Skip to content

GTM Otto

by gtmotto.com · remote · no sign-in to list tools · v1.2.1 · published by com.gtmotto

Self-driving LinkedIn prospecting: it sources, warms and invites daily. You approve every message.

Deletes · 6Changes · 8

21 tools: 6 can delete or cancel things, 8 change things and 7 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http linkedin https://agent.gtmotto.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "gtm_source_runs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "gtm_source_runs" says "run": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

21 tools

Deletes or cancels 6Claude Code: deny
  • gtm_approveApprove ONE drafted action by its approvalId (from gtm_list_approvals).Reads text others writeNo findings

    Why it is in this group

    • The name "gtm_approve" says "approve": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Approve ONE drafted action by its approvalId (from gtm_list_approvals). It then leaves on the seat's next slot, inside LinkedIn's limits — this is the human's tap, moved from the cockpit to the chat, so ONLY call it after showing them the draft and getting a yes in this conversation. An already-decided card is refused.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: true
  • gtm_configure_sourceWrite a lane's settings — upload an account list, set the Post-discovery intent and anchors, change the job keywords, move a gate.No findings

    Why it is in this group

    • The description's first verb is "write": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Write a lane's settings — upload an account list, set the Post-discovery intent and anchors, change the job keywords, move a gate. MERGE semantics: only the fields you send change. Lists (companies, postUrls, competitors) REPLACE by default; pass listMode 'append' to add to what is there (deduped, case-insensitive). Caps: 100 companies, 25 posts, 25 anchors — what did not fit comes back in `truncated`. Unknown fields are refused. Saving creates the lane's row if it never had one (OFF, because configuring is not switching on), makes the lane due again immediately and resets its retry backoff; on account_list it also forgets the cached misses so unfound companies are looked up again. Pass `on: true` to switch it on in the same call — refused, with nothing saved, if the lane would still have nothing to run on. Nothing runs inside this call: an ON lane on an ACTIVE play runs on the next tick (≤5 min); otherwise use gtm_run_source. Read gtm_sources_reference for each field's meaning.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: true
  • gtm_forget_harvested_postsThe tuning escape hatch for the post lanes.Can send data outNo findings

    Why it is in this group

    • The name "gtm_forget_harvested_posts" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "gtm_forget_harvested_posts" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    The tuning escape hatch for the post lanes. A post lane remembers every post it already paid to harvest so it never buys the same engagers twice — which makes it impossible to TUNE: change the intent or a gate, run, and the answer is 'no new posts since last time'. This clears that memory so the next run (or gtm_run_source) judges today's posts against the new settings. It COSTS: every forgotten post is a fresh engager fetch. Call it only after a deliberate settings change the human wants re-tested. Only competitor_posts and post_engagers have this memory.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
  • gtm_rejectReject (skip) ONE drafted action by its approvalId.No findings

    Why it is in this group

    • The name "gtm_reject" says "reject": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Reject (skip) ONE drafted action by its approvalId. Nothing is sent; the planner records the decline and re-plans around it instead of proposing the same step again. Ask the human first, as for gtm_approve.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: true
  • gtm_run_source'Run once now' — run ONE lane immediately through the same code the sourcing tick runs, with force: an OFF lane still runs (that is what run-once means while configuring), a DRAFT …Reads text others writeNo findings

    Why it is in this group

    • The name "gtm_run_source" says "run": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    'Run once now' — run ONE lane immediately through the same code the sourcing tick runs, with force: an OFF lane still runs (that is what run-once means while configuring), a DRAFT play still runs (how you try a lane before launch), a PAUSED play does not. REAL: provider calls are made, leads are inserted, the play's daily budget and the org's monthly lead quota are spent. Only call it when the human asked for a run in this conversation; to look without spending, use gtm_preview_source. Returns the run's funnel (scanned / dropped / droppedIntent / added / duplicates / capped), the unmapped ICP facets, and `skipped` + `reason` when it could not run (no_seat, needs_config, icp_empty, daily_cap, lead_quota, no_results, provider_error).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • gtm_update_playChange a play's own knobs — name, goal, voice — its two switches, and the ACCOUNT's pacing (daily action cap, working hours: shared by every play on the LinkedIn account, not per p…Reads text others writeNo findings

