Does LinkedIn approve of this endpoint?

No, and we publish no claim that it does. LinkedIn does not endorse, certify or partner with this product, and there is no LinkedIn programme that would let us say otherwise. What we can tell you is exactly how it works: LinkedIn calls run through an account you connected, at the pace of a person using it, and nothing here sends anything. Anyone telling you their LinkedIn tool is sanctioned is telling you something LinkedIn has not said.

Can an account be restricted for using this?

Yes. Any automation touching LinkedIn carries that risk, this one included, and nobody who sells you a tool can promise otherwise. What reduces the risk is what this endpoint already does: read-only LinkedIn tools, a workspace rate limit that an agent in a retry loop cannot talk its way past, and no sending tool at all. What raises it most is pointing automation at your personal profile, which also breaks LinkedIn's User Agreement.

Whose LinkedIn account do the tools run on?

Yours — a sender account you connected to your workspace. We do not run a shared pool, we do not proxy your calls through someone else's session, and we do not sell accounts. If no account is connected, the LinkedIn tools return a readable error instead of returning nothing and letting an agent draw conclusions from silence.

Is this hosted, or do I run something?

Hosted. It is one HTTPS URL we operate; there is nothing to install, no local process and no Docker image. Your client holds a workspace API key and speaks JSON-RPC over HTTP POST to it.

Can Claude buy something through this?

It can search the catalogue, read a product in full and record an installation of a free product. It cannot pay for anything: no payment processor is connected to this server, so a priced product cannot reach the paid state and install_product refuses it with that sentence rather than a vaguer one. Buying stays a decision a person makes on the product page.

Is the transport SSE?

No. HTTP POST with a JSON body and a JSON response — the subset of Streamable HTTP every MCP client speaks. A GET asking for text/event-stream answers 405, because the server has no messages of its own to push.

The hosted MCP endpoint

One endpoint, one credential

There is nothing to install and nothing to run. The hosted endpoint is a URL we operate: https://topclozer.com/api/mcp, spoken to with JSON-RPC 2.0 over HTTP POST, authenticated with a workspace API key. Your MCP client holds the key; we hold the server. A GET to the same URL answers with the server name, version and tool list without any credential at all, so you can confirm it is reachable before you wire anything up.

The key identifies a workspace, and every tool call is scoped to that workspace in the SQL that serves it. An agent cannot name a different workspace in its arguments — there is no argument for it. Minting a second key does not buy a second rate-limit allowance either; the budget is counted per workspace.

What the tools are

Three groups, and the distinction between them is the one that governs how you use this server: whether a call reaches LinkedIn, reads your own outreach data, or reads the product catalogue. This list is generated from the same registries the endpoint serves, so it cannot describe a tool the server does not implement. Your own tools/list response is the final authority for what your key can call today.

Reaches LinkedIn · rate limited

search_linkedin_peopleSearch LinkedIn for people matching an ICP, through a connected sender accountread-only

get_linkedin_profileRead one LinkedIn profile: identity, current role, followers, job-change signal and latest postread-only

get_linkedin_postsRecent posts by a LinkedIn member, newest firstread-only

list_linkedin_connectionsFirst-degree connections of a connected sender accountread-only

Reads your outreach workspace

list_sender_accountsThe LinkedIn accounts this workspace can act as, with their status, warm-up stage and remaining daily budgetread-only

get_usageHow many LinkedIn tool calls this workspace has made this month, and the rate limit in forceread-only

list_campaignsList all campaigns with performance statsread-only

get_statsGet workspace-wide outreach statsread-only

list_leadsList lead lists and leadsread-only

get_inboxGet unified inbox conversationsread-only

list_tasksList drafts waiting for approvalread-only

pause_campaignPause a campaign by idwrites

Reads and operates the platform

search_capabilitiesSearch what TopClozer products can actually do, and what performs each capability todayread-only

search_productsSearch the TopClozer catalogue by outcome, kind, tier, price, risk or capabilityread-only

get_productOne product in full: capabilities, risk, price, and whether this workspace has bought or installed itread-only

install_productRecord an installation of a product into an AI client or the hosted runner. Writes a row; runs nothing.writes

list_installationsWhat this workspace has installed, where, and what it paid forread-only

list_projectsThe projects in this workspace, with how complete each one's context isread-only

get_project_contextThe reusable company / ICP / offer / voice record an agent should read before it writes anythingread-only

check_creditsThe workspace credit balance and the ledger entries behind itread-only

get_platform_usageWhat this workspace owns and has run: installs, purchases, the hosted seat, credits and the execution ledgerread-only

The platform surface is how an AI client shops: search the capabilities before the products, because a capability names what performs it — a live tool, a written skill, a workflow, or nothing yet. A capability nothing can fulfil is marked planned and is never returned as available. The store reads the same rows.

Connect a client

Claude Code, in one command. Claude Desktop, Cursor, VS Code and ChatGPT each have their own setup page under the MCP docs, with the exact config block for that client.

claude code

claude mcp add --transport http topclozer https://topclozer.com/api/mcp \
  --header "Authorization: Bearer tcz_live_YOUR_KEY"

Prove the connection before you trust it. This returns every tool with its input schema:

curl

curl -s https://topclozer.com/api/mcp \
  -H "Authorization: Bearer tcz_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Three ways to present the key

Authorization: Bearer tcz_live_… is the one to use. X-Api-Key exists for clients that reserve the Authorization header, and ?key= for clients whose UI accepts nothing but a URL — it works, but query strings land in access logs, so prefer a header when you have the choice.

