GTM Otto
by gtmotto.com · remote · no sign-in to list tools · v1.2.1 · published by com.gtmotto
Self-driving LinkedIn prospecting: it sources, warms and invites daily. You approve every message.
21 tools: 6 can delete or cancel things, 8 change things and 7 only read.
Scanned Oct 21, 2026
- Deletes or cancels6Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things8Claude Code: ask: see these tools
- Only reads7Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http linkedin https://agent.gtmotto.com/mcpFindings
Matches of fixed checks, with the text they matched.
- Warngtm_source_runs
The server marks "gtm_source_runs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "gtm_source_runs" says "run": a word for a change.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
21 tools
Deletes or cancels 6Claude Code: deny
gtm_approveApprove ONE drafted action by its approvalId (from gtm_list_approvals).Reads text others writeNo findings
Why it is in this group
- The name "gtm_approve" says "approve": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Approve ONE drafted action by its approvalId (from gtm_list_approvals). It then leaves on the seat's next slot, inside LinkedIn's limits — this is the human's tap, moved from the cockpit to the chat, so ONLY call it after showing them the draft and getting a yes in this conversation. An already-decided card is refused.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
- idempotentHint: true
gtm_configure_sourceWrite a lane's settings — upload an account list, set the Post-discovery intent and anchors, change the job keywords, move a gate.No findings
Why it is in this group
- The description's first verb is "write": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Write a lane's settings — upload an account list, set the Post-discovery intent and anchors, change the job keywords, move a gate. MERGE semantics: only the fields you send change. Lists (companies, postUrls, competitors) REPLACE by default; pass listMode 'append' to add to what is there (deduped, case-insensitive). Caps: 100 companies, 25 posts, 25 anchors — what did not fit comes back in `truncated`. Unknown fields are refused. Saving creates the lane's row if it never had one (OFF, because configuring is not switching on), makes the lane due again immediately and resets its retry backoff; on account_list it also forgets the cached misses so unfound companies are looked up again. Pass `on: true` to switch it on in the same call — refused, with nothing saved, if the lane would still have nothing to run on. Nothing runs inside this call: an ON lane on an ACTIVE play runs on the next tick (≤5 min); otherwise use gtm_run_source. Read gtm_sources_reference for each field's meaning.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
- idempotentHint: true
gtm_forget_harvested_postsThe tuning escape hatch for the post lanes.Can send data outNo findings
Why it is in this group
- The name "gtm_forget_harvested_posts" says "post": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- outboundThe name "gtm_forget_harvested_posts" says "post": it sends or publishes something to other people.
Description, as the server wrote it The tuning escape hatch for the post lanes. A post lane remembers every post it already paid to harvest so it never buys the same engagers twice — which makes it impossible to TUNE: change the intent or a gate, run, and the answer is 'no new posts since last time'. This clears that memory so the next run (or gtm_run_source) judges today's posts against the new settings. It COSTS: every forgotten post is a fresh engager fetch. Call it only after a deliberate settings change the human wants re-tested. Only competitor_posts and post_engagers have this memory.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
gtm_rejectReject (skip) ONE drafted action by its approvalId.No findings
Why it is in this group
- The name "gtm_reject" says "reject": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Reject (skip) ONE drafted action by its approvalId. Nothing is sent; the planner records the decline and re-plans around it instead of proposing the same step again. Ask the human first, as for gtm_approve.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
- idempotentHint: true
gtm_run_source'Run once now' — run ONE lane immediately through the same code the sourcing tick runs, with force: an OFF lane still runs (that is what run-once means while configuring), a DRAFT …Reads text others writeNo findings
Why it is in this group
- The name "gtm_run_source" says "run": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it 'Run once now' — run ONE lane immediately through the same code the sourcing tick runs, with force: an OFF lane still runs (that is what run-once means while configuring), a DRAFT play still runs (how you try a lane before launch), a PAUSED play does not. REAL: provider calls are made, leads are inserted, the play's daily budget and the org's monthly lead quota are spent. Only call it when the human asked for a run in this conversation; to look without spending, use gtm_preview_source. Returns the run's funnel (scanned / dropped / droppedIntent / added / duplicates / capped), the unmapped ICP facets, and `skipped` + `reason` when it could not run (no_seat, needs_config, icp_empty, daily_cap, lead_quota, no_results, provider_error).