    Why it is in this group

    • The name "gtm_update_play" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Change a play's own knobs — name, goal, voice — its two switches, and the ACCOUNT's pacing (daily action cap, working hours: shared by every play on the LinkedIn account, not per play). `paused: true` is the human's stop button (nothing runs, nothing is sent); `paused: false` resumes. `status: 'active'` LAUNCHES a draft; `status: 'draft'` takes it back off the road. Seat rule, enforced server-side: no live LinkedIn seat ⇒ neither launch nor resume makes it active — it stays/falls back to draft and the note says so. Launching or resuming kicks the play's due lanes at once. Only launch, resume or raise the cap when the human asked for it in this conversation: an active play spends the month's lead quota and acts from the human's own LinkedIn account. Does not touch the autonomy ladder.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: true
Changes things 8Claude Code: ask
  • gtm_connect_linkedinThe link a human opens to connect (or reconnect) their LinkedIn account to a play — the one cockpit step the play cannot run without.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "link": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The link a human opens to connect (or reconnect) their LinkedIn account to a play — the one cockpit step the play cannot run without. Hand the URL to the human, tell them to say when it is done, then call gtm_linkedin_status: the seat reads `classic` or `sales_navigator` once bound. The link expires in 15 minutes; call again for a fresh one. Nothing is sent, nothing is read from their account by this call.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • gtm_create_playCreate a fully-configured play in one call: the product (an existing productId, or a websiteUrl which seeds one and kicks its research), the play itself, the ICP facets, which sour…Reads text others writeNo findings

    Why it is in this group

    • The name "gtm_create_play" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a fully-configured play in one call: the product (an existing productId, or a websiteUrl which seeds one and kicks its research), the play itself, the ICP facets, which sourcing lanes are on, the autonomy ladder and the caps. Three rules are enforced server-side and cannot be talked around. (1) `activate` DEFAULTS TO FALSE — turning a play on spends the month's lead quota and takes real actions from the user's own LinkedIn account, so hand the human the returned cockpit link and let them press go. (2) A play with no live LinkedIn seat stays a draft whatever you pass. (3) Autonomy rules are written ONLY for the steps you name; every step you omit keeps gtmotto's own default, which is 'wait for a human'. Lanes that need their own seeds (post_engagers, competitor_posts, account_list) are refused if switched on without them.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • idempotentHint: false
  • gtm_estimate_icpHow big an audience a CANDIDATE ICP would reach — '≈ N companies match' — before committing to it.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    How big an audience a CANDIDATE ICP would reach — '≈ N companies match' — before committing to it. Writes nothing: no play, no ICP row, no cache. Use it to iterate (propose facets → see 40 → widen the locations → see 900 → then create the play). Returns null when the data provider has no key configured, which is not an error. Needs a write-scoped key only because it rides the gateway's action channel.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • gtm_play_statsThe play's Stats screen: the pipeline (leads sourced → warmed → invited → new connections → conversations started) over four windows — all time, last 30 days, last 7 days, last 24 …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The play's Stats screen: the pipeline (leads sourced → warmed → invited → new connections → conversations started) over four windows — all time, last 30 days, last 7 days, last 24 hours — each windowed count paired with the window before it as a percentage delta. 'Conversations started' counts real replies, never the openers Otto sent. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • gtm_set_sourceSwitch a lane on or off — the toggle on the Sources list.No findings

    Why it is in this group

    • The name "gtm_set_source" says "set": a word for a change.
    Description, as the server wrote it
    Switch a lane on or off — the toggle on the Sources list. Switching ON a lane that has nothing to run on (no companies, no intent/anchors/posts, no role) is refused: configure it first. An empty ICP is not a refusal — people_search may go on ahead of the ICP and comes back `blocked: icp_empty` until gtm_update_icp fills it. Switching OFF never fails and creates nothing. The lane then runs (or stops running) on the daily cadence; nothing runs inside this call.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • gtm_source_runsThe run history of ONE lane, newest first — the funnel over time (scanned → dropped by fit → dropped by intent → added / duplicates / capped), the ICP facets LinkedIn could not fil…1 finding

