LinkedIn MCP for OpenWorker

A local-first LinkedIn MCP server for OpenWorker. It runs over stdio, keeps tokens in environment variables or explicit tool inputs, and exposes small, approval-friendly tools for LinkedIn profile reads and post operations.

Tools

• linkedin_start_oauth_flow starts the browser OAuth flow, captures the localhost callback, exchanges the code, and stores the token locally.
• linkedin_auth_status reports whether a stored token exists and when it expires.
• linkedin_logout deletes the stored token.
• linkedin_exchange_authorization_code exchanges an OAuth code and stores the token, for manual fallback flows.
• linkedin_get_my_profile reads the authenticated member profile from /v2/userinfo.
• linkedin_create_text_post publishes or drafts a text-only post through /rest/posts.
• linkedin_get_post retrieves a post by URN.
• linkedin_find_posts_by_author lists posts for a member or organization URN.

Setup

npm i linkedin-mcp-openworker

Create a LinkedIn developer app and request the products/scopes you need:

• openid profile email for Sign In with LinkedIn using OpenID Connect.
• w_member_social to publish as the authenticated member.
• Organization posting requires LinkedIn-approved organization scopes such as w_organization_social.

OpenWorker supports MCP servers through Manage -> Integrations using the same mcpServers JSON format as Claude Desktop and Cursor. After building, add a server like this:

{
  "mcpServers": {
    "linkedin": {
      "command": "npm",
      "args": ["linkedin-mcp-openworker"],
      "env": {
        "LINKEDIN_CLIENT_ID": "paste-your-linkedin-client-id-here",
        "LINKEDIN_CLIENT_SECRET": "paste-your-linkedin-client-secret-here",
        "LINKEDIN_REDIRECT_URI": "http://127.0.0.1:33333/linkedin/oauth/callback",
        "LINKEDIN_VERSION": "202607"
      }
    }
  }
}

LINKEDIN_VERSION defaults to 202607, matching LinkedIn Marketing API versioning guidance current at the time this project was created.

OAuth Flow

1. In your LinkedIn developer app, add this authorized redirect URL:

http://127.0.0.1:33333/linkedin/oauth/callback

2. Add the MCP server to OpenWorker with LINKEDIN_CLIENT_ID, LINKEDIN_CLIENT_SECRET, and LINKEDIN_REDIRECT_URI.
3. Ask OpenWorker to run linkedin_start_oauth_flow.
4. The MCP starts a localhost callback server, opens your browser to LinkedIn, validates the returned state, exchanges the authorization code, and stores the token at:

~/.linkedin-mcp-openworker/token.json

5. After that, LinkedIn tools automatically use the stored token. Use linkedin_auth_status to inspect token status and linkedin_logout to delete it.

The default managed flow uses LinkedIn's regular 3-legged OAuth authorization endpoint:

https://www.linkedin.com/oauth/v2/authorization

That is the endpoint LinkedIn documents for OpenID Connect. It requests openid profile email w_member_social by default, exchanges the authorization code with your client_secret, and stores the returned access token and ID token metadata locally. Do not use auth_method: "pkce" with OpenID scopes; LinkedIn rejects that combination with Open ID permission is not supported for PKCE flows.

LinkedIn's general 3-legged OAuth documentation says redirect URLs should be HTTPS. If LinkedIn rejects the localhost callback URL for your app, use an HTTPS callback/tunnel URL that forwards to this machine and set LINKEDIN_REDIRECT_URI to the exact URL registered in the LinkedIn Developer Portal.

By default, OAuth tools redact tokens in tool results. Pass return_access_token: true only when you explicitly want a result to include token values.

Notes

LinkedIn API access depends on the products approved for your developer app. A token without w_member_social cannot publish member posts, and organization posts require organization permissions plus an authenticated member with the right page role.