Community source release (MIT). Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

LinkedIn MCP by Nabux

Multi-user LinkedIn MCP Gateway using LinkedIn's official OAuth and REST APIs.

Production target: https://linkedin.nabuxai.com
MCP: https://linkedin.nabuxai.com/mcp
OAuth callback: https://linkedin.nabuxai.com/linkedin/callback

The gateway pins LinkedIn Marketing API header version 202608 by default and sends X-Restli-Protocol-Version: 2.0.0 for /rest calls.

Baseline vs Company Page access

The self-service baseline requests:

openid
profile
w_member_social

This supports authenticated member identity and member posting.

After LinkedIn grants your app Community Management / organization permissions, append the scopes your approved product exposes, commonly:

r_organization_admin
r_organization_social
w_organization_social

r_member_social is restricted and should only be requested after LinkedIn grants it. The gateway does not require it for creating member posts.

Related MCP server: linkedin-mcp

Tools

• linkedin_accounts

• linkedin_profile

• linkedin_organization_roles

• linkedin_publish_text

• linkedin_publish_article

• linkedin_list_posts

• linkedin_get_post

• linkedin_delete_post

• linkedin_comments

• linkedin_comment

• linkedin_reactions

• linkedin_react

• linkedin_follower_statistics

• linkedin_page_statistics

• linkedin_share_statistics

• linkedin_rest_get — GET-only, relative /rest escape hatch

Member operations default to the authenticated member URN. Organization operations accept an explicit urn:li:organization:{id} actor, subject to LinkedIn's roles and granted app scopes.

Company Page discovery

linkedin_organization_roles uses the official organizationAcls?q=roleAssignee finder. LinkedIn roles such as ADMINISTRATOR and CONTENT_ADMINISTRATOR determine which Page operations a member may perform. New integrations may also use LinkedIn's permission-based organizationAuthorizations model as their approved access evolves.

Tokens

LinkedIn access tokens are encrypted at rest. If LinkedIn issues a programmatic refresh token to the app, that refresh token is also encrypted and used automatically near expiry. Programmatic refresh tokens are not generally issued to every LinkedIn app; when no refresh token exists, the dashboard preserves the access-token expiry and the member must reconnect when needed.

MCP tokens are separate from LinkedIn credentials and stored only as hashes.

Coolify

Deploy feature/linkedin-mcp-gateway using docker-compose.coolify.yml, domain linkedin.nabuxai.com, container port 8000, and persistent /data.

PUBLIC_BASE_URL=https://linkedin.nabuxai.com
APP_SECRET_KEY=<32+ random chars>
LI_CLIENT_ID=<LinkedIn app client id>
LI_CLIENT_SECRET=<LinkedIn app client secret>
LI_REDIRECT_URI=https://linkedin.nabuxai.com/linkedin/callback
LI_VERSION=202608
LI_SCOPES=openid,profile,w_member_social
INTERNAL_SERVICE_TOKEN=<random server-to-server secret>

Do not commit secrets.

NabuGen/internal API

GET  /internal/v1/accounts/{account_key}
POST /internal/v1/accounts/{account_key}/publish/text

The publish endpoint defaults to the authenticated member; an approved organization URN can be provided as actor_urn.

Security

• No LinkedIn password, cookie or browser-session automation.

• Official OAuth/API only.

• Platform credentials encrypted at rest.

• Owner/account isolation.

• MCP clients never receive LinkedIn access tokens.

• Generic escape hatch is GET-only and only targets LinkedIn /rest paths.

Status

Code is deployment-shaped and CI-tested. Real E2E organization features require the applicable LinkedIn developer product approvals, scopes, organization role, production HTTPS/DNS and a real LinkedIn authorization.