LinkedIn MCP server guard
linksmcp is a LinkedIn MCP server guard for people who run outreach from their own LinkedIn profile with an AI agent.
No signup page yet: keys are issued by hand.
A LinkedIn MCP server does what your agent asks, as fast as it asks.
Give Claude or any other agent a LinkedIn tool and a list of leads, and it will work through the list. The tool does not know that 20 invitations already went out today, that LinkedIn signed you out an hour ago, or that you messaged this person two hours ago. Without a record of what was sent, the same opener can go twice.
linksmcp is the part that remembers and says no. Every action asks for a permit first. When the answer is no, the call never reaches LinkedIn, and your agent is told why and, when time fixes it, when to try again.
Illustration of the two setups, not a recorded account.
Your agent asks the guard. The guard decides, waits, and only then passes the call on.
Through the guard, steps 2 and 3 happen on their own. A deny comes with a reason and, when time solves it, a retry_at.
The guard starts the LinkedIn tool itself. Do not add the tool as a separate server as well: an agent that can reach it directly can go around the guard.
Every refused call says the guard refused it, not LinkedIn.
Conservative daily limits, pacing and pauses modelled on what keeps LinkedIn accounts healthy. These are the default preset as of 19 October 2026.
20 connection requests a day by default. Each profile gets its own variation of limits and timing per day, so connection requests, profile views and searches land between 70 and 100 percent of the limit. Replies to people who wrote to you are never cut.
Today's cap lands between 70 and 100 percent of the limit, so somewhere from 14 to 20.
Openers, replies and follow ups together. Replies to people who wrote to you are never cut.
A new profile does not start at the full limit. Connection requests start at 5 and add 1 a day. Messages start at 30 (+5 a day), profile views 50 (+15), searches 5 (+2), comments 3 (+1). Seven days without automated work restarts the warm up.
08:00 to 20:00 by default. Each day the window starts up to 45 minutes later and ends up to 45 minutes earlier.
Through the guard the wait happens for you.
25 to 40 minutes between invitations in the first 14 days. After that 5 to 8 minutes, stretched so the rest of the day's invitations spread over the rest of the working window, and never more than 3 hours apart.
For 6 hours after a sign in: at most 3 LinkedIn calls per 10 minutes in the first 2 hours, then 5, then 8. After 3 hours idle, a shorter 45 minute version of the ramp runs.
Replies still go. Too many requests, or a limit message on a send, counts as a warning. The write cooldown of up to 72 hours ends the next time you sign in, and then a 2 hour quiet window starts where only replies to people who wrote to you go.
Invitations pending 21 days or more are withdrawn oldest first, 5 per batch (up to 10 late in the day), one batch every 4 hours, 20 a day. A weekly reading of your Sent tab adds the invitations you sent by hand.
Pending invitations capped at 20 days of sending, and slow invitation spacing for 30 days.
The guard refuses the message. It does not quietly edit it.
Example preflight for one message.
Result: refused, links_before_reply. The call never reached LinkedIn.
When the person writes back, the same message gets a permit. Comments and replies on your own posts may carry a link at any time.
Example inbox. Names are made up, not customers.
You
You
Thanks for connecting, Tom. Curious how your team runs partner onboarding at the moment.
Following up with the case study I mentioned: yourdomain.com/case-study
Refused: Tom has not written back, so the link waits. The call never reached LinkedIn.
Refusedlinks_before_replyMost people never need hosted mode. It is not open yet: keys are issued by hand.
What linksmcp does not do.
LinkedIn's User Agreement does not allow automated activity. The limits lower the chance of a warning, they do not remove it.
What you do by hand on LinkedIn is invisible to it, except the invitations counted in the weekly Sent tab reading and the messages your agent files for you.
If the LinkedIn tool is also added as its own server, the agent can skip linksmcp entirely.
They cannot be wrapped, so the agent follows the loop by hand.
They read page addresses and button names from the last snapshot, not LinkedIn's own requests.
Hired, bought, borrowed or shared profiles are not what it is for.
Any MCP client that can start a stdio server. Early access users get the install with their key. Nothing is public to download yet.
{
"mcpServers": {
"linksmcp": {
"command": "node",
"args": ["<path from your early access email>"]
}
}
}The guard is the only server your agent sees. It starts the LinkedIn tool itself.
Short answers to what people ask before they let an agent near their profile. The numbers are the defaults as of 19 October 2026.
A LinkedIn MCP server is a tool that lets an AI agent such as Claude Code or Cursor act on LinkedIn: search, view profiles, send invitations and messages. One open source one is stickerdaniel/linkedin-mcp-server. On its own it does whatever the agent asks. linksmcp is a guard that sits in front of it and holds every action to daily limits, pacing and pauses.
No tool makes it safe. LinkedIn's User Agreement does not allow automated activity, and the limits lower the chance of a warning without removing it. What linksmcp adds is enforcement: 20 connection requests a day by default, invitations 25 to 40 minutes apart in the first 14 days, working hours, and 48 hours with no outreach after any sign out, security check, restriction or warning.
linksmcp allows 20 a day by default, and each day lands between 70 and 100 percent of that. A new profile starts at 5 and adds 1 a day. New or recently warned profiles use a stricter preset of 10 a day.
linksmcp has no weekly cap of its own. It caps pending invitations at about a month of the profile's own sending, 600 at the default limit, and withdraws invitations pending 21 days or more, oldest first, up to 20 a day. A weekly reading of your Sent tab adds the ones you sent by hand.
Outreach stops for 48 hours, and replies to people who wrote to you still go. If LinkedIn ended the session itself, a write cooldown of up to 72 hours comes on top. It ends at your next sign in, followed by a 2 hour quiet window for replies only.
No. A message, invitation note or comment with a link to someone who has not replied is refused, not edited, and never reaches LinkedIn. An accepted invitation does not count as a reply. Comments and replies on your own posts may carry links.
No. Your agent does the LinkedIn work in your own browser, with your own session, on your own connection. linksmcp never sees a LinkedIn password or cookie and never opens a LinkedIn page. In local mode, the default, nothing is sent anywhere: no account, no telemetry, no update check. Message text never leaves your machine in either mode.
Any MCP client that can start a stdio server: Claude Code as a plugin, Cursor and OpenClaw with a JSON config entry. Checks are complete with the stickerdaniel LinkedIn MCP server and best effort with the Playwright MCP browser server. Claude in Chrome and other browser extensions cannot be wrapped, so with them it is advice only.
There is no charge during early access and no price has been set. There is no signup page yet: email hi@linksmcp.com with the agent and LinkedIn MCP server you use, and keys are issued by hand. Hosted mode, for more than one agent on one profile, is not open yet.
No charge during early access, and no price has been set. Email hi@linksmcp.com with the agent you run and the LinkedIn tool you use, and we send a key by hand.