LinkedIn MCP Server

A local-first Model Context Protocol (MCP) server for LinkedIn's official OAuth and REST APIs. Each user runs their own instance and supplies credentials from their own LinkedIn Developer app.

Capabilities

The server exposes these MCP tools:

Tool	Capability
linkedin_authenticate	Starts the local LinkedIn OAuth flow.
linkedin_auth_status	Checks whether a local LinkedIn access token is available.
linkedin_get_my_profile	Reads the authenticated member's OpenID profile and email.
linkedin_create_post	Publishes a text post to the authenticated member's LinkedIn profile. Publishing requires confirm=true.
linkedin_create_post_with_image	Uploads a local image and publishes it with a text post. Publishing requires confirm=true.
linkedin_reshare_post	Reshares an existing post with optional commentary. Requires confirm=true.
linkedin_create_comment	Creates a comment on a post. Requires confirm=true.
linkedin_react_to_post	Adds a reaction such as Like, Praise, Empathy, Interest, Appreciation, or Entertainment. Requires confirm=true.
linkedin_remove_reaction	Removes your reaction from a post. Requires confirm=true.
linkedin_edit_comment	Edits one of your comments. Requires confirm=true.
linkedin_delete_comment	Deletes one of your comments. Requires confirm=true.
linkedin_delete_post	Deletes one of your posts. Requires confirm=true.

The server uses LinkedIn's official APIs only. It does not scrape LinkedIn, use browser cookies, search arbitrary people, read messages, or export connections.

LinkedIn Developer App Setup

LinkedIn API access is controlled by LinkedIn. A copy of this project does not provide API access or bypass LinkedIn permissions; every user must create and configure their own Developer app.

1. Create or select an app and Company Page

Create an app in the LinkedIn Developer Portal and associate it with a LinkedIn Company Page. A personal developer can create a small development Company Page and associate the app with it.

The default individual-developer page may be enough for basic sign-in, but it can restrict additional API products. If you need to publish posts, use a Company Page that permits the required product access.

2. Add products

Scopes are enabled through products rather than by adding scopes individually:

1. Open the app's Products tab.
2. Request Sign In with LinkedIn using OpenID Connect.
3. Request Share on LinkedIn.
4. Confirm both products appear under Added products.

These products enable the scopes used by this server:

• Sign In with LinkedIn using OpenID Connect enables openid, profile, and email.
• Share on LinkedIn enables w_member_social, required for posting.

Product approval and availability are controlled by LinkedIn. If Share on LinkedIn is not approved, authentication with this server's default scope set will fail and posting will not work.

3. Register the redirect URL

In the app's Auth tab, add this exact Authorized redirect URL:

http://127.0.0.1:3000/oauth/callback

The scheme, host, port, and path must match exactly. localhost and 127.0.0.1 are different redirect URLs. If you use another local callback, set LINKEDIN_REDIRECT_URI to that value and register the exact same value in LinkedIn. The server permits only local localhost or 127.0.0.1 callbacks.

4. Copy credentials

From the app's Auth tab, copy the Client ID and Client Secret. Keep the Client Secret private.

Run locally

npm install
cp .env.example .env
# Edit .env and add the Client ID and Client Secret.
npm run build
npm start

The server uses stdio, which is the simplest transport for Copilot CLI and other MCP clients. It should normally be launched by the MCP client rather than opened as an interactive terminal application.

Configuration

Required variables:

LINKEDIN_CLIENT_ID=your-linkedin-client-id
LINKEDIN_CLIENT_SECRET=your-linkedin-client-secret

Optional variables:

Variable	Default	Purpose
LINKEDIN_REDIRECT_URI	http://127.0.0.1:3000/oauth/callback	Local OAuth callback; register the exact value in LinkedIn.
LINKEDIN_VERSION	202607	LinkedIn REST API version for /rest/* requests.
LINKEDIN_TOKEN_FILE	.data/linkedin-token.json	Local access-token file location.

MCP client configuration

Use an absolute path to the cloned repository:

{
  "mcpServers": {
    "linkedin": {
      "command": "node",
      "args": ["/absolute/path/to/linkedin-mcp-server/dist/server.js"],
      "env": {
        "LINKEDIN_CLIENT_ID": "your-client-id",
        "LINKEDIN_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

Prefer the MCP client's secret or environment-variable facility instead of committing credentials to a configuration file.

Authenticate and use

1. Start the MCP server through your MCP client.
2. Call linkedin_authenticate.
3. Open the returned LinkedIn authorization URL.
4. Approve access.
5. Call linkedin_auth_status.
6. Call any of the tools above. Mutating tools require confirm=true.

Mutating tools require explicit confirmation to reduce accidental publishing or deletion. Example arguments:

{
  "commentary": "Hello from my LinkedIn MCP server.",
  "confirm": true
}

For social actions, provide the LinkedIn post URN returned by LinkedIn or a previous API response:

{
  "postUrn": "urn:li:share:123456789",
  "commentary": "Thanks for sharing this.",
  "confirm": true
}

The comment, reaction, reshare, edit, and delete tools operate on the specific post or comment identified by their URN/ID. They do not search LinkedIn or read your feed. The current default OAuth scopes support identity and member social actions, but do not provide general post-history, comment-history, messaging, people-search, or connections-read access.

LinkedIn controls access to individual API products and may change endpoint requirements. If a social-action call returns an authorization or scope error, check the app's enabled products and the permissions currently granted to the token; some newer feed APIs may require a feed-specific permission that is not included in the default w_member_social scope.

Troubleshooting

redirect_uri does not match the registered value

Register the exact callback URL shown above, or make sure LINKEDIN_REDIRECT_URI exactly matches the URL registered in LinkedIn. Check the hostname (127.0.0.1 versus localhost) and port.

invalid_scope_error

Verify that both required products are listed under Added products. If Share on LinkedIn is missing or not approved, w_member_social is unavailable and posting cannot succeed.

Re-authentication

Delete the local token file only when you intentionally want to authenticate again:

rm .data/linkedin-token.json

Then call linkedin_authenticate.

Security

• Never commit .env or .data/.
• The local token file is created with owner-only permissions.
• Publishing requires explicit confirm=true.
• Keep LinkedIn client secrets and tokens server-side.
• Never paste credentials or token files into issues, pull requests, or public repositories.

Azure deployment plan

Azure is not required for the local version. Deploy only if the server must be available to multiple clients or run continuously.

A production deployment should use Azure Container Apps or App Service for the MCP HTTP service, Azure Key Vault for secrets and encryption keys, encrypted durable storage for tokens, a registered HTTPS redirect URL, and authentication and audit logging before exposing the service outside the local machine.

The local stdio transport should remain the default for personal Copilot use; an Azure deployment is a separate production transport and security boundary.

License

MIT. See LICENSE.