LinkedIn MCP: connecting Claude or ChatGPT to LinkedIn without risking your account

A LinkedIn MCP promises that you can ask Claude or ChatGPT to “find me ten operations directors who are hiring” and watch it search LinkedIn for you. Several free servers do it. What they say less is how they connect to your account, and what you risk. Here are the five ways to connect an AI to LinkedIn, what LinkedIn’s terms say about them, the real risks and the method to use them without losing your account.

📌 Key points

• A LinkedIn MCP gives your AI assistant tools to read LinkedIn or act on it: search profiles, read your messages, invite, write.
• LinkedIn’s official API lets you neither search prospects nor send messages without partner approval: most LinkedIn MCPs therefore use your session.
• LinkedIn’s User Agreement prohibits copying cookies, sharing log-in credentials and using bots that copy the site or add contacts.
• Pasting your li_at cookie into a tool gives it full access to your account, messages included.
• The safe method: searching happens outside your account, and sending stays rare, spread out and different every time.

LinkedIn MCP: what is it, and how does it work?

A LinkedIn MCP is an MCP server that gives Claude, ChatGPT or Mistral tools to read LinkedIn or act on it. MCP (Model Context Protocol) is an open standard: the AI assistant connects to servers, each server presents a list of tools, and the assistant picks the one that answers your request.

The official protocol documentation distinguishes two cases. A local server runs on your computer, launched by the AI application. A remote server runs at a vendor and is reached over the internet; the protocol then recommends OAuth to obtain access, meaning an authorisation given in the browser, without handing over a password.

For LinkedIn, a server typically exposes tools such as “search people”, “read a profile”, “read the inbox”, “send a message” or “invite”. You ask a question, Claude calls the tool, the server queries LinkedIn and the answer comes back into the conversation.

Bottom line: an MCP is only a plug. The whole question is what sits behind it: with what rights, and in whose name, the server talks to LinkedIn.

Is there an official LinkedIn MCP?

No, not for prospecting. LinkedIn has an official API, but it is closed for what a salesperson needs. According to Microsoft Learn’s “Getting Access to LinkedIn APIs” page, only three permissions are open to every developer without approval: reading the signed-in member’s name, headline and photo, reading their email, and posting or commenting on their behalf.

Everything else (the data of the Marketing, Sales or Talent APIs) goes through partner programmes that LinkedIn must approve. An MCP server that honestly relies on the official API can therefore help you publish a post from Claude. It cannot search prospects, read your conversations or send invitations. 🔍

👉 As soon as a “LinkedIn MCP” promises to search profiles or write to prospects, it takes another route than the official API. That route is what you need to look at.

What are the five ways to connect an AI to LinkedIn?

There are five families of “LinkedIn MCP”, and they do not access LinkedIn in the same way. The table sums them up, from the official route to the most intrusive.

Type	How it accesses LinkedIn	What it allows	What LinkedIn’s terms say
Official API	OAuth sign-in to an approved app	Posting, reading your own profile	Allowed, within the permissions
MCP with cookie or password	Your li_at cookie or credentials, pasted into the configuration	Everything you can do on the site	Prohibited (copied cookies, shared credentials, bots)
AI that drives your browser	Your open session, simulated clicks	Everything you can do on the site	Prohibited (tools that automate activity)
Third-party data service	The service’s own bots, without your account	Reading public profiles and job posts	Collection prohibited by the terms, but your account is not used
Prospecting tool connected through an API provider	Your account connected to the provider, for sending	Inviting, writing, reading replies	Automated activity: the risk depends on volume and pace

Unofficial MCPs that use your session

This is the most common family on GitHub. Some ask you to copy the li_at cookie from the browser’s developer tools and paste it into a configuration file; others reuse the session of a browser where you are signed in and drive it. The most visible open source project, linkedin-mcp-server, is honest about this: its README warns that automated access “may violate LinkedIn’s terms and can lead to account restrictions”.

Third-party data services

Data providers such as Bright Data offer an MCP that reads public profiles, companies and job posts with their own bots. Your account is not at stake. However, the collection still goes against LinkedIn’s terms, and it is up to you to check what you are allowed to do with that data (see the GDPR part below).