    Why it is in this group

    • The name "gtm_source_runs" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "gtm_source_runs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "gtm_source_runs" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The run history of ONE lane, newest first — the funnel over time (scanned → dropped by fit → dropped by intent → added / duplicates / capped), the ICP facets LinkedIn could not filter on, and the provider's status and message when it refused. Use it to tell 'the query returns nobody' from 'everyone was already a lead' from 'LinkedIn is rate-limiting the seat'. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • gtm_sources_referenceTHE REFERENCE for configuring sourcing lanes — read it before your first gtm_configure_source / gtm_set_source / gtm_run_source call.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    THE REFERENCE for configuring sourcing lanes — read it before your first gtm_configure_source / gtm_set_source / gtm_run_source call. Every lane (people_search, competitor_posts a.k.a. Post discovery, job_offers, account_list, and the retired post_engagers), every config field with its meaning, default and cap, the fit/intent/post gates, what makes a lane runnable, how the 5-minute tick and the 24h cadence work, what a preview costs versus a run, and what this surface deliberately will not do. No backend call; safe to call any time.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • gtm_update_icpChange the ICP a play runs — the query behind people_search and the fit gate on every other lane.No findings

    Why it is in this group

    • The name "gtm_update_icp" says "update": a word for a change.
    Description, as the server wrote it
    Change the ICP a play runs — the query behind people_search and the fit gate on every other lane. Seven string arrays, plain words (gtmotto normalises 'Swiss' → Switzerland, 'Fintech' → Financial Services itself): titles, seniority, languages, industries, sizes (headcount bands like '11-50'), locations, exclude ('never contact' — absolute). ONLY the facets you name change; the first write on a play forks its own ICP row from the product baseline (or a sibling play's row), so no other play's targeting is rewritten. Filling an empty ICP unblocks lanes parked on icp_empty and kicks the play's due lanes if it is active. Size a candidate first with gtm_estimate_icp.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
Only reads 7Claude Code: allow
  • gtm_linkedin_statusThe play's LinkedIn seat and today's headroom against the LinkedIn limits.No findings

    Why it is in this group

    • The name "gtm_linkedin_status" says "status": a word for reading.
    Description, as the server wrote it
    The play's LinkedIn seat and today's headroom against the LinkedIn limits. States: `no_seat` (nothing connected — the play cannot act), `seat_broken` (the account was disconnected or deleted; the queue is parked until a human reconnects), `pending`, `classic`, or `sales_navigator` (which search backend the ICP compiles to). Read-only. Connecting a seat is a browser flow — link the human to the cockpit for it.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • gtm_list_approvalsEvery drafted action that waits for the human — an invite note, a first message, a follow-up, a reply or a comment the planner wrote — with the draft, the 'why now', the lead, and …Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "gtm_list_approvals" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Every drafted action that waits for the human — an invite note, a first message, a follow-up, a reply or a comment the planner wrote — with the draft, the 'why now', the lead, and a cockpit link. One play, or the whole workspace when playId is omitted. Show each draft to the human before gtm_approve / gtm_reject; never decide for them. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • gtm_list_playsEvery play in the workspace with enough context to route on: which product it sells, whether it is active or paused, whether a LinkedIn seat is actually connected (`seatConnected: …No findings

    Why it is in this group

    • The name "gtm_list_plays" says "list": a word for reading.
    Description, as the server wrote it
    Every play in the workspace with enough context to route on: which product it sells, whether it is active or paused, whether a LinkedIn seat is actually connected (`seatConnected: false` means the play cannot act, whatever its status says), and how its leads are spread across the pipeline stages. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • gtm_preview_sourceDry-run ONE lane: '≈ N people match' and a 10-person sample, WITHOUT inserting a lead, spending the day's budget or moving the run clock.Reads text others writeNo findings

    Why it is in this group

    • The name "gtm_preview_source" says "preview": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dry-run ONE lane: '≈ N people match' and a 10-person sample, WITHOUT inserting a lead, spending the day's budget or moving the run clock. Same query, same gates, same scorers as a real run, on up to 50 people — so what it shows is what a run would keep. `size.precision` is honest: 'exact' (the query ran out inside the probe), 'atLeast' (the probe filled up; LinkedIn reports no total) or 'unavailable' (no seat, no config, paused play — `skipped` says which). Reports the ICP facets LinkedIn could not filter on (`unmapped`), facet values it had no id for (`unresolved`), which sampled people are `alreadyALead`, and on account_list what each company resolved to. Costs provider calls and, when a gate is on, model tokens. Refused on a paused play.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • gtm_show_playONE play in full — everything needed to judge it or copy it into a better one: goal and voice, the account's daily cap and working hours (shared by every play on the seat), the ICP…No findings

