The best LinkedIn MCP server for reading and sending DMs

Short answer: most tools labelled "LinkedIn MCP" cannot touch your inbox at all. Three of the six below are publishing or outbound products that ship no inbox tool, and one of those three says so in its own documentation. Check that first and the list gets short fast. Every figure here comes from the vendor's own pages, checked 1 September 2026.

Publishing and messaging are different products with the same label

A LinkedIn MCP server can be built two ways. On LinkedIn's official partner APIs, which cover posting and analytics for accounts and pages you administer. Or on an authenticated LinkedIn session, which is what a hosted messaging layer gives you.

Only the second kind can open your inbox. The first kind is often the better engineered product and often cheaper, and it will never answer a DM. Buying the wrong one is the common mistake, and vendor homepages do not make it obvious, because both say "LinkedIn" and "MCP" and "agent".

Six servers compared

Who each one is genuinely best for

Outstand, $19/mo. Best for publishing.

If you want an agent that writes and posts to LinkedIn, buy Outstand and stop reading. It is $19 a month including 3,000 posts, then $0.007 per post. It runs on OAuth against LinkedIn's documented API, and their own line is worth repeating: "Every LinkedIn action goes through LinkedIn's documented API over an OAuth connection you approved. Nothing is scraped, no session cookie is used." It has 28 tools, 15 of them LinkedIn-specific, all posts, media, accounts and analytics.

They also publish the best retention detail of anyone here: account data for 90 days after deletion, usage logs 2 years, analytics 26 months, billing 7 years, with PostHog, Cloudflare and Neon named as subprocessors. SOC 2 is described as in progress, not certified.

Two things to know. There is no inbox tool, so it cannot help with DMs. And there is no approval queue, by design: "Let your agents post on their own." Their free tier claim also contradicts itself, with the MCP page saying no credit card needed and the homepage saying $19 to start.

Postbeam, $49 to $99/mo. Best for publishing plus engagement analytics.

Also a publishing product, on LinkedIn's official partner APIs with revocable OAuth, so it never sees your password. Solo is $99 list with a $49 offer, and there is a 7-day free trial. It adds engagement capture and analytics on top of posting.

It does not do DMs, and it is direct about that: "Does Postbeam auto-connect or auto-DM people? No." Retention is stated as while your account is active with deletion within 30 days, though subprocessors are named by category rather than by vendor and there is no security page.

Unipile, €49/mo floor. Best if you are building your own product.

Unipile is infrastructure, and it is very good at being infrastructure. Their own positioning says it: integrations "into your software applications" and "Avoid the complexities of building messaging functionality from scratch", with "Trusted by 4,000+ SaaS Platforms" on the homepage. If you are shipping a product that needs LinkedIn messaging, this is the right layer.

It is the wrong layer if you want a working inbox this afternoon. Their MCP server has five tools and none are LinkedIn-specific: list-endpoints, get-endpoint, search-endpoints, execute-request, get-server-variables. It is an OpenAPI explorer. Reaching your DMs means hand-constructing a request through the generic execute-request tool.

Pricing is a €49 a month floor plus VAT, billed on the peak number of linked accounts in a 30-day period, so one individual pays the floor. There is a 7-day free trial with no credit card. Two lines from their docs tell you what you are signing up to build. On limits, as of 1 September 2026: "We don't enforce any limits on our side, so you'll have the exact same limit in the LinkedIn UI", with quota management marked coming soon. On scheduling: "Store all generated slots in your database." Their documentation lists no approval-queue endpoint.

Disclosure: Iridium's LinkedIn connectivity runs on Unipile.

Fintalio, €69/mo. Best for outbound sequences from an agent.

Fintalio is developer-focused and ships real sequence tools. One plan, €69 a month, no card to start, with limits published in a machine-readable plan endpoint: 50 messages and 50 connections a day. That connection ceiling is higher than most managed products allow.

It cannot read your inbox, and it says so: "What Fintalio MCP does not expose in v0.0.1: no profile-scraping tool, no feed reader, no post-publishing, no inbox read, no LinkedIn-search MCP tool." The get_contact tool returns the last ten messages for one contact you already name.

Two other things to weigh. Their approval step is a confirm=true parameter passed by the calling agent, so the agent confirms its own send, and no separate human gate is documented. And /privacy, /terms and /security all return 404, with no stated retention period and no subprocessor list, while their own security post advises readers to "Ask for the specific time-to-purge SLA in writing". Longer comparison here.

Item 12, $49/seat/mo. Best if you want LinkedIn and email in one seat.

Item 12 is a real competitor with a real review queue, and the queue is the part worth paying for: "Every LinkedIn send from MCP lands in the same human review queue as the web app." Their text hedges with "when human review is enabled", and we could not confirm whether it can be turned off.

A seat is $49 a month and covers one LinkedIn account plus one email account with 200 credits a month, no rollover. Agency seats are $89. The trial is 7 days and requires a card on file. Connection is described as a secure LinkedIn sign-in in a new tab, hosted OAuth, with "LinkedIn connectivity and messaging infrastructure through authorized integration partners".

What we could not verify: a documented inbox-read tool. Ask them if reading is the job. Their legal pages exist but render client-side only, retention is "while your account is active and for a reasonable period afterward" with no defined period and deletion by request, and security is described as encryption in transit, access controls and isolated workspace data, with no encryption-at-rest claim and no SOC 2.

How to evaluate any of them in five questions

These work on any vendor, including the ones not on this page.

• Does it read the inbox, or only send? Look for a tool that lists threads, not one that fetches a contact you already named. Read the tool list, not the homepage.
• Where is my LinkedIn password entered? Best case is the vendor's hosted sign-in page and an opaque handle afterward. Worst case is pasting your li_at session cookie into a config file. That cookie is a bearer credential, it acts as you until it expires, and it commonly survives a password change.
• Where are the limits enforced? A cap in a prompt is a suggestion. Ask whether the server refuses the send or whether the model is trusted to count. Ask what happens on breach, because deferring is safer than failing and much safer than sending.
• Is there an activity log? You want to ask what was sent yesterday and read the exact text back, including failures. If the only record is the LinkedIn UI, you will not be able to reconstruct what an agent did.
• What is the retention period, in days? Other people's messages and profile data end up in this system. "For a reasonable period" is not an answer. Neither is a 404. Ask for the number and ask what happens on account deletion.

If the job is DMs

That leaves a short list. Item 12 if you need email in the same seat and the card on file is fine. Iridium if you want the cheapest option that opens the inbox.

Iridium is $20 a month for one LinkedIn account, with a 7-day trial and no card. Your agent can sort what arrived by whatever labels you pass it, search message bodies with real operators like is:unread and company:, separate the threads you ghosted from the ones you owe an answer, summarize a long thread, and draft a reply from the full history. Replies inside an existing thread do not count against the daily cap, because answering someone is not a new connection.

Every outgoing message is a draft first. Approving is a separate call and it is the only thing that sends. Caps are enforced on the server: 25 outreach sends a day, 14 invites, 90 invites per rolling 7 days, and a breach defers the send to the next morning rather than dropping it. The activity log is append-only by design and scoped to your account. Discovered profile and post data is purged by a daily job, seven days by default. Sequences ship disabled and return 501, which is a real limitation and a deliberate one.

Questions people ask next