Tools that go through an API provider

Many prospecting tools, ours included, connect your LinkedIn account to an API provider such as Unipile, which sends invitations and messages on your behalf. This is also automated activity on your account: the whole difference lies in what the tool does with that access, how much it sends and at what pace.

Bottom line: the danger does not come from the MCP itself but from two questions. Does the server use your account? And if so, to do what, how many times a day?

What do LinkedIn’s terms of use say?

LinkedIn’s User Agreement, effective since 3 November 2025, targets exactly what most LinkedIn MCPs do. In section 8.2, the list of don’ts includes in particular:

1. Using or attempting to use another’s account, the agreement giving sharing log-in credentials and copying cookies as examples.
2. Developing, supporting or using software, scripts, robots or browser add-ons to copy the site, profiles included.
3. Using bots or other unauthorised automated methods to access the site or add and download contacts.

Section 2.2 adds that you keep your password secret and do not share your account with anyone. The help page “Prohibited software and extensions” spells out the consequence: accounts that use these tools can be restricted or shut down. ⚠️

A cookie pasted into an MCP server therefore ticks two boxes: copying a cookie and using an automated tool. This is not a grey area.

What are the risks of a LinkedIn MCP for your account?

The risks fall into four categories: an account restriction, full access handed to a third party, a security hole on your computer, and a collection of personal data you will have to justify. The first is the most frequent, the second the most underestimated.

A restriction, then a shutdown

An AI assistant never gets tired: plugged into your session, it can chain dozens of searches and profile visits in a few minutes. That is exactly what LinkedIn’s systems watch for. We covered the causes, durations and remedies in our article on a restricted LinkedIn account: an invitation restriction lasts from a few hours to a month, but repeated suspensions can lead to a permanent restriction. 🚫

Your cookie is your account

The li_at cookie is the token that proves to LinkedIn that you are signed in. OWASP, the reference for web application security, describes session hijacking: whoever holds a valid session token can impersonate the user and access what is reserved for them. The cookie is not limited to “searching profiles”: it opens everything.

In practice, the server holding your cookie sees your private conversations, including those with your clients, and can write, invite or post in your name. On your machine, you can read its code; on someone else’s, you take them at their word. 🔑

Third-party code plugged into your AI

A local MCP server runs on your computer, with your rights: install it from its official source, reading what it asks for. Another point: the assistant reads LinkedIn content, including messages written by strangers. A booby-trapped message can contain instructions the AI would take for yours. Keep a human approval before anything is sent.

GDPR still applies

Extracting profiles means collecting personal data. In its focus sheet on web scraping, written for AI development, the CNIL, France’s data protection authority, recommends excluding sites that object to collection through their terms of use, and sticking to data freely accessible without an account. A prospect database pulled from your LinkedIn session ticks the wrong boxes. 📋

Common mistake: “I only read, I don’t send anything”

It is the argument we hear most: the MCP is only used to search, no message goes out, so there is no risk. It is wrong for two reasons.

• ❌ Automated reading is prohibited too. Section 8.2 targets tools that copy the site, profiles included, not only those that send.
• ❌ Searching is the most visible activity. Searches and profile visits have their own caps per account, recommended by Unipile and listed in the table of our article on restricted accounts. An AI that “checks” hundreds of profiles to keep ten goes over them fast.

Second mistake, a costlier one: plugging the MCP into a secondary account “so as not to risk the real one”. The terms prohibit fake profiles, and the secondary account, with no connections, is the first to be restricted.

How do you connect Claude to LinkedIn without risking your account?

To connect Claude to LinkedIn without risking your account, separate the two uses: searching for prospects happens outside your account, and only sending goes through your profile, at a human pace. Claude stays the interface; it never has your cookie.

1. Have the search done elsewhere. Use a tool whose bots detect prospects and their signals without going through your profile: your account makes no searches or visits in bulk.
2. Connect the AI through OAuth. A remote connector with OAuth shows you the permissions requested, never sees your password and can be removed in one click.
3. Cap sending. Stay well below the known limits (our article on the LinkedIn invitation limit gives the benchmarks), and spread sending over office hours, on weekdays.
4. Write a different message for each person. Identical messages drive up reports, and people’s reactions are also what LinkedIn measures.
5. Approve before sending. Claude prepares, you review, especially at the start.

