Best LinkedIn MCP Server to Read LinkedIn Inbox Messages

Published On October 14, 2026

Blurred dark-mode LinkedIn messaging window behind an AI assistant chat window on a blue-to-indigo gradient desktop

Summary

No official LinkedIn MCP server exists; every tool that reads personal DM threads operates outside LinkedIn's approved developer platform, and LinkedIn's User Agreement restricts automated access to the site.
OAuth tools are account-safe but cannot reach the inbox; session-based tools reach it but carry real account-restriction risk.
Kondo organizes LinkedIn DMs with labels, reminders and CRM sync — and its LinkedIn MCP server reads messages and drafts replies without ever sending.

Managing a LinkedIn inbox at volume is a material operational problem. Recruiters, founders, and sales teams report the same pattern: messages accumulate faster than LinkedIn's native interface can process them, filtering is limited, threading is cumbersome, and no programmatic pathway exists to connect the inbox to a CRM. The natural answer is a LinkedIn MCP server that reads inbox messages and exposes them to an AI client or workflow tool.

The landscape is harder to navigate than it appears. Most tools marketed as LinkedIn MCP servers handle profile scraping, post scheduling, or connection requests. Very few read personal direct message threads. This article covers only those that can, ranks them, and explains the technical and legal constraints that govern them all.

The first constraint is absolute: no official LinkedIn MCP server exists. Every option covered here is a third-party tool operating outside LinkedIn's approved API surface. That carries real risk, which this article addresses.

Why There Is No Official Path to Your Inbox

LinkedIn's official API programme does offer messaging endpoints, but none serves this use case. The enterprise-gated surfaces, including the Marketing API, Sales Navigator API, Recruiter API, and Pages Messaging API, are purpose-built for institutional accounts and specific commercial workflows. They are not available to individual developers building personal inbox tools.

The self-serve OAuth path is limited on the same basis. The w_member_social scope, the first most developers encounter, authorises posting, commenting, and liking on behalf of a user. It does not grant access to the member's incoming message threads.

The Risk Framework Before the Rankings

Understanding the risk attached to any LinkedIn MCP server reading inbox messages requires understanding authentication.

OAuth-based tools act as an approved LinkedIn developer application. Access is member-authorised and revocable. These tools carry low account risk but cannot read the member inbox. They are safe and categorically limited.

Session-based tools drive a logged-in LinkedIn session directly, either via session cookie or a headless browser. This is the only method that reaches the personal inbox. It also operates outside LinkedIn's approved developer platform, with real account-restriction risk.

Section 8.2 of LinkedIn's User Agreement states that members must not use "bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages." The clause covers access broadly, which means read-only inbox access already carries account-restriction risk. Tools that can also send messages fall under the explicitly named "send or redirect messages" prohibition, making them the most exposed category.

The 4 Best LinkedIn MCP Servers for Reading Messages

Tools focused exclusively on posts, profiles, or jobs, including OAuth-based servers and aggregation layers that list no messaging endpoints, are excluded from this ranking. The four servers below are those that solve the inbox problem.

1. Kondo: For Safe Read + Draft Window With No Autonomous Send

Kondo's LinkedIn MCP server takes a deliberately different approach to the problem. It reads the user's own inbox through the user's own browser session and drafts replies for review, and it is engineered so the agent cannot send anything autonomously. Replies are saved as drafts inside Kondo; nothing reaches LinkedIn until the draft is opened, reviewed, and sent by the user.

Two architectural choices set it apart from the session-automation tools below. First, messages are read through the user's own browser session and remain on the user's own device — the only outside service that sees message content is the AI provider the user chooses to connect. The agent never sees your LinkedIn credentials. Second, the send path is fully blocked at the protocol level, so the agent physically cannot transmit a message, run an outreach sequence, or act autonomously. It can list chats, search conversations, apply labels, set reminders, archive, and draft.

That read + draft posture removes the most explicitly named prohibition ("send or redirect messages") from the equation while still delivering the core value: surfacing unanswered leads, triaging chats, and drafting replies for a human gatekeeper to approve. Kondo works with Claude, ChatGPT, Gemini, Copilot, Cursor, and any MCP client supporting Streamable HTTP — follow the step-by-step setup guide to connect your agent in minutes.

Kondo is the right choice for sellers, recruiters, and founders who want an AI agent in the inbox but will do not want to expose their credentials.

ToS risk level: Low. Agent activity happens in the user's own browser session and is paced like one person; the blocked send path removes the highest-risk prohibited action.

2. Linked API: For Full Read/Write and B2B Applications

Linked API provides a complete messaging feature set of any LinkedIn MCP server available. Its toolkit includes get_inbox, get_conversation, sync_inbox for whole-inbox polling, send_message for programmatic sending or replying to threads, and manage_conversation for state changes. Sales Navigator subscribers also receive variants such as nv_send_message mapped to their premium account.

The mechanism is a dedicated cloud browser that runs on the client's behalf at a pace designed to resemble human interaction. This reduces, but does not eliminate, detection risk. The full tools list also includes admin endpoints, admin_get_seats and admin_set_limits, which make it viable for teams managing multiple LinkedIn accounts from a single application.

Pricing runs approximately $49/month per seat.

Linked API is the right choice for product builders integrating two-way LinkedIn messaging into a CRM or outreach workflow. The read-write capability and multi-seat management distinguish it from the open-source option below.

