB and 300 pages, with an optional title.

First100 copies every image, video and PDF into its own storage when it saves the post. Publishing never depends on the original URL staying up.

The guards do not change. First100 rejects identical text on LinkedIn within 24 hours. A platform gets at most 25 posts in any one day, well under LinkedIn's own 150-request member limit. Scheduled posts publish from a job that runs every minute, and failed attempts retry after 5, 10 and 20 minutes.

Links in a post become tracked /l/ links by default. That is how First100 measures LinkedIn at all: clicks per link and per platform, since LinkedIn shares no post metrics. The LinkedIn integration page covers these limits in one place.

What First100 cannot do on LinkedIn

First100 has the permissions LinkedIn grants to ordinary apps, so it lives inside the same limits as every official-API server. It publishes. It does not read LinkedIn, message anyone or engage on your behalf. Some of that is LinkedIn's rule; some of it is our choice. Here is the full list, so nobody finds out after paying.

• No profile reading. First100 cannot look up a person, a company or its employees on LinkedIn.
• No messages. It cannot read your inbox or send a message.
• No post metrics. get_post_performance and what_worked report no numbers for LinkedIn posts. Tracked-link clicks are the only LinkedIn signal.
• No automated engagement, by design. No auto-likes, auto-comments, connection requests or first-comment links. LinkedIn's section 8.2 forbids it, and we would not build it anyway.
• Personal profiles only. Posts go out as you, not as a company page. Company pages need w_organization_social and a page admin role, which First100 does not request.
• Tokens that expire after 60 days. When LinkedIn issues no refresh token, the daily connection check flags the account and you reconnect in a few clicks.

What happens when LinkedIn changes its API or a token expires?

Official-API servers break in scheduled, documented ways, and the fixes happen on the server side. LinkedIn retires each versioned API about 12 months after release and announces the date on its documentation pages. Access tokens run out after 60 days. Neither event depends on how LinkedIn's website looks this week, which is what breaks browser-session scripts.

In First100, document posts use a pinned LinkedIn-Version header, and we move it forward before LinkedIn retires the pinned version. You do not change anything on your side. Text, image and video posts use the older ugcPosts endpoint, which has no monthly version header.

A connection check runs once a day. If LinkedIn still accepts the token, nothing happens. If it has expired or you revoked access in LinkedIn's settings, First100 marks the account as needing a reconnect. Scheduled LinkedIn posts then fail with a message that says to reconnect, instead of failing silently. Reconnecting is the same consent screen you saw the first time.

How do you publish to LinkedIn from Claude or Cursor with First100?

Connecting takes about five minutes and needs no LinkedIn developer app of your own. You connect LinkedIn in the First100 dashboard, add First100's MCP endpoint to your agent, and ask the agent to write and schedule a post. The steps below cover Claude Code and Cursor; the quickstart guide covers the rest.

1. Create your account. Sign in at firsthundred.app and pick a plan. The week trial costs $5 for 7 days and includes 20 posts; Starter is $39 a month with 300 posts, and Pro is $59 a month with 600.

2. Connect LinkedIn. Open Connected accounts in the dashboard, choose LinkedIn, sign in and click Allow on LinkedIn's consent screen.

3. Add First100 to your agent. In Claude Code, run the command from the Claude Code setup page:

   claude mcp add --transport http first100 https://firsthundred.app/api/mcp \
     --header "Authorization: Bearer f100_your_key"
   

   In Cursor, add the same URL and header to ~/.cursor/mcp.json, as the Cursor setup page shows. Claude.ai and Claude Desktop take the URL as a custom connector and sign you in with no key.

4. Check the connection. Ask: "Use First100 to check my account status and list my connected accounts." LinkedIn should appear with your name.

5. Ask for a post. For example: "Read my brand context, write a LinkedIn post about this week's release, review it, and schedule it for Tuesday at 9:00 in my timezone." The agent calls get_content_context, writes the draft, runs review_post, then save_drafts.

6. Attach media if you want it. Give the agent a public image, MP4 or PDF URL. For a carousel, pass the PDF as documentUrl with a documentTitle.

7. Watch the queue. The post appears in the dashboard calendar. With auto-publish on, the default, it goes out at its time with no further approval.

If a step fails, the connection help page lists the usual causes. Every tool error names its fix in plain words.

Which kind of LinkedIn MCP server should you use?

Pick by the job, not by the tool count. If the job is reading LinkedIn, such as researching people or working your inbox, only a browser-session server can do it. It does so against LinkedIn's User Agreement, on an account LinkedIn may restrict. If the job is publishing on a schedule from your agent, an official-API server does it within the rules.

Three questions settle it for most founders:

1. Is your LinkedIn account an asset you cannot lose? If yes, stay on the official API.
2. Do you need to read or message, or only to post? Reading and messaging rule out the official API today.
3. Do you need post metrics? No personal-profile tool gets them through the API. Tracked links are the honest substitute.

You can also split the work. Draft and publish through an official-API server, and do your reading and replying by hand in LinkedIn itself. That is the use First100 has in mind: the agent writes and schedules, you talk to people.

FAQ

Is there an official LinkedIn MCP server?

We found no MCP server published by LinkedIn itself when we checked in September 2026. Third-party servers either use LinkedIn's official API over OAuth, like First100, or drive a logged-in browser session. Only the first kind uses access LinkedIn grants to apps.

Can a LinkedIn MCP server get my account banned?

A browser-session server can. LinkedIn's help page says members using bots or scraping tools "risk having their accounts restricted or shut down." An official-API server acts through permissions you approved on LinkedIn's consent screen, which LinkedIn permits.

Can a LinkedIn MCP server send LinkedIn messages?

Only a browser-session server, and doing so breaks section 8.2 of LinkedIn's User Agreement. The official API gives ordinary apps no messaging permission. First100 does not read or send messages.

Why does First100 show no LinkedIn post metrics?

Reading engagement on a member's posts needs the r_member_social permission. LinkedIn's Marketing API FAQ says it is closed and not accepting requests. First100 measures LinkedIn through clicks on tracked links instead.

Can First100 post PDF carousels to LinkedIn?

Yes. Pass a public PDF URL as documentUrl and LinkedIn shows it as a swipeable document. LinkedIn's Documents API accepts files up to 100 MB and 300 pages.

Does First100 post to LinkedIn company pages?

No. First100 posts to the personal profile you connect. Company pages need a different permission and a page admin role, which First100 does not request today.

Connect LinkedIn and schedule your first post

Open the quickstart guide, connect LinkedIn under Connected accounts, and add the endpoint to Claude Code or Cursor. Then ask your agent for one LinkedIn post about something you shipped this week, and schedule it for your next weekday morning. The full tool list shows what else the agent can do once you connect it.