Point 4 matters more than people think: a generic message is ignored or reported, and that is what damages the account.

Example

Signal: the sales director of a software SME posts that she is looking for two salespeople to open the German market.

Message an MCP sends to 200 people: “Hi, I saw your company is growing. We help sales teams become more efficient. Do you have 15 minutes for a call?”

Message that gets a reply: “Hi, opening Germany with two new hires often means three months before the first meeting there. Are you giving them a list of accounts, or are they starting from scratch?”

The first could go to anyone. The second starts from her post, names a concrete problem and asks a simple question. 💡

Bottom line: AI is very useful for preparing (choosing the target, writing, sorting replies). Our article on the AI SDR details that split. It becomes dangerous when you hand it your session to run LinkedIn at full speed.

How does MeetMagnet connect Claude to LinkedIn?

MeetMagnet has its own official MCP connector, which plugs into Claude, ChatGPT, Mistral or Perplexity with an OAuth sign-in: you approve the permissions on MeetMagnet’s consent screen, the assistant never sees your password, and access is limited to your account and can be revoked at any time. The step-by-step guide is in our tutorial on prospecting with Claude. 🔌

On the LinkedIn side, MeetMagnet uses your account for one thing only: sending your invitations and messages. Prospect searches go through our own bots, not through your account. Our settings, the same as in our article on restricted accounts:

1. 70 invitations a week at most, 50 if you want more room to invite by hand.
2. Sending at random times between 8 am and 6 pm, on weekdays, never at weekends.
3. Messages that are all different, built on each prospect’s signal.
4. Email as a relay when possible, so that not everything goes through LinkedIn.

✅ Since launch, we have not seen any account banned because of our sends. That is not a guarantee: the LinkedIn connection goes through Unipile, LinkedIn’s terms apply to every tool, and we control neither what you do alongside nor tomorrow’s rules. If you also connect your CRM, Claude can log the prospects who replied there, as in our article on the small business CRM connected to Claude. 📊

The connector is on our MCP connector page; the plans are on the pricing page: Self-serve at €149 excl. VAT per month, or Managed at €299 excl. VAT per month with a person who calibrates targeting and pace.

A LinkedIn MCP is neither magic nor necessarily dangerous: everything depends on what you give it, a limited and revocable authorisation or the key to your account. Have the AI search somewhere other than your profile, keep sending rare and written for each person, and your account will stay the place where your prospects reply to you. 🚀

Sources

• “Architecture overview”, Model Context Protocol, accessed 6 November 2026, https://modelcontextprotocol.io/docs/learn/architecture
• “Getting Access to LinkedIn APIs”, Microsoft Learn, accessed 6 November 2026, https://learn.microsoft.com/en-us/linkedin/shared/authentication/getting-access
• “User Agreement”, LinkedIn, effective 3 November 2025, sections 2.2 and 8.2, accessed 6 November 2026, https://www.linkedin.com/legal/user-agreement
• “Prohibited software and extensions”, LinkedIn Help, accessed 6 November 2026, https://www.linkedin.com/help/linkedin/answer/a1341387
• “Session hijacking attack”, OWASP, accessed 6 November 2026, https://community.owasp.org/attacks/Session_hijacking_attack
• “The legal basis of legitimate interest: focus sheet on the measures to implement in case of data collection by web scraping”, CNIL, accessed 6 November 2026, https://www.cnil.fr/en/legal-basis-legitimate-interest-focus-sheet-measures-implement-case-data-collection-web-scraping
• “linkedin-mcp-server”, README of the open source project, GitHub, accessed 6 November 2026, https://github.com/stickerdaniel/linkedin-mcp-server
• “LinkedIn MCP Server”, Bright Data, accessed 6 November 2026, https://brightdata.com/ai/mcp-server/linkedin
• MeetMagnet sending practices (caps, hours, searches by our bots), as described in our article on restricted LinkedIn accounts, November 2026.