ToS risk level: High. Full read/write via session automation places it in the most exposed category.

3. stickerdaniel/linkedin-mcp-server: Free and Open-Source Option

The stickerdaniel/linkedin-mcp-server is an open-source project, licensed under Apache 2.0, with approximately 2,500 to 3,000 GitHub stars. It reads the LinkedIn inbox and full message threads using Chromium browser automation, authenticated via the li_at session cookie.

Message replying and connection requests are documented as in-progress rather than stable. This positions the server as an effectively read-mostly tool, suited to a narrower set of use cases: pulling message data into a personal dashboard, building a lightweight message CRM, or analysing conversation history without needing to send replies programmatically.

Individual developers and researchers comfortable with self-hosting and without write requirements will find this the most practical starting point. The cost is zero.

ToS risk level: Medium-High. Session automation is still a ToS violation, but the absence of outbound messaging removes the most explicitly named prohibited action.

4. Unipile: Multi-Channel Messaging API for Developers

Unipile approaches the problem differently. Rather than a LinkedIn-only tool, it provides a single managed REST API and webhook layer across LinkedIn, WhatsApp, email, and other messaging channels. LinkedIn inbox access, both read and write, is one supported channel within that unified surface.

The platform handles proxy management and quota controls internally, reducing the practical detection risk relative to a self-hosted session tool, though the underlying mechanism remains session automation. Unipile ships an MCP server compatible with Cursor, Claude Code, and Gemini CLI.

Pricing starts at €49/month for up to 10 connected accounts, with no usage-based fees on top.

Unipile is best suited to B2B founders and product teams building multi-channel communication tools where LinkedIn messaging is one channel among several. It is infrastructure for developers to build on, not an end-user inbox. The abstraction layer and flat-rate pricing structure make it faster to integrate into a production application than a self-hosted open-source server.

ToS risk level: High, with built-in mitigation features. Session automation remains the foundation, but Unipile's proxy and quota management is designed to reduce the practical exposure.

At-a-Glance Comparison

Choosing the Right Server

The decision comes down to a direct trade-off between capability and account risk. Programmatic inbox access requires session automation, which operates outside LinkedIn's approved developer platform. No currently available method avoids both facts simultaneously.

Given that baseline:

Businesses and professionals who want an AI agent in the inbox without giving up safety and control should start with Kondo. It reads messages and drafts replies through the user's own browser session, and sending is not possible — the agent never transmits anything.
Product builders and commercial application teams should evaluate Unipile for a managed, multi-channel API, or Linked API for maximum LinkedIn-specific control, including Sales Navigator support and multi-seat administration. Both are infrastructure for developers building messaging features; Kondo is an inbox professionals use every day.
Individual developers and hobbyists requiring read-only access to their own inbox could start with the free, open-source stickerdaniel/linkedin-mcp-server before committing to a paid service.
Organisations for which account safety is the overriding priority should use an OAuth-based tool and accept that programmatic inbox access is not available on that path.

Every session-based tool covered here operates outside LinkedIn's approved developer platform. Account restriction or closure is an identified enforcement outcome. Operators should assess that risk against their use case before connecting any LinkedIn MCP server to read inbox messages. Where session automation is a disqualifying condition, a dedicated LinkedIn inbox management tool such as Kondo organizes DMs with labels, reminders, and CRM sync.

Frequently Asked Questions

What is a LinkedIn MCP server?

A LinkedIn MCP server is a third-party tool that connects a LinkedIn account to an AI client or workflow tool using the Model Context Protocol (MCP). It can expose posts, profiles, or inbox messages to tools like Claude, ChatGPT, or Cursor. No official LinkedIn MCP server exists, and only session-based servers reach personal DMs.

Is there an official LinkedIn MCP server from LinkedIn?

No. LinkedIn offers no official MCP server. Its messaging APIs are enterprise-gated, and no self-serve OAuth scope exposes the personal inbox. Every server that reads messages is a third-party tool using session automation, which operates outside LinkedIn's approved developer platform, with real account-restriction risk.

What is the best LinkedIn MCP server for reading messages?

Kondo is the safest pick for most users — it reads messages and drafts replies through your own browser session, with sending fully blocked. For full read/write via session automation, consider Linked API (B2B and CRM), stickerdaniel/linkedin-mcp-server (free, open-source), or Unipile (unified multi-channel API).

Can a LinkedIn MCP server read my DMs without getting my account banned?

Not reliably. Reading DMs requires session automation, which operates outside LinkedIn's approved developer platform and can trigger account restriction or permanent closure. Only OAuth-based tools are safe, but they cannot access the inbox. Treat account risk as the baseline for any server that reads messages.

How do I connect my LinkedIn inbox to a CRM?

A read/write session-based MCP server is required, since OAuth tools cannot access the inbox. Linked API and Unipile support inbox reads, message sends, and multi-seat access; sync via webhooks or polling, then map threads to CRM records. Session automation operates outside LinkedIn's approved developer platform.

Should I use an OAuth-based or session-based LinkedIn MCP server?

The answer depends on the operating priority. OAuth-based tools are safe but cannot read the inbox; they post and comment only. Session-based tools reach the inbox but operate outside LinkedIn's approved developer platform and place the account at risk. Choose OAuth when safety matters most; choose session-based only when inbox access is essential and the risk is acceptable.