Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

linkedin-mcp-server

by stickerdaniel/linkedin-mcp-serverApache-2.0 licenceAudited 22 Sep 2026 · source 260c73272252

PyPI mcp-server-linkedin 4.24.4stdiostreamable-http★ 3,579
!CAUTIONGrade D · 69/100 · 22 Sep 2026 · 260c732
3,579GitHub stars
InstallView source on GitHub ↗

Is it safe? With care — CAUTION, grade D (69/100). It exposes 10 tools: 9 read, 1 write and 0 destructive. The audit recorded 35 findings (0 critical, 0 high, 7 medium, 28 low). Maintainer's description: Open-source MCP server for LinkedIn. Give Claude and any MCP-compatible AI agent access to profiles, companies, jobs, and messages.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “linkedin-mcp-server (stickerdaniel/linkedin-mcp-server)”. Retrieved 22 Sep 2026. https://modelsatlas.com/mcp/stickerdaniel/linkedin-mcp-server

Trust audit

Audit 0.4.1 · full source read 22 Sep 2026

Trust score69/100!CAUTION D
0 critical0 high7 medium28 low0 info

35 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared5 observations
  • NetworkDeclared5 observations
  • ShellNone observedNothing seen in the source
  • DependenciesPinnedNothing floats
  • SecretsFoundSee the findings

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

LayerWhat we checkResult
L0 ProvenanceRepo owner, licence, archive status, activityPASS 4 findings
L1 Static sourceSecrets, path traversal, supply chainWARN 21 findings
L2 InstructionsPrompt injection and authority framing in docs and tool descriptionsPASS
L3 InventoryDeclared tools match the sourcePASS
L4 SandboxRun in isolation and watch behaviourSKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

  • Repository owner stickerdanielUser accountAccount type recorded when we read the repository.
  • PackagePublished on PyPImcp-server-linkedin at version 4.24.4
  • LicenceApache-2.0From the repository, as read at the audited commit.
  • Last pushTodayActivity of the repository when we read it.
  • Source commit read260c73272252The audit covers exactly this commit, read on 22 Sep 2026.

Runtime

  • Sandbox runNot run yetThis audit read the source only; it did not execute the server.
  • Tool inventory10 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (35)

Sorted by severity · the 25 most severe of 35 are listed

MEDIUMNetwork egressnet.raw_ip · .agents/skills/2-repro-issue/SKILL.md:79
F-04 Network egressCWE-200 · CWE-319Layer L1
curl -s -D /tmp/repro-$NUM-headers -X POST http://127.0.0.1:$PORT/mcp \
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · .agents/skills/2-repro-issue/SKILL.md:89
F-04 Network egressCWE-200 · CWE-319Layer L1
curl -s -X POST http://127.0.0.1:$PORT/mcp \
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · .agents/skills/2-repro-issue/SKILL.md:109
F-04 Network egressCWE-200 · CWE-319Layer L1
curl -s -X POST http://127.0.0.1:$PORT/mcp \
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · .agents/skills/3-verify-pr-fix/SKILL.md:109
F-04 Network egressCWE-200 · CWE-319Layer L1
curl -s -D /tmp/verify-pr-$PR-headers -X POST http://127.0.0.1:$PORT/mcp \
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · .agents/skills/3-verify-pr-fix/SKILL.md:119
F-04 Network egressCWE-200 · CWE-319Layer L1
curl -s -X POST http://127.0.0.1:$PORT/mcp \
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · tests/test_bootstrap.py:4783
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · tests/test_daemon_election.py:3341
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .coveragerc
F-13 Inventory / provenanceCWE-1104Layer L0
.coveragerc
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .mcpbignore
F-13 Inventory / provenanceCWE-1104Layer L0
.mcpbignore
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .pre-commit-config.yaml
F-13 Inventory / provenanceCWE-1104Layer L0
.pre-commit-config.yaml
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWCode injectioncode.eval_exec · tests/test_daemon_election_collection.py:49
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(compile(source, str(_TEST_MODULE), "exec"), namespace)
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWFilesystem / pathfs.traversal · tests/scraping/test_company.py:92
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
await scraper.scrape_company("../../feed", {"about"})
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · tests/scraping/test_company.py:692
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
await scraper.get_company_employees("../../feed")
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · tests/scraping/test_conversations.py:435
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
await reader._open_conversation_by_username("../../feed")
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · tests/scraping/test_conversations.py:758
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
await reader.get_conversation(thread_id="../../feed")
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · tests/scraping/test_facade_contracts.py:477
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
linkedin_username="../../feed", thread_id="2-direct", index=-1
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.base64_blob · README.md:38
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
[![uvx](https://img.shields.io/badge/uvx-Quick_Install-de5fe9?style=for-the-badge&logo=data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iNDEiIGhlaWdodD0iNDEiIHZpZXdCb3g9IjAgMCA0MSA0MSIgZmlsbD0ibm9uZSIgeG1sbnM
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.base64_blob · README.md:40
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
[![Codex Plugin](https://img.shields.io/badge/Codex-Plugin-24292f?style=for-the-badge&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCI%2BP
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · linkedin_mcp_server/browser_import/extract.py:193
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
encrypted_key = base64.b64decode(payload["os_crypt"]["encrypted_key"])
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · linkedin_mcp_server/process_gate.py:20
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
decoded = bytes.fromhex(nonce)
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · linkedin_mcp_server/process_protocol.py:27
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
decoded = bytes.fromhex(value)
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.rtl_override · tests/test_pr_title.py:147
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"",
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.rtl_override · tests/test_pr_title.py:148
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"",
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.rtl_override · tests/test_pr_title.py:149
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"",
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

10 declared in source · 0 destructive

9 read1 write0 destructive
ToolRiskWhat it does
send_messagewriteNo description in the source
close_sessionreadClose the current browser session and clean up resources.
connect_with_personreadNo description in the source
get_company_employeesreadNo description in the source
get_company_postsreadNo description in the source
get_company_profilereadNo description in the source
get_job_detailsreadNo description in the source
get_sidebar_profilesreadNo description in the source
search_companiesreadNo description in the source
search_peoplereadNo description in the source

Install

Package version 4.24.4 · audited commit 260c732

Read the findings first. The most severe is Network egress (medium) at .agents/skills/2-repro-issue/SKILL.md.

No connect command is recorded for this server yet. Follow the repository's own instructions, and read the findings above first.

Audit history

  1. !CAUTION D 69 / 100

    BLOCK -> CAUTION · 260c73272252

  2. ✕BLOCK D 61 / 100

    First audit · afa0f16d00a3

README badge

For maintainers · updates on every re-audit

ModelsAtlas: CAUTION DMODELSATLASCAUTION · D 
[![ModelsAtlas: CAUTION D](https://modelsatlas.com/mcp/stickerdaniel/linkedin-mcp-server/badge.svg)](https://modelsatlas.com/mcp/stickerdaniel/linkedin-mcp-server/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about linkedin-mcp-server

What is the linkedin-mcp-server MCP server?
Open-source MCP server for LinkedIn. Give Claude and any MCP-compatible AI agent access to profiles, companies, jobs, and messages.
What tools does linkedin-mcp-server expose?
10 in total: 9 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is linkedin-mcp-server safe to connect to an agent?
With care. The audit graded it D (69/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does linkedin-mcp-server need?
It reads PROXY_PASSWORD, PROXY_SERVER and PROXY_USERNAME from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does linkedin-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as mcp-server-linkedin.
How current is this page?
The grade is for one exact copy of the source (260c73272252), read on 2026-09-22. The repository is watched and re-audited when it changes.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.