Connecting an AI agent

What this actually is

Model Context Protocol is the standard way an AI assistant is given tools. Point a client at our endpoint, sign in, and it can list your automations, schedule a post, read your leads or send a message — inside your caps, under your autonomy setting, and on your audit log.

The endpoint is https://leadadapter.com/mcp. Opening it in a browser, with no credential at all, returns the catalogue and the tier of each tool, so you can see what the product does before you sign up for anything.

Nothing an agent does bypasses the rules. There is no agent budget, no agent exemption from the do-not-engage list, and no way for a model to raise a cap above the ceiling your plan allows.

Connecting a client

Claude and ChatGPT sign in with OAuth: you paste the endpoint, they register themselves and send you to a LeadAdapter sign-in page where you choose the workspace and approve. Cursor and anything running in a terminal use an API key instead.

Configuration file

For a client that authenticates with an API key rather than a browser sign-in:

{
  "mcpServers": {
    "leadadapter": {
      "url": "https://leadadapter.com/mcp",
      "headers": {
        "Authorization": "Bearer la_live_…"
      }
    }
  }
}

The server speaks these protocol versions: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26. Keys are shown once when they are created and can be revoked at any time.

The tool catalogue

This is generated from the server's own registry when the page loads, so it is exactly what your agent will see.

Tools above your plan stay visible and refuse when called, naming the plan that includes them. Hiding them would make a model tell you the product cannot do something it can — the one failure mode worse than a refusal.

This table is generated from the server's own registry, so it is the catalogue your agent actually sees. The same list is available without signing in at https://leadadapter.com/mcp. Tool names and descriptions are shown exactly as the server sends them.

What each plan can call

Every tool is listed on every plan. The badge is what decides whether it answers.

The response contract

Every tool answers in the same shape. The governance block is the part that matters: it says what happened, why, and how much of the budget is left, so an agent can plan rather than guess.

{
  "ok": true,
  "data": { },
  "governance": {
    "verdict": "queued",
    "reason": null,
    "remaining": { "dm": 137 }
  },
  "action_id": "01J…"
}

A refusal has the same shape. It is a result, not an error, so the model reads it and re-plans:

{
  "ok": false,
  "error": {
    "code": "cap_reached",
    "message": "…"
  },
  "governance": {
    "verdict": "blocked",
    "reason": "cap_reached",
    "remaining": { "dm": 0 }
  },
  "action_id": "01J…"
}

Anything that touches LinkedIn is executed by your browser, so it answers with a job to poll. Clients that support long calls may ask to wait — the server holds the call for up to 25 seconds:

{
  "ok": true,
  "status": "queued",
  "job_id": "01J…",
  "eta_seconds": 45,
  "governance": { },
  "action_id": "01J…"
}

What each verdict means for an agent

A refusal is a successful answer that says no. It comes back as a result the model reads, never as a protocol error the model cannot see — an invisible error is retried, and a retried LinkedIn write is the thing this whole product exists to avoid.

The complete list of refusal codes, and what to do about each, is on the governance page.

Dry runs and confirmations

Every write tool accepts dry_run: true. It returns the exact verdict the real call would produce — including the refusal and the remaining budget — and changes nothing. It is the right first move for an agent that has just been handed a new account.

Destructive tools refuse unless they are called with confirm: true. Cancelling a scheduled post, archiving an automation, deleting a lead page and pausing a channel all need it, so that no single confident sentence from a model can undo work you did not ask it to touch.

Loadouts

A loadout is a named job: a system prompt, a list of tools the agent may use for it, and defaults that already make sense. It is packaging rather than new capability, which is exactly why it works — most of the difference between a useful agent and a dangerous one is scope.

Rate limits and versions

The endpoint accepts up to 120 requests a minute per session. A client may ask a tool that runs in your browser to wait for the result; the server holds the call for up to 25 seconds and then hands back a job id to poll instead.

Supported protocol versions: 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26. The server answers with the version your client asked for when it can, and with the newest one it speaks when it cannot.