Skip to content

nabuxai/nabu-linkedin

v0.1.0

Work with authorized LinkedIn profiles, organization pages, and posts.

GitHubOpen Website

Community source release (MIT). Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

LinkedIn MCP by Nabux

Multi-user LinkedIn MCP Gateway using LinkedIn's official OAuth and REST APIs.

Production target: https://linkedin.nabuxai.com
MCP: https://linkedin.nabuxai.com/mcp
OAuth callback: https://linkedin.nabuxai.com/linkedin/callback

The gateway pins LinkedIn Marketing API header version 202608 by default and sends X-Restli-Protocol-Version: 2.0.0 for /rest calls.

Baseline vs Company Page access

The self-service baseline requests:

openid
profile
w_member_social

This supports authenticated member identity and member posting.

After LinkedIn grants your app Community Management / organization permissions, append the scopes your approved product exposes, commonly:

r_organization_admin
r_organization_social
w_organization_social

r_member_social is restricted and should only be requested after LinkedIn grants it. The gateway does not require it for creating member posts.

Tools

  • linkedin_accounts
  • linkedin_profile
  • linkedin_organization_roles
  • linkedin_publish_text
  • linkedin_publish_article
  • linkedin_list_posts
  • linkedin_get_post
  • linkedin_delete_post
  • linkedin_comments
  • linkedin_comment
  • linkedin_reactions
  • linkedin_react
  • linkedin_follower_statistics
  • linkedin_page_statistics
  • linkedin_share_statistics
  • linkedin_rest_get — GET-only, relative /rest escape hatch

Member operations default to the authenticated member URN. Organization operations accept an explicit urn:li:organization:{id} actor, subject to LinkedIn's roles and granted app scopes.

Company Page discovery

linkedin_organization_roles uses the official organizationAcls?q=roleAssignee finder. LinkedIn roles such as ADMINISTRATOR and CONTENT_ADMINISTRATOR determine which Page operations a member may perform. New integrations may also use LinkedIn's permission-based organizationAuthorizations model as their approved access evolves.

Tokens

LinkedIn access tokens are encrypted at rest. If LinkedIn issues a programmatic refresh token to the app, that refresh token is also encrypted and used automatically near expiry. Programmatic refresh tokens are not generally issued to every LinkedIn app; when no refresh token exists, the dashboard preserves the access-token expiry and the member must reconnect when needed.

MCP tokens are separate from LinkedIn credentials and stored only as hashes.

Coolify

Deploy feature/linkedin-mcp-gateway using docker-compose.coolify.yml, domain linkedin.nabuxai.com, container port 8000, and persistent /data.

PUBLIC_BASE_URL=https://linkedin.nabuxai.com
APP_SECRET_KEY=<32+ random chars>
LI_CLIENT_ID=<LinkedIn app client id>
LI_CLIENT_SECRET=<LinkedIn app client secret>
LI_REDIRECT_URI=https://linkedin.nabuxai.com/linkedin/callback
LI_VERSION=202608
LI_SCOPES=openid,profile,w_member_social
INTERNAL_SERVICE_TOKEN=<random server-to-server secret>

Do not commit secrets.

NabuGen/internal API

GET  /internal/v1/accounts/{account_key}
POST /internal/v1/accounts/{account_key}/publish/text

The publish endpoint defaults to the authenticated member; an approved organization URN can be provided as actor_urn.

Security

  • No LinkedIn password, cookie or browser-session automation.
  • Official OAuth/API only.
  • Platform credentials encrypted at rest.
  • Owner/account isolation.
  • MCP clients never receive LinkedIn access tokens.
  • Generic escape hatch is GET-only and only targets LinkedIn /rest paths.

Status

Code is deployment-shaped and CI-tested. Real E2E organization features require the applicable LinkedIn developer product approvals, scopes, organization role, production HTTPS/DNS and a real LinkedIn authorization.