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
gtm_update_playChange a play's own knobs — name, goal, voice — its two switches, and the ACCOUNT's pacing (daily action cap, working hours: shared by every play on the LinkedIn account, not per p…Reads text others writeNo findings
Why it is in this group
- The name "gtm_update_play" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Change a play's own knobs — name, goal, voice — its two switches, and the ACCOUNT's pacing (daily action cap, working hours: shared by every play on the LinkedIn account, not per play). `paused: true` is the human's stop button (nothing runs, nothing is sent); `paused: false` resumes. `status: 'active'` LAUNCHES a draft; `status: 'draft'` takes it back off the road. Seat rule, enforced server-side: no live LinkedIn seat ⇒ neither launch nor resume makes it active — it stays/falls back to draft and the note says so. Launching or resuming kicks the play's due lanes at once. Only launch, resume or raise the cap when the human asked for it in this conversation: an active play spends the month's lead quota and acts from the human's own LinkedIn account. Does not touch the autonomy ladder.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
- idempotentHint: true
Changes things 8Claude Code: ask
gtm_connect_linkedinThe link a human opens to connect (or reconnect) their LinkedIn account to a play — the one cockpit step the play cannot run without.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "link": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The link a human opens to connect (or reconnect) their LinkedIn account to a play — the one cockpit step the play cannot run without. Hand the URL to the human, tell them to say when it is done, then call gtm_linkedin_status: the seat reads `classic` or `sales_navigator` once bound. The link expires in 15 minutes; call again for a fresh one. Nothing is sent, nothing is read from their account by this call.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
gtm_create_playCreate a fully-configured play in one call: the product (an existing productId, or a websiteUrl which seeds one and kicks its research), the play itself, the ICP facets, which sour…Reads text others writeNo findings
Why it is in this group
- The name "gtm_create_play" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Create a fully-configured play in one call: the product (an existing productId, or a websiteUrl which seeds one and kicks its research), the play itself, the ICP facets, which sourcing lanes are on, the autonomy ladder and the caps. Three rules are enforced server-side and cannot be talked around. (1) `activate` DEFAULTS TO FALSE — turning a play on spends the month's lead quota and takes real actions from the user's own LinkedIn account, so hand the human the returned cockpit link and let them press go. (2) A play with no live LinkedIn seat stays a draft whatever you pass. (3) Autonomy rules are written ONLY for the steps you name; every step you omit keeps gtmotto's own default, which is 'wait for a human'. Lanes that need their own seeds (post_engagers, competitor_posts, account_list) are refused if switched on without them.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
- idempotentHint: false
gtm_estimate_icpHow big an audience a CANDIDATE ICP would reach — '≈ N companies match' — before committing to it.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it How big an audience a CANDIDATE ICP would reach — '≈ N companies match' — before committing to it. Writes nothing: no play, no ICP row, no cache. Use it to iterate (propose facets → see 40 → widen the locations → see 900 → then create the play). Returns null when the data provider has no key configured, which is not an error. Needs a write-scoped key only because it rides the gateway's action channel.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
gtm_play_statsThe play's Stats screen: the pipeline (leads sourced → warmed → invited → new connections → conversations started) over four windows — all time, last 30 days, last 7 days, last 24 …No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it The play's Stats screen: the pipeline (leads sourced → warmed → invited → new connections → conversations started) over four windows — all time, last 30 days, last 7 days, last 24 hours — each windowed count paired with the window before it as a percentage delta. 'Conversations started' counts real replies, never the openers Otto sent. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
gtm_set_sourceSwitch a lane on or off — the toggle on the Sources list.No findings
Why it is in this group
- The name "gtm_set_source" says "set": a word for a change.
Description, as the server wrote it Switch a lane on or off — the toggle on the Sources list. Switching ON a lane that has nothing to run on (no companies, no intent/anchors/posts, no role) is refused: configure it first. An empty ICP is not a refusal — people_search may go on ahead of the ICP and comes back `blocked: icp_empty` until gtm_update_icp fills it. Switching OFF never fails and creates nothing. The lane then runs (or stops running) on the daily cadence; nothing runs inside this call.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- idempotentHint: true
gtm_source_runsThe run history of ONE lane, newest first — the funnel over time (scanned → dropped by fit → dropped by intent → added / duplicates / capped), the ICP facets LinkedIn could not fil…1 finding
Why it is in this group
- The name "gtm_source_runs" says "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "gtm_source_runs" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "gtm_source_runs" says "run": a word for a change.
