One endpoint. One credential. Your own LinkedIn account.

One endpoint, one credential

There is nothing to install and nothing to run. The hosted endpoint is a URL we operate: https://topclozer.com/api/mcp, spoken to with JSON-RPC 2.0 over HTTP POST, authenticated with a workspace API key. Your MCP client holds the key; we hold the server. A GET to the same URL answers with the server name, version and tool list without any credential at all, so you can confirm it is reachable before you wire anything up.

The key identifies a workspace, and every tool call is scoped to that workspace in the SQL that serves it. An agent cannot name a different workspace in its arguments — there is no argument for it. Minting a second key does not buy a second rate-limit allowance either; the budget is counted per workspace.

What the tools are

Three groups, and the distinction between them is the one that governs how you use this server: whether a call reaches LinkedIn, reads your own outreach data, or reads the product catalogue. This list is generated from the same registries the endpoint serves, so it cannot describe a tool the server does not implement. Your own tools/list response is the final authority for what your key can call today.

Reaches LinkedIn · rate limited

Reads your outreach workspace

Reads and operates the platform

The platform surface is how an AI client shops: search the capabilities before the products, because a capability names what performs it — a live tool, a written skill, a workflow, or nothing yet. A capability nothing can fulfil is marked planned and is never returned as available. The store reads the same rows.

Connect a client

Claude Code, in one command. Claude Desktop, Cursor, VS Code and ChatGPT each have their own setup page under the MCP docs, with the exact config block for that client.

claude mcp add --transport http topclozer https://topclozer.com/api/mcp \
  --header "Authorization: Bearer tcz_live_YOUR_KEY"

Prove the connection before you trust it. This returns every tool with its input schema:

curl -s https://topclozer.com/api/mcp \
  -H "Authorization: Bearer tcz_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Whose LinkedIn account this is

Yours. Every LinkedIn call runs through a sender account connected to your workspace, and it returns what that account can see — the same data, and the same limits, as the person logged into it. We do not operate a shared pool of accounts, we do not proxy your calls through someone else's session, and we do not sell accounts. With no connected account, the LinkedIn tools return a readable error rather than an empty result an agent would mistake for an answer.

Limits and boundaries

19 of the 65 tools write anything at all, and none of them acts on LinkedIn: connect_linkedin_account, propose_connection_request, propose_message, propose_profile_visit, propose_inmail, propose_reply, propose_withdraw_invitation, propose_accept_invitation, propose_ignore_invitation, propose_follow, propose_unfollow, propose_endorsement, propose_post_reaction, propose_comment, propose_post, propose_message_reaction, add_do_not_contact, pause_campaign and install_product. The propose_* tools queue an action for a person to approve; the others change only this workspace. Everything else reads.

• No sending without a person. No tool sends an invite, a message, a reply, a follow or a like by itself. An agent can propose any of them — and a comment, a reaction, an InMail, a profile visit or a post; each waits in the console's Approvals and goes out only after a person approves it, under the account's Smart Limits. Sending is the irreversible action, and an agent having a bad hour should not be able to burn an account.
• The LinkedIn tools share a budget of 30 calls per 5 minutes, per workspace, enforced with HTTP 429 and a Retry-After header. One search returns up to 50 profiles, so the budget stretches further than the number suggests. This is the limit that stops a retry loop reaching LinkedIn.
• The workspace and platform tools are not limited. They read this server's own database and cost nothing — including the two usage tools.
• install_product records, it does not run. It appends a real installation row so your library and any later run history point at something that exists. It copies no files, configures no client and executes nothing.
• A priced product cannot be installed until it is paid for. No payment processor is connected to this server, so nothing reaches the paid state, so today that gate refuses every priced product and says exactly that. Free products install normally.
• Project context is read-only here. An agent can read the company, offer, ICP and voice a project holds; it cannot rewrite them. An agent that could edit the brief it is judged against can move its own goalposts.
• No MCP resources or prompts, no SSE, no OAuth. The server advertises the tools capability only, answers 405 to a stream request, and authenticates with a workspace API key.

What is not built yet

Stated here rather than discovered later. None of these are close to shipping quietly; each one is a real gap with a real reason.

• No hosted runner. The hosted install target records a seat and reserves the install. Nothing executes a store product on our machines, so no run in your history will ever be one. The execution ledger that get_platform_usage reads is not empty, though: it records the LinkedIn tool calls you make through this endpoint, the installs you perform, and the drafting and sending the outreach engine does on a seat — and the tool says which of those it is counting rather than returning four zeroes and letting them read as a slow month.
• No payments. Checkout records a genuine pending purchase and tells you nothing has been charged. There is no processor, no card form and no key. The state machine behind it is real and a verified webhook is the only thing that will ever mark a purchase paid.
• No product action grants or spends a credit. check_credits reads a real ledger, and the only thing that writes to it is a TopClozer operator posting an adjustment by hand — a support path, not a product one. A zero balance means the ledger is empty, not that an allowance ran out. The tool says that in the response.
• No seat enforcement. A subscription records how many seats it covers; nothing counts connected accounts against that number.
• Not everything LinkedIn has. People, company, post and job search, profiles in depth, companies, posts and their engagement, the inbox and the network are implemented; invites, messages, InMails, comments, reactions, follows, endorsements and posts exist as proposals. Recruiter projects, voice notes, group conversations and editing the account's own profile are not, and anything that would need them is marked planned in the catalogue rather than implied.

What it costs

The endpoint is part of the software plan — there is no separate API charge and no separate MCP tier. What it does not include is a LinkedIn account; that is a separate decision with its own trade-offs. Current numbers are on the pricing page, and what runs here rather than in your own client is the hosted seat.

FAQ

Does LinkedIn approve of this endpoint?

No, and we publish no claim that it does. LinkedIn does not endorse, certify or partner with this product, and there is no LinkedIn programme that would let us say otherwise. What we can tell you is exactly how it works: LinkedIn calls run through an account you connected, at the pace of a person using it, and nothing here sends anything. Anyone telling you their LinkedIn tool is sanctioned is telling you something LinkedIn has not said.

Can an account be restricted for using this?

Yes. Any automation touching LinkedIn carries that risk, this one included, and nobody who sells you a tool can promise otherwise. What reduces the risk is what this endpoint already does: read-only LinkedIn tools, a workspace rate limit that an agent in a retry loop cannot talk its way past, and no sending tool at all. What raises it most is pointing automation at your personal profile, which also breaks LinkedIn's User Agreement.

Whose LinkedIn account do the tools run on?

Yours — a sender account you connected to your workspace. We do not run a shared pool, we do not proxy your calls through someone else's session, and we do not sell accounts. If no account is connected, the LinkedIn tools return a readable error instead of returning nothing and letting an agent draw conclusions from silence.

Is this hosted, or do I run something?

Hosted. It is one HTTPS URL we operate; there is nothing to install, no local process and no Docker image. Your client holds a workspace API key and speaks JSON-RPC over HTTP POST to it.

Can Claude buy something through this?

It can search the catalogue, read a product in full and record an installation of a free product. It cannot pay for anything: no payment processor is connected to this server, so a priced product cannot reach the paid state and install_product refuses it with that sentence rather than a vaguer one. Buying stays a decision a person makes on the product page.

Is the transport SSE?

No. HTTP POST with a JSON body and a JSON response — the subset of Streamable HTTP every MCP client speaks. A GET asking for text/event-stream answers 405, because the server has no messages of its own to push.