> **Community source release (MIT).** Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

# LinkedIn MCP by Nabux

Multi-user LinkedIn MCP Gateway using LinkedIn's official OAuth and REST APIs.

Production target: `https://linkedin.nabuxai.com`  
MCP: `https://linkedin.nabuxai.com/mcp`  
OAuth callback: `https://linkedin.nabuxai.com/linkedin/callback`

The gateway pins LinkedIn Marketing API header version **202608** by default and sends `X-Restli-Protocol-Version: 2.0.0` for `/rest` calls.

## Baseline vs Company Page access

The self-service baseline requests:

```text
openid
profile
w_member_social
```

This supports authenticated member identity and member posting.

After LinkedIn grants your app Community Management / organization permissions, append the scopes your approved product exposes, commonly:

```text
r_organization_admin
r_organization_social
w_organization_social
```

`r_member_social` is restricted and should only be requested after LinkedIn grants it. The gateway does not require it for creating member posts.

## Tools

- `linkedin_accounts`
- `linkedin_profile`
- `linkedin_organization_roles`
- `linkedin_publish_text`
- `linkedin_publish_article`
- `linkedin_list_posts`
- `linkedin_get_post`
- `linkedin_delete_post`
- `linkedin_comments`
- `linkedin_comment`
- `linkedin_reactions`
- `linkedin_react`
- `linkedin_follower_statistics`
- `linkedin_page_statistics`
- `linkedin_share_statistics`
- `linkedin_rest_get` — GET-only, relative `/rest` escape hatch

Member operations default to the authenticated member URN. Organization operations accept an explicit `urn:li:organization:{id}` actor, subject to LinkedIn's roles and granted app scopes.

## Company Page discovery

`linkedin_organization_roles` uses the official `organizationAcls?q=roleAssignee` finder. LinkedIn roles such as `ADMINISTRATOR` and `CONTENT_ADMINISTRATOR` determine which Page operations a member may perform. New integrations may also use LinkedIn's permission-based `organizationAuthorizations` model as their approved access evolves.

## Tokens

LinkedIn access tokens are encrypted at rest. If LinkedIn issues a programmatic refresh token to the app, that refresh token is also encrypted and used automatically near expiry. Programmatic refresh tokens are not generally issued to every LinkedIn app; when no refresh token exists, the dashboard preserves the access-token expiry and the member must reconnect when needed.

MCP tokens are separate from LinkedIn credentials and stored only as hashes.

## Coolify

Deploy `feature/linkedin-mcp-gateway` using `docker-compose.coolify.yml`, domain `linkedin.nabuxai.com`, container port 8000, and persistent `/data`.

```text
PUBLIC_BASE_URL=https://linkedin.nabuxai.com
APP_SECRET_KEY=<32+ random chars>
LI_CLIENT_ID=<LinkedIn app client id>
LI_CLIENT_SECRET=<LinkedIn app client secret>
LI_REDIRECT_URI=https://linkedin.nabuxai.com/linkedin/callback
LI_VERSION=202608
LI_SCOPES=openid,profile,w_member_social
INTERNAL_SERVICE_TOKEN=<random server-to-server secret>
```

Do not commit secrets.

## NabuGen/internal API

```text
GET  /internal/v1/accounts/{account_key}
POST /internal/v1/accounts/{account_key}/publish/text
```

The publish endpoint defaults to the authenticated member; an approved organization URN can be provided as `actor_urn`.

## Security

- No LinkedIn password, cookie or browser-session automation.
- Official OAuth/API only.
- Platform credentials encrypted at rest.
- Owner/account isolation.
- MCP clients never receive LinkedIn access tokens.
- Generic escape hatch is GET-only and only targets LinkedIn `/rest` paths.

## Status

Code is deployment-shaped and CI-tested. Real E2E organization features require the applicable LinkedIn developer product approvals, scopes, organization role, production HTTPS/DNS and a real LinkedIn authorization.