Description, as the server wrote it The run history of ONE lane, newest first — the funnel over time (scanned → dropped by fit → dropped by intent → added / duplicates / capped), the ICP facets LinkedIn could not filter on, and the provider's status and message when it refused. Use it to tell 'the query returns nobody' from 'everyone was already a lead' from 'LinkedIn is rate-limiting the seat'. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
gtm_sources_referenceTHE REFERENCE for configuring sourcing lanes — read it before your first gtm_configure_source / gtm_set_source / gtm_run_source call.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it THE REFERENCE for configuring sourcing lanes — read it before your first gtm_configure_source / gtm_set_source / gtm_run_source call. Every lane (people_search, competitor_posts a.k.a. Post discovery, job_offers, account_list, and the retired post_engagers), every config field with its meaning, default and cap, the fit/intent/post gates, what makes a lane runnable, how the 5-minute tick and the 24h cadence work, what a preview costs versus a run, and what this surface deliberately will not do. No backend call; safe to call any time.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
gtm_update_icpChange the ICP a play runs — the query behind people_search and the fit gate on every other lane.No findings
Why it is in this group
- The name "gtm_update_icp" says "update": a word for a change.
Description, as the server wrote it Change the ICP a play runs — the query behind people_search and the fit gate on every other lane. Seven string arrays, plain words (gtmotto normalises 'Swiss' → Switzerland, 'Fintech' → Financial Services itself): titles, seniority, languages, industries, sizes (headcount bands like '11-50'), locations, exclude ('never contact' — absolute). ONLY the facets you name change; the first write on a play forks its own ICP row from the product baseline (or a sibling play's row), so no other play's targeting is rewritten. Filling an empty ICP unblocks lanes parked on icp_empty and kicks the play's due lanes if it is active. Size a candidate first with gtm_estimate_icp.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- idempotentHint: true
Only reads 7Claude Code: allow
gtm_linkedin_statusThe play's LinkedIn seat and today's headroom against the LinkedIn limits.No findings
Why it is in this group
- The name "gtm_linkedin_status" says "status": a word for reading.
Description, as the server wrote it The play's LinkedIn seat and today's headroom against the LinkedIn limits. States: `no_seat` (nothing connected — the play cannot act), `seat_broken` (the account was disconnected or deleted; the queue is parked until a human reconnects), `pending`, `classic`, or `sales_navigator` (which search backend the ICP compiles to). Read-only. Connecting a seat is a browser flow — link the human to the cockpit for it.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
gtm_list_approvalsEvery drafted action that waits for the human — an invite note, a first message, a follow-up, a reply or a comment the planner wrote — with the draft, the 'why now', the lead, and …Reads private dataReads text others writeNo findings
Why it is in this group
- The name "gtm_list_approvals" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "note": it reads notes.
- untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
Description, as the server wrote it Every drafted action that waits for the human — an invite note, a first message, a follow-up, a reply or a comment the planner wrote — with the draft, the 'why now', the lead, and a cockpit link. One play, or the whole workspace when playId is omitted. Show each draft to the human before gtm_approve / gtm_reject; never decide for them. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
gtm_list_playsEvery play in the workspace with enough context to route on: which product it sells, whether it is active or paused, whether a LinkedIn seat is actually connected (`seatConnected: …No findings
Why it is in this group
- The name "gtm_list_plays" says "list": a word for reading.
Description, as the server wrote it Every play in the workspace with enough context to route on: which product it sells, whether it is active or paused, whether a LinkedIn seat is actually connected (`seatConnected: false` means the play cannot act, whatever its status says), and how its leads are spread across the pipeline stages. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
gtm_preview_sourceDry-run ONE lane: '≈ N people match' and a 10-person sample, WITHOUT inserting a lead, spending the day's budget or moving the run clock.Reads text others writeNo findings
Why it is in this group
- The name "gtm_preview_source" says "preview": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Dry-run ONE lane: '≈ N people match' and a 10-person sample, WITHOUT inserting a lead, spending the day's budget or moving the run clock. Same query, same gates, same scorers as a real run, on up to 50 people — so what it shows is what a run would keep. `size.precision` is honest: 'exact' (the query ran out inside the probe), 'atLeast' (the probe filled up; LinkedIn reports no total) or 'unavailable' (no seat, no config, paused play — `skipped` says which). Reports the ICP facets LinkedIn could not filter on (`unmapped`), facet values it had no id for (`unresolved`), which sampled people are `alreadyALead`, and on account_list what each company resolved to. Costs provider calls and, when a gate is on, model tokens. Refused on a paused play.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
gtm_show_playONE play in full — everything needed to judge it or copy it into a better one: goal and voice, the account's daily cap and working hours (shared by every play on the seat), the ICP…No findings
Why it is in this group
- The name "gtm_show_play" says "show": a word for reading.