Whose LinkedIn account this is

Yours. Every LinkedIn call runs through a sender account connected to your workspace, and it returns what that account can see — the same data, and the same limits, as the person logged into it. We do not operate a shared pool of accounts, we do not proxy your calls through someone else's session, and we do not sell accounts. With no connected account, the LinkedIn tools return a readable error rather than an empty result an agent would mistake for an answer.

We publish no claim of LinkedIn's blessing

LinkedIn does not endorse, certify or partner with this product, and no MCP server for LinkedIn has that status — there is no programme that grants it. Any automation touching LinkedIn can get an account restricted, including this one, and we will not tell you otherwise. What we will tell you is what the server does: reads only, at a limited rate, with no way to send. Pointing automation at your personal profile breaks LinkedIn's User Agreement and is the ordinary way a profile ends up restricted; the alternatives are compared on accounts for agents.

Limits and read-only boundaries

Two of the 21 tools write anything at all, and neither writes to LinkedIn: pause_campaign and install_product. Everything else reads.

No sending, at all. No tool sends an invite, a message, a reply, a follow or a like. Outbound is released by the product itself under the workspace sending policy — by default, after a person approves each draft. Sending is the irreversible action, and an agent having a bad hour should not be able to burn an account.
The LinkedIn tools share a budget of 30 calls per 5 minutes, per workspace, enforced with HTTP 429 and a Retry-After header. One search returns up to 50 profiles, so the budget stretches further than the number suggests. This is the limit that stops a retry loop reaching LinkedIn.
The workspace and platform tools are not limited. They read this server's own database and cost nothing — including the two usage tools.
install_product records, it does not run. It appends a real installation row so your library and any later run history point at something that exists. It copies no files, configures no client and executes nothing.
A priced product cannot be installed until it is paid for. No payment processor is connected to this server, so nothing reaches the paid state, so today that gate refuses every priced product and says exactly that. Free products install normally.
Project context is read-only here. An agent can read the company, offer, ICP and voice a project holds; it cannot rewrite them. An agent that could edit the brief it is judged against can move its own goalposts.
No MCP resources or prompts, no SSE, no OAuth. The server advertises the tools capability only, answers 405 to a stream request, and authenticates with a workspace API key.

What is not built yet

Stated here rather than discovered later. None of these are close to shipping quietly; each one is a real gap with a real reason.

No hosted runner. The hosted install target records a seat and reserves the install. Nothing executes a store product on our machines, so no run in your history will ever be one. The execution ledger that get_platform_usage reads is not empty, though: it records the LinkedIn tool calls you make through this endpoint, the installs you perform, and the drafting and sending the outreach engine does on a seat — and the tool says which of those it is counting rather than returning four zeroes and letting them read as a slow month.
No payments. Checkout records a genuine pending purchase and tells you nothing has been charged. There is no processor, no card form and no key. The state machine behind it is real and a verified webhook is the only thing that will ever mark a purchase paid.
No product action grants or spends a credit. check_credits reads a real ledger, and the only thing that writes to it is a TopClozer operator posting an adjustment by hand — a support path, not a product one. A zero balance means the ledger is empty, not that an allowance ran out. The tool says that in the response.
No seat enforcement. A subscription records how many seats it covers; nothing counts connected accounts against that number.
People only, on LinkedIn. People search, profiles, posts and connections are implemented. Company search, job search and post engagement are not, and the capabilities that would need them are marked planned in the catalogue rather than implied.

What it costs

The endpoint is part of the software plan — there is no separate API charge and no separate MCP tier. What it does not include is a LinkedIn account; that is a separate decision with its own trade-offs. Current numbers are on the pricing page, and what runs here rather than in your own client is the hosted seat.

FAQ

Does LinkedIn approve of this endpoint?: No, and we publish no claim that it does. LinkedIn does not endorse, certify or partner with this product, and there is no LinkedIn programme that would let us say otherwise. What we can tell you is exactly how it works: LinkedIn calls run through an account you connected, at the pace of a person using it, and nothing here sends anything. Anyone telling you their LinkedIn tool is sanctioned is telling you something LinkedIn has not said.
Can an account be restricted for using this?: Yes. Any automation touching LinkedIn carries that risk, this one included, and nobody who sells you a tool can promise otherwise. What reduces the risk is what this endpoint already does: read-only LinkedIn tools, a workspace rate limit that an agent in a retry loop cannot talk its way past, and no sending tool at all. What raises it most is pointing automation at your personal profile, which also breaks LinkedIn's User Agreement.
Whose LinkedIn account do the tools run on?: Yours — a sender account you connected to your workspace. We do not run a shared pool, we do not proxy your calls through someone else's session, and we do not sell accounts. If no account is connected, the LinkedIn tools return a readable error instead of returning nothing and letting an agent draw conclusions from silence.
Is this hosted, or do I run something?: Hosted. It is one HTTPS URL we operate; there is nothing to install, no local process and no Docker image. Your client holds a workspace API key and speaks JSON-RPC over HTTP POST to it.
Can Claude buy something through this?: It can search the catalogue, read a product in full and record an installation of a free product. It cannot pay for anything: no payment processor is connected to this server, so a priced product cannot reach the paid state and install_product refuses it with that sentence rather than a vaguer one. Buying stays a decision a person makes on the product page.
Is the transport SSE?: No. HTTP POST with a JSON body and a JSON response — the subset of Streamable HTTP every MCP client speaks. A GET asking for text/event-stream answers 405, because the server has no messages of its own to push.

Get an API key Protocol details

One endpoint. One credential. Your own LinkedIn account.