    Why it is in this group

    • The name "gtm_show_play" says "show": a word for reading.
    Description, as the server wrote it
    ONE play in full — everything needed to judge it or copy it into a better one: goal and voice, the account's daily cap and working hours (shared by every play on the seat), the ICP facets, the five sourcing lanes with their config and last run, the autonomy ladder (which rungs run alone and which wait for a human), the LinkedIn seat, and today's used/cap for the seat plus this play's share. Read-only. Pass a playId from gtm_list_plays.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • gtm_show_sourcesAll five sourcing lanes of a play, configured or not — the read to make before touching any of them.No findings

    Why it is in this group

    • The name "gtm_show_sources" says "show": a word for reading.
    Description, as the server wrote it
    All five sourcing lanes of a play, configured or not — the read to make before touching any of them. Per lane: `configured`, `on`, the parsed `config` (defaults filled), the cockpit's `summary` (null = needs setup), `blocked` (why it cannot run, judged without running: needs_config / icp_empty / null), last/next run and the last run's funnel, `addedToday`, `failures`, and the lane's memory — `accounts[]` with `found: true|false` per typed company on account_list, `harvestedPosts` on the post lanes, the cached `searches` the model wrote on Post discovery. Play level: `state` is the same verdict the cockpit shows when the Leads table is empty (no_sources / paused / draft / no_seat / seat_broken / icp_empty / needs_config / lead_quota / never_ran / no_results / provider_error / added_nothing / ok), plus provider, seat, ICP facet count and the month's remaining lead quota. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • gtm_whoamiWho this key belongs to, and what the workspace may do: org name, plan, subscription status, how many products and plays exist, and the LEAD METER (leads added this calendar month,…Reads private dataNo findings

    Why it is in this group

    • The name "gtm_whoami" says "whoami": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "calendar": it reads calendars.
    Description, as the server wrote it
    Who this key belongs to, and what the workspace may do: org name, plan, subscription status, how many products and plays exist, and the LEAD METER (leads added this calendar month, the plan's cap, and what is left). Start here — the remaining lead allowance is the one number that changes what is worth proposing. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

16 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write8
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__linkedin__gtm_forget_harvested_posts"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:33 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
14
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://agent.gtmotto.com/.well-known/oauth-protected-resource/mcp
Authorization servers
https://clerk.gtmotto.com
Legacy HTTP+SSE transport
no
Dynamic client registration
no
Client ID metadata documents
yes
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 14 tools that change things (6 destructive, 8 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://agent.gtmotto.com/mcp: tools/list returned 21 tools to an anonymous client, including gtm_configure_source (destructive), gtm_run_source (destructive), gtm_forget_harvested_posts (destructive), gtm_update_play (destructive), gtm_approve (destructive) and 9 more

    What this check looks for

Install

Pinned to version 1.2.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http linkedin https://agent.gtmotto.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__linkedin__gtm_whoami",
      "mcp__linkedin__gtm_list_plays",
      "mcp__linkedin__gtm_show_play",
      "mcp__linkedin__gtm_linkedin_status",
      "mcp__linkedin__gtm_show_sources",
      "mcp__linkedin__gtm_preview_source",
      "mcp__linkedin__gtm_list_approvals"
    ],
    "ask": [
      "mcp__linkedin__gtm_play_stats",
      "mcp__linkedin__gtm_estimate_icp",
      "mcp__linkedin__gtm_create_play",
      "mcp__linkedin__gtm_sources_reference",
      "mcp__linkedin__gtm_source_runs",
      "mcp__linkedin__gtm_set_source",
      "mcp__linkedin__gtm_update_icp",
      "mcp__linkedin__gtm_connect_linkedin"
    ],
    "deny": [
      "mcp__linkedin__gtm_configure_source",
      "mcp__linkedin__gtm_run_source",
      "mcp__linkedin__gtm_forget_harvested_posts",
      "mcp__linkedin__gtm_update_play",
      "mcp__linkedin__gtm_approve",
      "mcp__linkedin__gtm_reject"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as linkedin. Review it before you use it.

Capability tags behind 10 rules
  • mcp__linkedin__gtm_whoami private-data
  • mcp__linkedin__gtm_estimate_icp untrusted-input
  • mcp__linkedin__gtm_create_play untrusted-input
  • mcp__linkedin__gtm_preview_source untrusted-input
  • mcp__linkedin__gtm_run_source untrusted-input
  • mcp__linkedin__gtm_forget_harvested_posts outbound
  • mcp__linkedin__gtm_update_play untrusted-input
  • mcp__linkedin__gtm_connect_linkedin untrusted-input
  • mcp__linkedin__gtm_list_approvals private-data, untrusted-input
  • mcp__linkedin__gtm_approve untrusted-input