Description, as the server wrote it ONE play in full — everything needed to judge it or copy it into a better one: goal and voice, the account's daily cap and working hours (shared by every play on the seat), the ICP facets, the five sourcing lanes with their config and last run, the autonomy ladder (which rungs run alone and which wait for a human), the LinkedIn seat, and today's used/cap for the seat plus this play's share. Read-only. Pass a playId from gtm_list_plays.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
gtm_show_sourcesAll five sourcing lanes of a play, configured or not — the read to make before touching any of them.No findings
Why it is in this group
- The name "gtm_show_sources" says "show": a word for reading.
Description, as the server wrote it All five sourcing lanes of a play, configured or not — the read to make before touching any of them. Per lane: `configured`, `on`, the parsed `config` (defaults filled), the cockpit's `summary` (null = needs setup), `blocked` (why it cannot run, judged without running: needs_config / icp_empty / null), last/next run and the last run's funnel, `addedToday`, `failures`, and the lane's memory — `accounts[]` with `found: true|false` per typed company on account_list, `harvestedPosts` on the post lanes, the cached `searches` the model wrote on Post discovery. Play level: `state` is the same verdict the cockpit shows when the Leads table is empty (no_sources / paused / draft / no_seat / seat_broken / icp_empty / needs_config / lead_quota / never_ran / no_results / provider_error / added_nothing / ok), plus provider, seat, ICP facet count and the month's remaining lead quota. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
gtm_whoamiWho this key belongs to, and what the workspace may do: org name, plan, subscription status, how many products and plays exist, and the LEAD METER (leads added this calendar month,…Reads private dataNo findings
Why it is in this group
- The name "gtm_whoami" says "whoami": a word for reading.
What it can reach
- private-dataThe description's first sentence says "calendar": it reads calendars.
Description, as the server wrote it Who this key belongs to, and what the workspace may do: org name, plan, subscription status, how many products and plays exist, and the LEAD METER (leads added this calendar month, the plan's cap, and what is left). Start here — the remaining lead allowance is the one number that changes what is worth proposing. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
16 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write8
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out1
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__linkedin__gtm_forget_harvested_posts"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:33 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 14
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- https://agent.gtmotto.com/.well-known/oauth-protected-resource/mcp
- Authorization servers
- https://clerk.gtmotto.com
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- no
- Client ID metadata documents
- yes
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 14 tools that change things (6 destructive, 8 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://agent.gtmotto.com/mcp: tools/list returned 21 tools to an anonymous client, including gtm_configure_source (destructive), gtm_run_source (destructive), gtm_forget_harvested_posts (destructive), gtm_update_play (destructive), gtm_approve (destructive) and 9 more
Install
Pinned to version 1.2.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http linkedin https://agent.gtmotto.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__linkedin__gtm_whoami",
"mcp__linkedin__gtm_list_plays",
"mcp__linkedin__gtm_show_play",
"mcp__linkedin__gtm_linkedin_status",
"mcp__linkedin__gtm_show_sources",
"mcp__linkedin__gtm_preview_source",
"mcp__linkedin__gtm_list_approvals"
],
"ask": [
"mcp__linkedin__gtm_play_stats",
"mcp__linkedin__gtm_estimate_icp",
"mcp__linkedin__gtm_create_play",
"mcp__linkedin__gtm_sources_reference",
"mcp__linkedin__gtm_source_runs",
"mcp__linkedin__gtm_set_source",
"mcp__linkedin__gtm_update_icp",
"mcp__linkedin__gtm_connect_linkedin"
],
"deny": [
"mcp__linkedin__gtm_configure_source",
"mcp__linkedin__gtm_run_source",
"mcp__linkedin__gtm_forget_harvested_posts",
"mcp__linkedin__gtm_update_play",
"mcp__linkedin__gtm_approve",
"mcp__linkedin__gtm_reject"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as linkedin. Review it before you use it.
Capability tags behind 10 rules
- mcp__linkedin__gtm_whoami private-data
- mcp__linkedin__gtm_estimate_icp untrusted-input
- mcp__linkedin__gtm_create_play untrusted-input
- mcp__linkedin__gtm_preview_source untrusted-input
- mcp__linkedin__gtm_run_source untrusted-input
- mcp__linkedin__gtm_forget_harvested_posts outbound
- mcp__linkedin__gtm_update_play untrusted-input
- mcp__linkedin__gtm_connect_linkedin untrusted-input
- mcp__linkedin__gtm_list_approvals private-data, untrusted-input
- mcp__linkedin__gtm_approve untrusted-input